Subject: Re: TKEY

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Fri, 03 Mar 2000 14:20:00 -0500

From:  Edward Lewis <[email-masked]>
X-Sender:  [email-masked]
Message-Id:  <v03130306b4c47dbea4f8@[207.172.150.18]>
In-Reply-To:  <[email-masked]>
References:  Your message of "Tue, 04 Jan 2000 09:50:00 EST."            
	     <v03130300b497b4f47765@[10.33.10.14]>
Content-Type:  text/plain; charset="us-ascii"
Date:  Mon, 7 Feb 2000 09:10:30 -0500
To:  "Donald E. Eastlake 3rd" <[email-masked]>
Cc:  Edward Lewis <[email-masked]>,
            "Donald E. Eastlake 3rd" <[email-masked]>,
            [email-masked]
>At 11:26 PM -0500 2/6/00, Donald E. Eastlake 3rd wrote:
>>However, I must say that the process of reviewing and re-organization
>>this material was a lot more work than I thought it would be and has
>>lead, in my opinion, to a lot more improvement than I though it would.
>>In fact, I found cases that said "SHOULD" which have to say "MUST" to
>>actually achieve security.
>
>This is what I thought would happen.  By following a stricter discipline
>(e.g., no requirements in intro, discussions), I have found that the result
>is much better.  Not only do the aesthetics improve, the reorganization
>effort often finds other places where one can tighten the work.  I think
>the reason is that the author sees the requirements from another angle,
>performing another round of requirements analysis.
>
>>Based on all this it seems best to not use the DNS header RCODE field,
>>so the current -dnsind-tkey-03.txt draft on page 7 where the error
>>codes are listed says the following which I essentially plan to retain
>>in the next draft:
>>
>>   When an extended RCODE appears in the TKEY in a response, the DNS
>>   header RCODE field indicates no error.
>
>I think it is wise to report an error just once, lest you start seeing
>messages with multiple error codes, leading to confusion by the reader.
>Writing a "good" client that understands the error codes is very hard once
>we start indicating multiple failures.
>
>OTOH, reporting "no error" in the header field is probably misleading, is
>there a "error inside" value?  That being said, I think having "no error"
>in the header field is better than having some other specific error code
>there.

Deciding to minimize changes, I left it as "no error" in the updated
version of the draft just announced today.

>---
>
>There is a paper by Ferguson & Schneier called "A Cryptographic Evaluation
>of IPsec," unfortunately I have a copy for which I cannot give a published
>reference[1] (it was handed to me).  In this, they[2] criticize IPsec from
>a security/cryptographic point of view.  I think that some of the
>interesting points are the claims that the documentation of IPsec prevents
>good security analysis, as well as the protocol's complexity making it hard
>to ensure that security is "attained."  The reason I am riding the DNS
>security documents hard is to try and avoid the same criticisms if DNS
>security.

It's at <http://www.counterpane.com/ipsec.html>.  The
IPSEC/ISAKMP/IKE/...  melange is an order of magnitude more complex
than all proposals for DNS security put together.

>[1] There is a URL: www.counterpane.com under the title.
>[2] Assuming the paper did not forge their typed names...;)
>
>-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
>Edward Lewis                                                NAI Labs
>Phone: +1 443-259-2352                      Email: [email-masked]
>
>"Trying is the first step to failure." - Homer Simpson
>"No! Try not. Do... or do not. There is no try." - Yoda
>"It takes years of training to know when to do nothing" - Dogbert 1/21/00
>
>Opinions expressed are property of my evil twin, not my employer.

Thanks,
Donald
===================================================================
 Donald E. Eastlake 3rd                    [email-masked]
 65 Shindegan Hill Rd, RR#1                 [email-masked]
 Carmel, NY 10512 USA     +1 914-276-2668(h)    +1 508-261-5434(w)

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.