Subject: RE: (ngtrans) Joint DNSEXT & NGTRANS summary

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 9 Aug 2001 08:15:19 -0700

> Understood.  But very little of that security benefit is 
> really due to NAT; most of it is due to the fact that 
> connections have to be initiated from within.  That's 
> certainly an artifact of NAT (actually NAPT) but it can 
> be done just as easily without translating addresses.

Unfortunately the problem with anything labelled 'security'
is that once it is installed it is practically impossible 
to shift.

We still have people who refuse to countenance moving from
DES which has been broken in practice to AES because they
don't know how secure AES will prove... well duuhh, it ain't
gonna be worse than DES. So we give them 3DES rather than argue.

Co-opting the NAT box as you suggest to become a 6 to 4 type
box is the real answer. Wishing they will go away is simply
futile.

		Phill

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 22 Aug 2001 18:01:47 -0700

In retrospect, I believe I made at least one mistake when writing the A6
RFC, which is going for a "full recursion" model. This triggers all
kinds of "interesting" possibilities. Going for a site model would have
been more appropriate: basically, one could request that the "prefix
domain name" points to a set of AAAA records, allowing for exactly one
level of indirection. 

-- Christian Huitema