Re: (ngtrans) Re: The reverse lookup issue

[Derek Atkins <warlord@MIT.EDU>]

"Jeroen Massar" <jeroen@unfix.org> writes:

> (1) = Dynamic updates, will you really be going to let every user of
> your ISP update the reverses?

No, but the ISP trust's its own DHCP server to update its reverse
domain (which may involve updating a reverse-tree deleagation).  Note
that the client does not need to update the reverse tree itself; it
can provide its DNS hostname to the DHCP server and the DHCP server
updates the reverse tree.

> In a company thats probably very different, if you got a nice tightly
> controlled environment.
> But then again, ofcourse we got
> http://ops.ietf.org/dns/dynupd/secure-ddns-howto.html ;)

Personally, I find the reverse tree both useful in my every day work
and also I can see a number of future uses, such as binding keys to IP
addresses.  From an IPsec perspective, all I know is that I want to
send a packet to host X (where X is some IP Address), and I need to
key that connection.  This requires either certificates with IP
addresses or DNS lookups based on IP Address.  I certainly prefer the
latter case, because generally certificates are based on the FQDN, not
the IP Address.

If I want to talk to 1.2.3.4 and get back a certificate claiming to be
for secure.host.net, how do I know I'm talking to the right machine?
OTOH, if I can query DNS for "4.3.2.1.in-addr.arpa. IN <some keytype
record>", which is DNSSec-protected, then I have a higher assurance
that I'm actually talking to the host I think I am.

> Greets,
>  Jeroen

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       warlord@MIT.EDU                        PGP key available

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>