Subject: Re: draft-arends-dnsnr-00

From: Greg Hudson <[email-masked]>
Date: Sun, 25 Jul 2004 12:22:18 -0400

On Sat, 2004-07-24 at 19:21, Paul Vixie wrote:
> No.  Close, though.  Non-repudiation means being able to prove that
> a third party can't prove that a transaction did not take place.  Count
> the negations.

Source?  Googling around yields definitions like:

  "Nonrepudiation is a way to guarantee that the sender of a message
  cannot later deny having sent the message and that the recipient
  cannot deny having received the message."
  (http://www.webopedia.com/TERM/N/nonrepudiation.html)

and

  In general, nonrepudiation is the ability to ensure that a party
  to a contract or a communication cannot deny the authenticity of
  their signature on a document or the sending of a message that
  they originated.
  (http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci761640,00.html)

These definitions agree with my understanding from cryptography courses,
Schneier, et al.  Your definition puzzles me.

Non-repudiation would seem to be a sensical property for financial
transactions; it doesn't seem terribly relevant to DNS.

(Apologies for perpetuating the discussion over the least important
aspect of the draft.  nsecN for some value of N seems like a fine
name--nsec2 seems to make the most sense for external consumption, nsec3
for internal communication.  I don't know which the IETF generally
favors.  The proposal itself seems like a nice way of integrating hashes
into nsec records without mandating that everyone use them, but of
course people have pointed out that hashes may not be terribly effective
at preventing zone traversal.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>