Subject: Re: I-D ACTION:draft-ietf-dnsext-restrict-key-for-dnssec-03.txt

From: Ted Lemon <[email-masked]>
Date: Tue, 9 Jul 2002 10:57:36 -0500

> ... you can't tell for sure what a host is. How do you find the SSH key
> for the host "fugue.com" in your example? How do you find the "WWW" or 
> "FTP"
> key?

Why, you use the PTR record!

No, seriously, if fugue.com doesn't have an A record (and thus, a related 
appkey) then it has a CNAME that points you to the True Name of the host, 
doesn't it?   So the appkey is going to be hanging off the appropriate 
subdomain of the CNAME.   This isn't a problem, other than that it might 
make the appkey lookup code a little more tricky - it's a Simple Matter Of 
Programming.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 09 Jul 2002 18:14:38 +0200

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

Peter Koch <[email-masked]> writes:

>> Let's say I have a host, toccata.fugue.com, with sshd running on it.   So 
>> what's wrong with having an APPKEY hanging off of sshd.toccata.fugue.com?   
>
> While applications nicely fit into the hierarchical model (as well as
> e.g. interface names) ...
>
>> We don't currently use subdomains of hostnames - what's the conflicting use 
>> that we're ruining by doing this?
>
> for the host "fugue.com" in your example? How do you find the "WWW" or "FTP"
> key?

Huh?  In a DNS-centric world; a host is a domain name with at least
one IN A, IN A6 or IN AAAA record.

Given a name of a host, to find the SSH key you prepend "ssh.".  In
your examples, the answer to your question would be "ssh.fugue.com IN
APPKEY", "WWW.fugue.com IN APPKEY" and "FTP.fugue.com IN APPKEY",
respectively.  What's the problem?

I'm not saying prepending "ssh." is a good solution, but the only
argument against it presented so far seem to be design religious ones.