Subject: Re: [keyassure] Poking the charter bear....

From: Tony Finch <[email-masked]>
Date: Wed, 8 Sep 2010 00:22:29 +0100

On 27 Aug 2010, at 15:42, Phillip Hallam-Baker <[email-masked]> wrote:
> 
> It is far too late to use DNS Curve for inter-domain security in my
> view. But the use of a similar approach to support intra-domain
> security between the client and server is very much on the table as
> far as I am concerned (albeit not in this group). It is a model that
> has considerable sympathy and champions in Microsoft and other major
> vendors.

TSIG and SIG(0) should be able to do the job in that environment.

Tony.
--
f.anthony.n.finch  <[email-masked]>  http://dotat.at/

---

From: David Conrad <[email-masked]>
Date: Tue, 7 Sep 2010 13:35:30 -1000

On Sep 7, 2010, at 1:22 PM, Tony Finch wrote:
>> But the use of a similar approach to support intra-domain

Well, yeah, it does (and did). If I recall correctly, Microsoft came out with TKEY negotiated TSIG for communication between stubs and resolvers in AD environments way back when AD came out (and, of course, they used non-standard enhancements (GSS-TSIG) to do the work).  Took a while to reverse engineer that one.

Not sure why "Microsoft and other major vendors" would have "sympathy and champions" for reinventing that particular wheel...

Regards,
-drc