Subject: Re: draft-itojun-ipv6-nodeinfo-revlookup-00.txt

From: Ted Lemon <[email-masked]>
Date: Wed, 24 Jul 2002 20:06:51 -0700

> Returning to your idea, it sounds attractive.  However, I'm not sure
> if this approach is applicable widely.  In particular, I'm not sure if
> "edge devices" such as personal laptops, PDAs, cell phones..., for
> which the nodeinfo-revlookup would be most useful, have private keys
> authorized in the DNSSEC framework.

Why not?   I think they do probably have private keys, and configuring them 
with the private side of a DNSSEC key doesn't sound very hard.   It does 
sound like it would be quite useful.   :')

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: JINMEI Tatuya / 神明達哉<[email-masked]>
Date: Fri, 26 Jul 2002 02:03:39 +0900

>>>>> On Wed, 24 Jul 2002 20:06:51 -0700, 
>>>>> Ted Lemon <[email-masked]> said:

> sound like it would be quite useful.   :')

It is probably okay to assume the devices have some private keys.  My
concerns (or what I'm not sure about) are:

- how to register the keys to DNS.  Manual configuration (by an
  administrator) is not realistic for general cases, but I'm not sure
  if DNS dynamic update is effective.
- how to construct the trust chain of DNSSEC toward the root zone.
  The zone to which the edge devices belong is presumably a kind of
  "personal" one, and we may not always assume it is a secure zone.
  In fact, in my understanding the current trend of DNSSEC is to
  restrict signed zones to some "well-known" ones such as a zone
  containing famous commercial web servers.

Some may have an idea to deal with this, though.  If there is a
concrete idea of an entire system, I'm very interested in it.

					JINMEI, Tatuya
					Communication Platform Lab.
					Corporate R&D Center, Toshiba Corp.
					[email-masked]

---

From: David Terrell <[email-masked]>
Date: Fri, 26 Jul 2002 11:52:20 -0700

>   if DNS dynamic update is effective.

In the mobile, dynamic IPv6 world, it seems like having public keys 
in DNS would be fairly common for things like secured NSUPDATE, so the
host would already be doing this.

>   containing famous commercial web servers.

Something tells me that a lot of people on this mailling list will have
signed, secure zones long before these famous commercial web servers...

-- 
David Terrell          | Step 1: "configure one system using your GUI"
[email-masked]           | Step 2: "now configure 1000 more"
Nebcorp Prime Minister |   - Casper H.S. Dik
http://wwn.nebcorp.com |