Subject: Re: DNSEXT WGLC: IPv6 Name Auto Registration

From: Ted Lemon <[email-masked]>
Date: Thu, 6 Feb 2003 17:01:42 -0600

I would argue, by the way, that the right way to do DNS updates in IPv6 
with stateless addrconf is this:

1. Client gets address.
2. Client discovers route to outside world.
3. Client, which knows its FQDN, and has a private key matching the 
public key in a SIG record on that FQDN, updates the primary nameserver 
for its FQDN with its new IP address, using SIG(0) with its key.
4. Client queries to find out who owns the reverse zone it needs to 
update.   It can do this either by walking the chain from the root, or 
by asking the local name server if it's gotten DNS server configuration 
information through DHCPv6.
5. Client sends a DNS update to the primary server for the reverse zone 
that owns its name, again using SIG(0) with the signature from its FQDN.
6. DNS server looks up the key on the FQDN, verifies that the client 
knows the private key, verifies that there is an A4 record for the IP 
address corresponding to the PTR the client is updating, and then does 
the update.

Now you have an automatic, standards-compliant update mechanism that 
doesn't require DHCP, is reasonably secure, and places the 
responsibility for doing the update on the device that is most capable 
of deciding to do it.   The one thing that's missing is a step for 
removing the name later.   Probably this would involve a step 7, where 
the client sends a delete, again signed with the private half of the 
SIG on its FQDN, and the DNS server verifies that the A4 record is 
gone, and then does the delete.

BTW, I used the term "client" above even though we're not doing DHCP, 
simply because it was easier than saying "configuring node."   I don't 
mean to imply anything by using the term "client" - it's just what 
rolled off my keyboard.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Randy Bush <[email-masked]>
Date: Thu, 06 Feb 2003 18:43:21 -0500

> that owns its name, again using SIG(0) with the signature from its FQDN.

if it does not know who holds the reverse zone, and, in fact, is not
preconfigured, how the heck does it send a _validly signed_ sig(0)
update to the reverse server if and when it finds it?

randy