Subject: DNSSEC and NAPTR RRsets

From: "bill" <[email-masked]>
Date: Thu, 20 Jun 2002 21:21:12 +0800

Hi, folks:

 I want to use DNSSEC to encrypt the NAPTR (type=35) RRset. Can I do that?

 Best Regards

 Bill
 
 2002/06/20
��h�{.n�+���zwZ��,j��v�y�覗���ު笷�)������"�a{
+w�����r��{��jȧ�W��w���^��,j�{[���j�!����m��������_����X����jg���iz�?

---

From: Roy Arends <[email-masked]>
Date: Thu, 20 Jun 2002 16:06:47 +0200 (CEST)

>  I want to use DNSSEC to encrypt the NAPTR (type=35) RRset. Can I do that?

No, you are currently not able to encrypt RRsets. The DNSSEC standards
only have a solution for Signing RRsets.

If you mean signing a NAPTR RRset, I see no reason why not.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Thu, 20 Jun 2002 09:48:06 -0400

From RFC 2535 (DNSSEC base spec):

2.1 Services Not Provided

...

    No effort has been made to provide for any confidentiality for
    queries or responses.  (This service may be available via IPSEC [RFC
    2401], TLS, or other security protocols.)

...

At 9:21 PM +0800 6/20/02, bill wrote:
>šh†{.n«+â…¨zwZôÎ,j‚¢v¶yŽË¶ó´„™ÞÁ¨…™)„¯ûµËÆ"a{
>+wšß¾ÊÏr½õ{¯ßj»ßÇW€äwö¾ÿ^ôÎ,j‚{[°Ðj…!ä—œmß¢õâÎ_œäýœX¨¦ÁjgùÆäizª?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Donald Eastlake 3rd <[email-masked]>
Date: Thu, 20 Jun 2002 09:47:38 -0400 (EDT)

DNSSEC has nothing to do with encryption or confidentiality. It is
designed to provide only authentication and integrity.

Donald
======================================================================
 Donald E. Eastlake 3rd                       [email-masked]
 155 Beaver Street              +1-508-634-2066(h) +1-508-851-8280(w)
 Milford, MA 01757 USA                   [email-masked]

On Thu, 20 Jun 2002, bill wrote:

> Date: Thu, 20 Jun 2002 21:21:12 +0800
> From: bill <[email-masked]>
> To: [email-masked]
> Subject: DNSSEC and NAPTR RRsets
>
>  Hi, folks:
>
>
> ������r��zǧu���Ơz�'jg���iz�+z����)�'�~���+a����n�˛���m�jȧ�W��w���^��,j�{[�ܚ��b��~��)�'�~���X����jg���iz�?

---

From: "bill" <[email-masked]>
Date: Thu, 20 Jun 2002 21:56:02 +0800

----- Original Message ----- 
From: "Roy Arends" <[email-masked]>
To: "bill" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, June 20, 2002 10:06 PM
Subject: Re: DNSSEC and NAPTR RRsets

> If you mean signing a NAPTR RRset, I see no reason why not.

Yes, I mean signing a NAPTR RRset. I am a freshman at the DNSSEC, and what the different between encrypting and signing.

Thanks
Best Regards

Bill

2002/06/20
ÿûhº{.nÇ+‰·¬zwZ™ë,j¢v¦yÚè¦—«³úÞªç¬·ú)³øžµÿè®"¶a{
+wû§²æìr¸›{ø§jÈ§‚W¥Šwš²Ø^™ë,j{[¡Üÿj·!Š÷ÿþm§ÿÿ¢›ÿ‰ë_þŠàþX¬¶Ïçjg®Šiz»?

---

From: Mats Dufberg <[email-masked]>
Date: Thu, 20 Jun 2002 16:05:16 +0200 (CEST)

>  I want to use DNSSEC to encrypt the NAPTR (type=35) RRset. Can I do

If you by encryting mean hiding the data for unauthorized persons, the
answer is no. DNSsec is not for encryption, but for protecting data from
unauthorized changes through signing with the use of ecryption technology.

Mats

----------------------------------------------------------------------
Mats Dufberg				             Registry TeliaNet
[email-masked]                                  Skanova/AO Networks
+46 8 456 7274                                               Box 10707
+46 70 258 2588                                    SE-121 29 Stockholm
----------------------------------------------------------------------