Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Tue, 25 Oct 2005 18:21:48 +0200

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] 
> Sent: Tuesday, October 25, 2005 5:59 PM
> To: COMBES Jean-Michel RD-MAPS-ISS
> Cc: Gerardo Giaretta; Kilian Weniger; Alexandru Petrescu; 
> [email-masked]
> Subject: Re: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> 
>  In your previous mail you wrote:
> 
>    >    If you want to update the DNS servers frequently, 
> DNSSEC cannot be
>    >    usable:
>    >    - for each update you will have to sign the zone
>    >    - for each update you will have to transfer the 
> signed zone to the
>    >    secondary servers
>    >    ...
>    >    
>    > => this is not true: you can use dynamic updates and you can 
>    > put the critical RRs in a small zone in order to mitigate the 
>    > main issue of dynamic updates with DNSSEC 
>    
>    Maybe, this is a solution but that will depend a lot on 
> the number of HA
>    the MSP will manage
> 
> => I can't see why... dynamic update is a valid way to manage 
> leaf zones.

My concern was about the signature of the zone and so the size of this
zone. 

> 
>    and you will still have to transfer the signed zone to the
>    secondary servers.
>    
> => the propagation of updates is a part of the dynamic update 
> mechanism (i.e., you have not to worry about).

Ok .. but how long the propagation will take? We can have cache problems
too ...
I am not sure this is a good solution to modify DNS data frequently if
DNSSEC is used.

>    
>    > (the private key 
>    > must be online).
>    
>    Which private key?
> 
> => the private part of the zone signing key pair.
> 
>    The one used to sign the zone or to secure the updates?
> 
> => the first one.
> 
>    If this is the first one, the habit is to avoid to put it 
> online (I know
>    you know that :)
>    
> => this is why DNSSEC and dynamic updates are not "friendly".
> 
>    >    So forget DNSSEC in such a case: result, no more security.
>    >    
>    > => I disagree: the only real problem with DNSSEC is it is not 
>    > yet deployed.
>    
>    This is for me another issue (BTW, today, IKEv2 is not 
> deployed too and
>    most of the work in mip6 are on IKEv2).
>    
> => this is because IKEv1 is so limited (cf my comments about 
> the bootstrapping with IKEv1 I-D). And DNSSEC is an 
> infrastructure, something which is always hard to deploy.
> 
> Regards
> 
> [email-masked]
> 

Regards.

JMC.

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6