Subject: Re: [IPsec] [dane] IPSEC & DANE (RFC4025)

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 17 Aug 2012 13:34:23 -0400

Is the answer to this problem possibly that DNS records to configure
IPSEC should go in the reverse DNS?

On Tue, Jul 31, 2012 at 7:00 PM, Michael Richardson
<[email-masked]> wrote:
>
>>>>>> "Paul" == Paul Wouters <[email-masked]> writes:
>     Paul> So what happens in my case? Either google is blocked, or google is
>     Paul> downgraded to plaintext. Or the application could distinguish between
>     Paul> my suggested boguspublic-key versus the real google
>
> Google is plaintext, you never had the right to speak for it.
>
>     Paul> Yes, and what I'm saying is that current methods for tying DANE to IPSEC
>     Paul> fail, because there is no binding to the legitimacy of the proclaimed
>     Paul> gateway.
>
> I assume by "current methods", you mean RFC4322?
> Or is there another proposal that I've missed?
>
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works
>
>
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

-- 
Website: http://hallambaker.com/

---

From: Paul Wouters <[email-masked]>
Date: Mon, 20 Aug 2012 13:33:47 -0400 (EDT)

> IPSEC should go in the reverse DNS?

Been there, done that in 1995, did not work.

Paul

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 21 Aug 2012 20:13:14 -0400

> Been there, done that in 1995, did not work.

When people make claims like that, I prefer to see a reason. Or are we
meant to take the fact that you could not make it work to mean that it
is impossible?

---

From: Paul Wouters <[email-masked]>
Date: Tue, 21 Aug 2012 20:26:23 -0400 (EDT)

> meant to take the fact that you could not make it work to mean that it

It was called The FreeS/WAN Project and was founded by John Gilmore.

It's Opportuistic Encryption used TXT records in the reverse. The two
main problems were no one could add anything in their "own" reverse,
and massive deployment of NAT meant people couldn't make their machines
visible and reachable.

Additionally, I see lots of signs the reverse for IPv6 is going to be
even worse - even ISPs aren't really caring about it.

Paul