Subject: Re: the KEY debate

From: Paul Vixie <[email-masked]>
Date: Sun, 04 Aug 2002 19:40:59 +0000

> I would just like to interject at this point that if the WG's goal is to 
> find the *best* way to put keys in the DNS, we are doomed to fail.   The 
> best is the enemy of good enough.   The KEY record was not good enough, and 
> I think there's consensus on that, but we will never find out what the best 
> is if we don't come up with something that's good enough, try it, and learn 
> from it.

the working group had better show some leadership, in that case.  saying that
KEY is wrong for applications due to subtyping is merely _true_.  let's try
for _helpful_.

1. subtype with subdomains that have leading underscores, like SRV does.
2. carry the key data itself in TXT RR's.

if someone writes up a draft showing how openpgp keys and x509 certs can
be carried in that fashion, then this whole debate will be over, because
you will have demonstrated some leadership.

until you do that, all you're doing is trying to take something away from
the "appdev" community, and they will fight you to the last binary digit,
regardless of the truth of your arguments.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ólafur Guðmundsson<[email-masked]>
Date: Mon, 05 Aug 2002 01:41:50 -0400

>you will have demonstrated some leadership.

I real sorry to see the efforts of trying to define other ways to
carry keying information via DNS are not progressing.

SIKED BOF showed us that "unified" approach will not work (IMHO) as the
"security mafia" will demand (rightly so) a solid security consideration
section that covers all applications (a NP complete task).
We need to see if application specific type approach will work as
writing a security consideration section for one particular 
application/protocol should be much simpler.

The other thing that needs to be addressed is that different applications
have different keying needs, some require Certificates, others require the
public key information, others can get away with a signed key footprint.

The real reason I think the separate RR type approach is the best one,
has to do with dynamic update of application key information.
E-mail keys will be updated by the email administration people,
IPSEC keys by the remote access group, etc.
It is much simpler to grant authority to update a single type for,
existing names than allowing the creation/deletion of SRV style name
such as _sec._ip.<name>

The best the DNSEXT working group right now is to help application
people to draft proposals that suite each application needs.

         Olafur

---

From: Edward Lewis <[email-masked]>
Date: Mon, 5 Aug 2002 14:40:27 -0400

>regardless of the truth of your arguments.

I would think that a better approach would be to document what 
determines whether a design of a resource record is "good" or "bad." 
The document would not need to be a tutorial to RR proposers as much 
as it would be a resource for DNS reviewers to say "I don't like this 
RR because of what's in section x.y."

A well designed solution to an application key in DNS would have to:
     1) Solve the problem facing the application
     2) Do so in a way that is in accordance with appropriate security practices
     3) Be copacetic with DNS

As the DNS community is just one leg of this, I would think that the 
best we could hope for is defining what is copacetic.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer