[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Use of DNS to distribute keys
Steve:
>>I believe the question that precipitated this discussion came
>>from someone who posed it in the context of certificates for machines,
>>not for people
Actually, the context was in setting up end-end (rather than store-and-
forward) data protection keys, in which case not storing certificates
in the DNS seems to make more sense. One very big advantage, by the way,
is that there is less state in directory services to keep accurate and
synchronized, the most difficult part of a nameserver-based certificate
distribution scheme being the practical one of ongoing maintenance. Note
that DNS has no notion of self-administration, as X.500 access controls
support, even if your policy would accommodate this sort of thing.
Now, how about simply defining a (publicly readable, usually) MIB for this
so that keys could be accessed (and even remotely managed) without inventing
new protocol, using SNMP?
/Joe
Follow-Ups:
References: