[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: DNS Security

While applauding the call for consolidation of security services into
appropriate layers, I think I see a counter-argument to the need to
feed datagram security requirements into the IP layer.  The services
themselves can easily be configured to use host-to-host signed,
private datagrams that provide the authentication required for
securing their services.  Perhaps they would share some sort of
certificate or key information with the IP layer, but there is no need
to be dependent on the IP layer itself for security.  In fact, it is
somewhat awkward to do this, because some services will accept
requests (reads) from any host, but accept changes (writes) only from
a trusted subset.  Upon receiving a datagram, they might have to query
the IP layer as to its provenance --- was this an authenticated
datagram or not?

 Hilarie Orman
Follow-Ups: References: