To:
Keith Moore <moore@cs.utk.edu>
Cc:
Ted.Hardie@nominum.com, Edward Lewis <lewis@tislabs.com>, keydist@cafax.se
From:
Derek Atkins <warlord@MIT.EDU>
Date:
09 Jan 2002 16:11:24 -0500
In-Reply-To:
Keith Moore's message of "Wed, 09 Jan 2002 15:48:53 -0500"
Sender:
owner-keydist@cafax.se
Subject:
Re: From whence we came...
Keith Moore <moore@cs.utk.edu> writes:
> It's not clear to me why you need to verify the authenticity or
> integrity of a blob if you can't interpret the blob anyway.
Perhaps. But keep in mind that there are some blobs that don't have
any internal integrity/origin protection at all (eg. ssh keys or
freeswan keys). DNSSec fills that void perfectly.
> I'm aware that the discussion started in terms of using DNS. I don't
> know how the charter will end up, whether it will presume DNS as part
> of the solution or not. IMHO it would be wrong for the charter to
> presume DNS distribution and DNSSEC as mechanisms even if the charter
> were limited to associating key material with DNS-based names.
Honestly, I don't think we want to try solving the whole key
distribution problem. I think we should definitely keep ourselves
limited in scope. In particular, I think we should limit ourselves to
distributing keys for identities that can be represented as DNS names
(definitely host names, maybe user names).
> I agree that there is a large set of applications for which DNS should
> be part of the mechanism for locating keys. Any application that
> wants to associate meaning with DNS names, and probably IP addresses,
> would be a likely customer for such a mechanism.
>
> Whether DNS is a good mechanism for actually distributing keys is a
> different question. Several limitations in the DNS protocol make
> me dubious about this.
I'd like to hear your reasoning for this, but perhaps that should be
taken offline?
> Whether DNSSEC is a good mechanism to verify the authenticity of keys
> is yet another question. As far as I can tell DNSSEC is potentially useful
> but has narrower applicability than the general key distribution mechanism
> being considered.
Agreed. There are some keys for which DNSSec is absolutely necessary.
There are other keys for which DNSSec would be nice but isn't
necessarily required.
> Keith
-derek
--
Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
Member, MIT Student Information Processing Board (SIPB)
URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH
warlord@MIT.EDU PGP key available