Subject: RE: draft-eastlake-dnsext-cookies-00.txt

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 26 Jun 2006 23:54:40 -0400

See below at ### 

-----Original Message-----
From: Kenji Rikitake [mailto:[email-masked]] 
Sent: Monday, June 26, 2006 8:42 PM
To: Eastlake III Donald-LDE008
Cc: [email-masked]
Subject: Re: draft-eastlake-dnsext-cookies-00.txt

In the message
<[email-masked]>
dated Mon, Jun 26, 2006 at 10:41:18AM -0400, Eastlake III Donald-LDE008
<[email-masked]> writes:

...

> @@@ If a minimum recommended rollover period was to be included, I'd 
> say a day.

I have no objection so far, though I feel some more studies are needed.
It also depends on how many different resolvers a server has to
communicate with, for the simultaneous entropy (as in RFC4086)
requirement.

### Sure, more studies are fine.

> * SHOULD/MUST a server/resolver change the cookie for each program on 
> the other end?
> 
> @@@ Not completely sure I understand what you mean but I would say no.
> Arguably there is really only one logical DNS entity at a host.

OK, so only one Cookie Secret bound for an IP address.  Am I right?

### One per server and one per resolver. Multiple resolver could, due to
NATing, appear to a server to be from the same IP address...

Regards,
// Kenji Rikitake

### Thanks,
### Donald

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>