Subject: Re: Access controls on DNS queries (was RE: [no subject])

From: bert hubert <[email-masked]>
Date: Mon, 3 Jun 2002 20:50:25 +0200

On Mon, Jun 03, 2002 at 09:33:09AM -0400, Loomis, Rip wrote:

> Actually, if it's for MS and it starts out based on GSS-TSIG, then
> it likely would scale...it just wouldn't be highly interoperable.

There are a lot of GSS-TSIG documents out there currently and it looks like
there is enough available to write an implementation. But it has proved too
complex for us to determine this within a working day of trying to make
sense of what is what, and if everything is there.

Does anybody know if it is theoretically possible to interoperate with
GSS-TSIG from something that is not written on Windows or tightly integrated
with it?

We'd love to be able to authenticate the origin of W2K dynamic updates and
authorize them.

Regards,

bert hubert
PowerDNS

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Rob Austein <[email-masked]>
Date: Mon, 03 Jun 2002 17:33:47 -0400

At Mon, 3 Jun 2002 09:33:09 -0400, Rip Loomis wrote:
> 
> On Sunday, 02 June, 2002 06:40, Rob Austein wrote:
>>
>> This was an explict non-goal for DNSSEC (RFC 2535 et seq).  DNSSEC
>> explicitly does not attempt to provide confidentiality.
> 
> True, but he didn't ask for confidentiality on the wire--or if that
> was what he wanted then it wasn't clear.  I read it as asking about
> access control on specific data--it's not an uncommon request/
> problem.

Rip is correct.  My oops.