Subject: RE: Scale (and the SRV record)

From: Graham Bland <[email-masked]>
Date: Fri, 30 Oct 1998 09:32:51 -0000

Large portions of original message deleted for readability, relevant
sections only maintained with comments in line.

Graham Bland

> -----Original Message-----
> From: Alan Lloyd [mailto:[email-masked]]
> Sent: 29 October 1998 21:37
> To: 'Bill Burr'; Alan Lloyd; 'Phillip M Hallam-Baker'; Russ Housley;
> [email-masked]
> Subject: RE: Scale (and the SRV record)

...deleted
> > I have been saying for some time that don't know of anybody who has
> > built
> > an X.500 directory of a size that convinces me that it is a viable
> > technology to base a US national PKI, or even a US Federal
> > government-wide
> > PKI on. I keep asking the question, where are the really big
> > distributed
> > X.500 directories? Particularly multivendor directories.  
> But I don't
> > seem
> > to get any answers.  What I hear are horror stories about the
> > difficulties
> > of getting any two X.500 products to work together.
> 	[Alan Lloyd]  
> 	No horror stories from us. 20 million entries, 1000s of searches
> a second, distributed, multi master, etc We have very scaleable,
> distributed technology - that also integrates LDAP servers, etc We are
> very busy deploying X.500 into major corporate infrastructures who are
> following the themes I described. Including those in the US. 
> Please read
> our WEB site. "Uses of Directory Services"
> 

Can I access these directories or are they private islands.  If they are
private islands then they might as well not exist.

> >   If the X.500 directory industry builds products that interoperate
> > and scale
> > well, it has done a really bad job of getting the word out.  
> 	[Alan Lloyd]  
> 	My view here is that the LDAP hype has done a really good job of
> damaging X.500. However, now the LDAP hype has dissipated and reality
> has set in we are left with a protocol that can only ACCESS a 
> directory
> service ? is twice as big as DAP and has half the functionality. In
> addition, getting LDAP only solutions is proving to many that X.500 is
> the way to go because of LDAPs NO distribution and a model 
> that demands
> Replicate everything to everywhere. LDAP has high operational 
> costs and
> gets to a point where it is unworkable.
> 	So LDAP accessed X.500 in my book is the way to go and is being
> deployed globally.

I think you meant to say DAP accessed X.500 from the flow of the text

> 
> >  Until now, I have also been saying, does anybody have a believable
> > alternative to the mythological, pervasive X.500 directory service?
> > It
> > seemed almost a rhetorical question.  But I think perhaps Phill has
> > outlined an alternative, that looks like it probably ought to work,
> > and is
> > based on something, DNS, that we know works well, scales well, and
> > exists
> > now. Moreover, we should be able to create the service we need
> > incrementally, by just by adding servers as we need them, one at  a
> > time.
> > And, If I understand the proposal, all we have to do is 
> agree on some
> > simple naming conventions.
> 	[Alan Lloyd]  I am not against alternative proposals - its all a
> question of how much effort and implementation goes behind it. Phills
> solution has to be backed by all the DNS and PKI suppliers on this
> planet and DNS then has to become secure - with signed operations,
> mutual authentication, access controls, real life naming, and scale a
> lot better and of course be easy to manage and follow Object Oriented
> design. (does this mean turning DNS into X.500?) I would vote 
> for that -
> thats more X.500!

Why would DNS need to be more secure with signed operations mutual
authentication etc. Certificates and CRLs are signed objects and their
security is inherent.   Ignoring denial of service I cannot see any
attacks from an insecure distribution method.  The whole point of the
distribution method is that I have no trust relationship with it and
have no need of a trust relationship be it email, X.500 or anything
else.

How is it relevant if DNS follows OO design, why should it.  While I
agree that OO design and methods have many advantages the relevant
questions are does it work and how much will it cost, not what its
internal structure is.

What is the problem with the scalability of DNS (How many users does it
support now ?)

X.500 is easy to manage? later you say "But LDAP did prove that
directorys are difficult
 and complex and X.500 got most things right."  

Graham Bland

---

From: Michael Helm <[email-masked]>
Date: Fri, 30 Oct 1998 09:05:09 -0800

> security is inherent.   Ignoring denial of service I cannot see any

This is theoretically true, but then, aren't you setting yourself
up for an attack based on a single (or small integer number) point 
of failure?  For example maybe I could trick you into using 
a bad certificate database (by breaking into a login of yours
somewhere & trojanning your personal software) but I may not 
have enuf access to change your ldap server's certificate db or
trojan your secure dns.  If these things were doing signed operations
you may be able to notice you have a problem, or you may make the
attacker's need to fool you more complex & expensive.

On the other hand, would price would we pay for this complexity?
Would we somehown make operations more insecure and/or less reliable?

> What is the problem with the scalability of DNS (How many users does it

The current commonly used software is terribly memory-intensive
& adding gigantic certificate data-blobs to that is scary. 
If your dns stops working the internet (as far as you are concerned!)
goes away. Of course the software will improve.