Subject: [dnsext] TSIG, TKEY, and IPSEC

From: Edward Lewis <[email-masked]>
Date: Fri, 15 May 2009 11:03:54 -0400

As an operator of DNS, my concern about forgery resilience comes from 
"how many mechanisms do I have to support?"

One of the strengths of DNS is its simplicity and lightweight nature. 
That is one reason why it has scaled so well, why it and not X.500 is 
dominant today. Add more and more optional mechanisms takes away from 
that.  Referring to "falling back" from one mechanism to another kind 
of bothers me.

When it comes to client and server message exchange, we already have 
TSIG and TKEY.  TSIG is of course shared secret and that has limited 
scaling, best withing some sort of administrative domain (recursive 
server and stubs or amonst authorities for a zone).  I haven't 
dabbled in TKEY (yes, I know I was a contributor but that was a long 
time ago), so I'll put forward the question - does anyone use it?  Is 
it useful?  It there a problem with it?

We also have the non-DNS IPSEC option.  Perhaps there is an issue 
with IPSEC'ing across the world, but it's not clear to me.  If anyone 
knows a reason why it's not a candidate it would good to hear.

The reason I am bringing this up is these are solutions already 
documented.  That doesn't mean they are good solutions, but maybe 
they are.  If something is available and unused, it is because no one 
has been using it or is it because the solution isn't that good after 
all.  Just because it is in print and/or code doesn't make it a good 
idea.

I'll stop at this point.  Is there any WG assessment of TSIG, TKEY, 
oh, and SIG(0) or even IPSEC as a forgery resilience mechanism?  Why 
do we need to invent more?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Getting everything you want is easy if you don't want much.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>