Subject: Re: General comments on DNSSEC

From: Greg Hudson <[email-masked]>
Date: 16 Jun 2002 12:14:57 -0400

On Sun, 2002-06-16 at 12:01, Andy W. Barclay wrote:
> I agree about using DNS to distribute keys, and that would convince me 
> that DNSSEC is still worthwhile, however, with the draft suggestion to 
> limit the KEY RR, and with DNSSEC taking so long to be deployed, I feel 
> that people requiring secure key-based protocols won't wait for
> DNSsec. I've checked the working group drafts, and I can't find any
> that are working on storing application keys in the DNS. Is anyone aware
> of work being done in this area - possibly outside the WG?

I think there are some people experimenting with doing this for ssh and
possibly for IPsec.

Both of those applications already have their own specialized security
protocol which merely needs to be seeded with a private key.  Most
applications are not in that situation, and no one in an application
working group wants to invent a new security protocol just to get a
particular key management behavior.

Perhaps the easiest way to gain acceptance would be to define SASL
and/or GSSAPI mechanisms which use keys or key fingerprints in DNS,
protected by DNSSEC, to bootstrap a security association.  (People who
don't want to trust the DNS authority chain could use other mechanisms,
so Keith's objection would be covered, I think.)  Still a difficult
road, though.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jakob Schlyter <[email-masked]>
Date: Sun, 16 Jun 2002 18:23:05 +0200 (CEST)

On Sun, 16 Jun 2002, Andy W. Barclay wrote:

> I've checked the working group drafts, and I can't find any that are
> working on storing application keys in the DNS. Is anyone aware of work
> being done in this area - possibly outside the WG?

draft-schlyter-appkey-02.txt
draft-schlyter-pkix-dns-02.txt

	jakob