[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: DNSSEC for IPSEC?
With respect to validation policies, I think there's also need for
some more advanced policies, allowing for a domain-to-domain web of
trust/cross certification, where the trust graph doesn't match the
domain hierarchy.
E.g., to use Bob Moskowitz's auto industry model, Chrysler and its big
subcontractors may well "trust" the root domain to not screw up on a
day-to-day basis, but because they have long-term business
relationship involving the exchange of hundreds of millions of dollars
a year, and they only each send $50/year to the Internic, they might
be happier if there was a direct trust path between their zones not
involving any organization which wasn't as committed as they were to
their business relationship.
One way to do this would be to configure the trusted key for
chrysler.com into all resolvers in the subcontractor.com domain, but
that would be a management nightmare; an alternative would be to set
up some sort of "trusted shadow" of the root inside chrysler.com
(e.g., a peers.chrysler.com zone signed by the chrysler key containing
KEY rr's off of `subcontractor.com.peers.chrysler.com'); the
validation model (which is admittedly an extension of the current
DNSsec model) would trust zone keys inside the shadow subtree before
you trust keys certified through the root..
- Bill
References: