[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: "Re: DNS? was Re: Key Management, anyone?"

Hilarie,

        I think there have been two threads of authentication discussion,
both of which have merit.  As Steve Bellovin pointed out, if one starts
with a DNS name, then one wants the binding between the name and the
corresponding IP address to be authenticated, or you are in trouble.
However, although most of the security association (SA) establishment
procedures take that path, some might proceed directly from an address.
Hence, an authenticated binding between an IP address and a public key also
is necessary, and sometime sufficient.

        Th DNS security mechanism facilities provide a necessary service
whenever one starts with a DNS name as an input to SA creation, especially
if one is not sure about the existance of key material for the target, or
the target's existance.  If you know that the target exists, and has key
material, then one could do without the DNS security facilities and merely
fetch a certificate from the DNS (or elsewhere).  That certificate could
embody the address/key binding, and it might also include the DNS name.
(X.509 v3 certificates allow for multiple alternative name forms in a
single certificate, so it is feasible to include multiple bindings, so long
as one can establish a certification system that is consistent with the
multiple bindings.)  So, I also agree with the observations made by David
Kemp, that the DNS security approach to providing key and signature records
is not the only game in town.  Some subscribers may find that they require
some of the features that come from using certificates (vs. the signature
and key records of DNSSEC).

        The two schemes are not necessarily in conflcit; they offer
somewhat different sets of services. One might even go with a hybrid scheme
where DNSSEC was used to authenticate existing records for hosts, but
certificates were stored for the hosts themselves.  This would reduce the
extent to which DNS signature and key records would be introduced, since
they would be required only to represent the domains (not the hosts), while
certificates could be used for the hosts.  (Just a quick thought, noithing
that I've worked on in depth.)

Steve