Subject: Re: draft-griffin-ssh-host-keys-in-dns-00.txt

From: Jeffrey Altman <[email-masked]>
Date: Sat, 3 Feb 2001 20:22:15 EST

> Bill Sommerfeld <[email-masked]> writes:
> 
> > I believe that:
> > 
> > 	"Storing SSH Host Keys in DNS"
> > 	draft-griffin-ssh-host-keys-in-dns-00.txt
> > 
> > should be made a working group document.
> > 
> > Please send comments on whether or not this makes sense to this list,
> > (as well as technical or other comments on the document itself).
> 
> I don't know very much about DNS and DNSSEC internals (in particular,
> I'm not sure how delegation/trust is supposed to flow across the dns
> tree).
> 
> But the general idea of storing host keys in DNS makes a lot of sense
> to me, and I welcome work on this in the wg.
> 
> /Niels
> 

Using DNS to distribute host keys only makes sense if and only if
DNSSEC is used at the same time.  Otherwise, DNS can be used to spoof
the host key for a server.

---

From: Darren J Moffat <[email-masked]>
Date: Sat, 03 Feb 2001 18:25:17 -0800

> the host key for a server.

Agreed.  Okay now please forgive my ignorance of DNSSEC and the
slight digression to what is probably more of an implementation issue
than a protocol issue:

Does DNSSEC require/allow using a new API so that the calling program
knows that it got the data back from a secure DNS service ? 

Consider that most implmentations will currently call the platform
functions to resolve a hostname, eg gethostbyname()/getaddrinfo() on
platforms that have a name service switch the calling application has
no way to know which name service the data came from never mind if the
DNS lookup was secure.  So in this case why should we trust the keys we
get back - which if I understand correctly this is what Jeffrey was
saying.

So maybe what is needed is an implementation note in the draft that
says that if app is going to get SSH keys from DNSSEC then it SHOULD
use DNSSEC directly to resolv hosts rather than using functions 
provided by the platform which may hide the details of the name service
from the caller.  But on the other hand I dislike applications that
call into the DNS resolver libaries directly on Solaris because they
bypass the valuable caching provided by the name service switch -
of course you can always argue that caching an security don't mix
very well.

--
Darren J Moffat