Subject: Re: Global PKI on DNS?

From: "Steven M. Bellovin" <[email-masked]>
Date: Sat, 08 Jun 2002 18:01:13 -0400

In message <[email-masked]>, David Conrad writes:
>On 6/8/02 6:22 AM, "Steven M. Bellovin" <[email-masked]> wrote:
>> DNS packets are limited to 512 bytes.
>
>No they are not.  They are limited to 64K.  Even without EDNS0, a large
>response can fall back to TCP.  You know this.

I was excluding EDNS0, since I thought it wasn't widely implemented.  TCP 
fallback is, as you are painfully well aware, expensive.
>
>> Few MTUs are larger than 1500.
>
>What is the average size of a CERT (honest question, I have no idea)?

Good question -- and I don't think there's any one answer.
>
>> Anyway -- the concept is called "appkeys", and has been discussed in
>> the dnsext working group.  Check the archives.
>
>I thought APPKEY was addressing putting non-self-validating keys into the
>DNS, relying on DNSSEC to insure a chain of trust.
>
Technically, you're right, but a number of the essential concepts are 
the same, including the key one that the record you're looking for has 
to have a name in DNS space.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

---

From: David Conrad <[email-masked]>
Date: Sat, 08 Jun 2002 17:29:51 -0700

On 6/8/02 3:01 PM, "Steven M. Bellovin" <[email-masked]> wrote:
> I was excluding EDNS0, since I thought it wasn't widely implemented.

It has been implemented in the latest version of BINDv8, it has always been
in BINDv9, and I believe it is in Microsoft's DNS server (not positive on
this).  Given EDNS0 is required for implementing DNS for IPv6, I wouldn't
think it something you'd like to exclude.

> TCP fallback is, as you are painfully well aware, expensive.

Yes.

> Good question -- and I don't think there's any one answer.

Hmm.  "Average"?

> to have a name in DNS space.

And, of course, there are applications in which this makes perfect sense
(e.g., ssh).

Rgds,
-drc