Subject: Name resolution, dns and security

From: Aidan Williams <[email-masked]>
Date: Thu, 12 Jul 2001 12:13:21 +1000

Greetings,

The recent discussion of the requirements draft has made me reconsider
the relationship between name resolution and the use of DNS in zeroconf
networks.  I agree that mDNS is a likely potential solution, however
the security requirements sections seem to mandate something DNS-like
as the solution (which bothers me a bit):

3.2 Name to Address Resolution
   [ other text ]   
   A zeroconf name to address resolution protocol MUST be compatible
   with the use of DNSsec.  Therefore it MUST be possible for a host
   running a zeroconf protocol to use DNS and DNSsec for authenticated
   name resolution if that host (or its administrator) chooses to do so.
   [RFC 2541]

This paragraph could read as requiring the zeroconf protocol to be
securable with DNSsec (i.e. thou shalt use DNS).

Alternatively, you can ignore the whole issue and use whatever you like
as long as the user can turn on and configure DNS/DNSsec (requiring an
implmentation of DNS/DNSsec in each host).
"MUST be possible" is wierd wording.  It would be clearer to say that
"zeroconf hosts MUST implement DNS/DNSsec" if that is what is meant.

I would prefer this to read:

  A zeroconf name to address resolution protocol MUST support
  authentication of name resolution responses.
  (DNSsec doesn't authenticate requests, and we only need to be
   as good as DNSsec)

One could then use mDNS+mDNSsec, IPSec+NetBIOS naming, SLP+auth, whatever
and comply with the requirements without having to do DNS/DNSsec too.
The "profile" document can mandate a particular mechanism (e.g. mDNS + mDNSSec)
as required-to-implement.

In general, I don't think DNS itself is the requirement for name to address
resolution.  Rather the requirements are:
  - supporting the API (as Erik suggested)
  - the protocol characteristics of DNS (forward and reverse mappings)

The same could be said for the security requirements:
  - some API (I don't know of one)
  - the protocol characteristics of DNSsec (authentication of responses)

regards
	aidan
____
:wq!