Subject: [perpass] Reviewers needed - Secure DNS authentication

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 28 Sep 2013 00:13:10 +0200

Hello,

I am looking for reviewers to review the
http://tools.ietf.org/html/draft-rafiee-intarea-cga-tsig draft. It deals
with the use of CGA (RFC 3972) or SSAS for authentication purposes during
various types of scenarios. This is truly possible when the authentication
is based on the source IP address. Everything in this authentication is done
"on the fly" and only once is there a need to configure the Servers.
Advantages:
- If the shared secret is compromised (which is true in TSIG, you won't need
to repeat the process of re-sharing the shared secret among the many hosts
that used the compromised shared secret)
- If for any reason the IP address of any nodes involved in authentication
is changed, then the other nodes will  still be able to verify that it is
the same node
- It is both easier and preferable to use this approach to prove the address
ownership while at the same time performing source IP address
authentication.
- The nodes don't need to go through the chain of trusts  because the magic
of CGA or SSAS works well. This means that if the other nodes are aware of
one node's real IP address then that is all the information the other nodes
need  to identify this node. No matter how your node changes its IP address.
This draft explains how to easily handle this situation, automatically,
without the need for human intervention. 
I am sure you will find it interesting. 

The different scenarios that are considered are:
- Authentication during FQDN
- Authentication during zone transfer
- Authentication of the resolvers in stub resolvers
- Authentication of root DNS servers to recursive DNS servers

We also considered the scenario where the server doesn't support CGA or
SeND. The interesting thing about this draft is that you can use a CGA
script generator that I will provide and make available to everybody. Then
just manually set the IP address for the node that wants to use CGA-TSIG.
The CGA-TSIG implementation will thereafter  processes the handling for all
the CGA parameters. 

This scenario is good for the future of the Internet where IPv6 is used. I
guess many DNS servers now support IPv6 as well as IPv4. 

I am looking forward to receiving your comments. 

Thank you,
Hosnieh
P.S. So if you'll review mine i'll review yours.. Deal??? :-)

---

From: SM <[email-masked]>
Date: Fri, 27 Sep 2013 15:42:36 -0700

Hi Hosnieh,
>P.S. So if you'll review mine i'll review yours.. Deal??? :-)

I like the spirit. :-)

Regards,
-sm

---

From: Warren Kumari <[email-masked]>
Date: Fri, 27 Sep 2013 21:03:46 -0400

I'm sorry, but this is not related to DANE (nor was it last time you came shopping around).

I (of course) have no problem with folk reviewing it, just making it clear that it isn't a DANE thing...

W

Warren Kumari
------
Please excuse typing, etc -- This was sent from a device with a tiny keyboard.

> On Sep 27, 2013, at 6:13 PM, "Hosnieh Rafiee" <[email-masked]> wrote:
> 
> Hello,
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 28 Sep 2013 15:47:32 +0200

> I (of course) have no problem with folk reviewing it, just making it clear
that it
> isn't a DANE thing...

You're right it is individual submission which has a document shepherd. I
asked Andrew to be a document shepherd for this work. But we are trying to
hunt reviewers :-) . Some DNS experts have already reviewed this document
and the document improved a lot since the first version.  We are now looking
for more reviewers (security expert, DNS expert, etc) for technical and
organization comments. Any volunteer reviewers that give us more useful
comments so that we can proceed with it.  The reviewers can send their
comments directly to I and Andrew or to the list.

Thanks,
Hosnieh