Subject: Re: I-D ACTION:draft-ietf-dnsext-restrict-key-for-dnssec-03.txt

From: Jim Reid <[email-masked]>
Date: Wed, 10 Jul 2002 01:23:45 -0700

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> Given a name of a host, to find the SSH key you prepend
    Simon> "ssh.".  In your examples, the answer to your question
    Simon> would be "ssh.fugue.com IN APPKEY", "WWW.fugue.com IN
    Simon> APPKEY" and "FTP.fugue.com IN APPKEY", respectively.
    Simon> What's the problem?

Well what if I had a host called ssh.fugue.com? Or what if prepending
the protocol name makes the overall domain name too long? I think that
prepending the protocol name isn't so bad though it is a bit ugly. But
the label for the protocol name should probably include an underscore
so it doesn't clash with a hostname, just like underscores in SRV
records.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jim Reid <[email-masked]>
Date: Wed, 10 Jul 2002 04:55:26 -0700

>>  Well what if I had a host called ssh.fugue.com?

    Simon> Yes, how does that create a problem?

Apologies,I was not clear. Suppose I delegate ssh.fugue.com and
there's an A record for fugue.com which has an ssh key. In your
scheme, that ssh key would have to go in the child zone which may be
under a different administrative control.