Subject: Re: draft-itojun-ipv6-nodeinfo-revlookup-00.txt

From: [email-masked]
Date: Mon, 22 Jul 2002 07:24:14 +0900

>> 	i may be asking a stupid question, but where do you get that private
>> 	key from?  for instance, if a node responds with "www.ietf.org",
>> 	we could get a public key for www.ietf.org by KEY RR query, but
>> 	not the private key (it's on ietf.org authoritative server, and
>> 	is not accessible from outside).
>Presumably the device answering the ICMP request is the one named,
>and therefore knows the private key associated with its name.

	no, the device answering ICMPv6 request is not named.

	with the "type ipv6nodeinfo" directive, named will work like this:
	- accept DNS query from a DNS client resolver.
	- send NI query to the target address.
	- receive NI response from the target.
	- send DNS response to the original DNS client resolver.

	since the NI query target can return arbitrary FQDN (like
	"www.ietf.org") named does not have the private key.

client resolver ---------> named -------> the target
		DNS query	 NI query
client resolver <--------- named <------- the target
		DNS response     NI response

itojun

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>