On 07/10/2012 08:14 AM, Michael Richardson wrote:
>>> A local trust anchor is needed for the isolated network with
>>> more than one router.
>> Agreed there.
Michael> Ok, here's my ignorance. If we want a local DNSsec trust
Michael> anchor -- which seems like a reasonable want -- how do
Michael> those root keys get into each client host? And what happens
Michael> if I visit my neighbor's homenet with my phone, does that
Michael> imply that I have to enroll with his root keys?
I really think we should find a way to limit our scope here.
First, we need a bit of localhost behaviour on the part of secure
resolvers to understand that the trust anchor for .local (or .home.lan
or... have we even decided that part yet?) is network dependant.
Given that, we might not actually care that multiple routers answer
a signed .local with different signatures.
We either trust one, some, or none. We might create some mechanism
whereby a .local trust anchor goes into global DNS somewhere.
e.g. _router1._local_trust_anchor.michaelthomas.com
but, can we make that out of scope for now?
Even if we only have one .local, or whatever the root is, how
does that root's key get into clients?
And I'd think it's pretty important that the local names for my house
cannot be spoofed by a local name for your house just because I
happened to visit and some auto-conf magic happened because I
wanted to talk to your fridge. Which to me seems that a .local root
gets into a lot of trouble with (malicious) namespace collisions when
you're talking about mobile devices.
Second, if we agree that if we have more than one router with a .local
name server that answers securely, then we need to decide how things
are signed.
Is this specifically coupled to a "router", or just the generic "thing
in my house that might have a DNS server in it"?
Third, maybe we do not need more than one secure .local name server
in a network that has more than one router.
Seriously, I can see my neighbor's wifi, and I have access to his
(guest) net. This problem is already here.
Mike
_______________________________________________
homenet mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/homenet
