Subject: RE: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Thu, 16 Dec 99 13:44:48 EST

> > of:
> > 	foo
> > 	foo.dns-search-1
> > 	...
> > 	foo.dns-search-n
> > 
> > Obviously there is no 'host/[email-masked]' which would verify what the
> > user typed.  The other problem is that the dns-search{1-n} on the
> > client may not match the dns-search{1-n} on the KDC, so you can't just
> > pass 'foo' and always get the same implied host.
> > 
> > How do you deal with this situation?
> 
> The client sends "host/foo.dns-search-n" for the chosen "n".
> 
> The choice of names to look up (via the search suffixes) is under the
> control of the user. Since all they typed is "foo", all they can expect is
> that the KDC will guarantee that they got a server with "foo" as a prefix.
> They will get that guarantee, regardless of what DNS returns.
> 
> Paul

So the KDC must be sent N queries?

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Ken Raeburn <[email-masked]>
Date: 16 Dec 1999 14:58:16 -0500

> So the KDC must be sent N queries?

Sure.  After all, the DNS server would be sent N queries.  The
difference is in the centralization; with DNS, the server in question
can be on the local system and can do caching.  (And, there will
likely be referrals to other KDCs.)

I've been trying to write up a summary of the discussion, but I keep
bumping into areas like this where big or little things need to be
thought through a little bit to get an answer, and I'm not sure if
it's the answer the various authors would intend.  I've got to try to
do a little less of that...

And, I keep coming back to: *Why* can't we simply insist on DNSSEC if
sites want security?

Ken