Subject: [Sip] sip-connect-reuse-03

From: Cullen Jennings <[email-masked]>
Date: Wed, 02 Mar 2005 21:52:39 -0800

I think I finally figured out what my disconnect with all this is. This
assumes that DNS is secure. It's not. Solutions that do not assume DNS is
secure can not take advantage of the load balancing properties that SRV
provides. You have pointed out this is a problem with some my proposals and
I agree. 

Do we need to pick our poisons or can we adapt this to get the best of both?

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Thu, 03 Mar 2005 08:00:32 -0800

> Do we need to pick our poisons or can we adapt this to get the best of both?

Define "secure". We need to be careful to not go overboard
when evaluating solutions. The root zone is not signed, that
is true, but that doesn't necessarily disqualify DNS from
having a part in a "secure" solution. If you're _directly_
using DNS as a trust anchor you obviously have to be very
careful about the security tradeoffs, but if you're using
DNS to just lead you to another trust anchor (eg, SRV to 
something with TLS server certs), the risks are fewer.

The other thing to keep in mind is that DNSsec is still
(unfortunately) a solution in search of a problem. Or at
least a problem whose energy barrier is low enough to
convince people that signing their zones is worthwhile.
In some respects, putting _more_ stuff on the shoulders
of DNS may in fact be a greater good if it finally leads
to signing those zones.

		Mike