Subject: Re: on NAT-PT

From: Alain Durand <[email-masked]>
Date: Fri, 03 Jan 2003 17:51:36 -0800

[email-masked] wrote:

>>>you have been ignoring my comment (i made this comment months ago)
>>>to use "AD is secure" for the response from DNS-ALG.
>>>
>>>      
>>>
>>Let met get back to this now.
>>
>>The fundamental issue is that nodes do not know
>>about the potential presence of a DNS ALG,
>>so they can not decide if it is OK to do recursive
>>queries themselves or if they have to use "AD is secure"
>>and send DNS queries to a trusted recursive resolver.
>>    
>>
>
>	i guess you are talking about something different.
>
>	if the site administration policy is to use a recursive resolver
>	and "AD is secure", this does not matter whether the recursive
>	resolver is DNS-ALG or not.  the whole point of "AD is secure" is to
>	offload the implementation complexity of DNSSEC from the end clients
>	and put it into recursive resolver.
>
>itojun
>  
>
I think yes, were are talking about something different.
Yes, using 'AD is secure' works and solve the particular
problem I'm describing.

What I'm saying is that imposing to use 'AD is secure'
to operate DNSsec in IPv6 networks is a big step
that I'm not sure I'm ready to make.

    - Alain.

---

From: [email-masked]
Date: Sat, 04 Jan 2003 10:18:08 +0900

itojun

---

From: [email-masked]
Date: Sat, 04 Jan 2003 10:18:36 +0900

>>	so you don't apologize for attacking me on "product advertisement"?
>>	how nice.
>My words were too strong, but yours are sometime strong too.
>I guess this is because none of us are native english speaker.

	so you don't know how to apologize in English?

itojun

---

From: [email-masked]
Date: Sat, 04 Jan 2003 11:00:46 +0900

>Yes, using 'AD is secure' works and solve the particular

	as far as i understand the use of recursive resolver (DNS-ALG) is part
	of the deal in NAT-PT.  so the point you made previously (nodes that
	make recursive query by themselves) are not covered/supported by NAT-PT.

>that I'm not sure I'm ready to make.

	you are generalizing it too much by saying "in IPv6 networks" - what
	i'm suggesting is to use "AD is secure" for NAT-PT, that's all.
	it doesn't have to be imposed for all IPv6 networks.

itojun

---

From: Alain Durand <[email-masked]>
Date: Fri, 03 Jan 2003 10:21:20 -0800

Anyway, happy new year!

    - Alain.

---

From: Alain Durand <[email-masked]>
Date: Fri, 03 Jan 2003 13:32:52 -0800

- Alain.

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 20 Jan 2003 00:59:40 +0100 (CET)

> 	it doesn't have to be imposed for all IPv6 networks.

Suppose I have a host that doesn't want to trust "AD is secure".
This might be because I'm only wanting to trust it when talking to
my trusted "home" resolver.
Suppose I visit a place which provides nice IPv6 functionality using NAT-PT.
Can my box validate the DNSSEC signatures itself?

As far as I understand it can't, since it doesn't know which AAAA records
have been made up by the DNS ALG in the NAT-PT box.

Reading draft-ietf-dnsext-dns-threats-02.txt makes me believe this would
be unacceptable.

Oh - and I think DNSSEC will be deployed in our lifetime, just like
I think IPv6 will be deployed in our lifetime. But are likely to happen over
the next 5-10 years.

  Erik