Subject: Re: DNSEXT WGLC: NO record

From: Peter Koch <[email-masked]>
Date: Fri, 06 Apr 2001 18:14:34 +0200

> What I thought about was that some of the problems with NXT might not
> be visible at the registry level -- like the zone walking problem.
> Registries won't consider it to be an issue, they don't store SSH host
> keys, personal PGP keys etc in DNS.  Registries aren't the "end-users"
> of DNS data. Once the registries (the infrastructure) use DNSSEC,

Do you want to say that preventing zone-walking is not important for TLD
registries? From what I've heard it's the other way round. While for most
of the other zones it is a matter of server load, security by obscurity
or even phantasy, they have blocked access to "their" zones to avoid
a whole lot of non-technical problems. So, any backdoor, like in NXT,
will delay deployment.

-Peter

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Simon Josefsson <[email-masked]>
Date: 17 Apr 2001 16:46:38 +0200

Peter Koch <[email-masked]> writes:

> registries? From what I've heard it's the other way round.

I think it's important for some, and not important for others -- and
for the same reason that some operators allow anonymous zone transfers
and others don't.  I know at least .SE and .NL, which both have been
visible in DNSSEC testing, allow zone transfers, so there wouldn't be
a need to "walk" these zones for information.

With the "end-users" of DNS above I meant companys and organizations
that will be running DNS(SEC), and I think the zone walking issue will
be regarded (by themself) as more problematic.  TLDs that disallow
zone transfers might also agree, depending on their reasons for not
allowing zone transfers.