Subject: Re: draft-itojun-ipv6-nodeinfo-revlookup-00.txt

From: [email-masked]
Date: Sun, 21 Jul 2002 09:07:36 +0900

>What do people think of signing the ICMP packet with the private key that 
>corresponds to a KEY RR that is attached to the name mentioned in the ICMP 
>packet?

	i may be asking a stupid question, but where do you get that private
	key from?  for instance, if a node responds with "www.ietf.org",
	we could get a public key for www.ietf.org by KEY RR query, but
	not the private key (it's on ietf.org authoritative server, and
	is not accessible from outside).

itojun

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Wed, 24 Jul 2002 23:28:45 +0900

>>>>> On Wed, 24 Jul 2002 22:56:04 +0900, 
>>>>> [email-masked] said:

>>> no, the device answering ICMPv6 request is not named.
>> ??? I'm a bit confused.  Are you saying that we can *not always*
>> assume the device answering ICMPv6 request runs a name server?

> 	the thread of email assumes the following diagram.

>> client resolver ---------> named -------> the target
>> DNS query        NI query
>> client resolver <--------- named <------- the target
>> DNS response     NI response

Hmm, I read the Ted's message

>>>>> On Sat, 20 Jul 2002 16:53:10 -0700, 
>>>>> Ted Lemon <[email-masked]> said:

> corresponds to a KEY RR that is attached to the name mentioned in the ICMP 

to mean the diagram like this:

                   NI query
nodeinfo client ------------------> the target
                                    with named (authorizing the name)
                                    and private key
                <------------------
                   NI response signed
                   by the private key

(BTW: I understood the very original idea of this thread meant the
diagram you showed.)

But if I just misunderstood, please ignore me.  I was just checking.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: "Jeroen Massar" <[email-masked]>
Date: Wed, 24 Jul 2002 16:21:53 +0200

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

> > client resolver <--------- named <------- the target

As I was toying around with Opportunistic Encryption it shaded another
light on this subject.
Could there be a query type which requests the KEY (just like the DNS
RR) of a host.
This would allow for example FreeS/WAN and Racoon and other IPSec
implementations to request
the public KEY from the host itself in a standardized way. The proposed
DNS<->nodeinfo could
then also provide this information over DNS. Ofcourse one has no 100%
ensurance that the replied
KEY is valid at all.

Greets,
 Jeroen