Re: transaction security in the last mile

[Florian Weimer <fw@deneb.enyo.de>]

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

* Paul Vixie:

> end users who really just can't tolerate provider-in-the-middle attacks will
> use VPN to reach an RDNS they trust, or will run an RDNS of their own using
> a VPN through some trusted relay point for their RDNS/ADNS traffic.

Speaking as a vendor, I want to standardize the VPN infrastructure, so
that our users are not tied into the VPN infrastructure we provide.  I
want interoperability at the protocol level, too, so that the software
at the endpoints is interchangeable.

It would be really neat if we could use official DNS protocols for that.
If we can't, it's not a showstopper, but it means that the approach will
be proprietary, no matter how much source code we release.  On the other
hand, I'm not sure if the underlying problem is of sufficient general
interest to justify IETF involvement.

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>