[56263] in North American Network Operators' Group
Re: BGP to doom us all
daemon@ATHENA.MIT.EDU (Vadim Antonov)
Sat Mar 1 01:49:48 2003
Date: Fri, 28 Feb 2003 22:49:02 -0800 (PST)
From: Vadim Antonov <avg@kotovnik.com>
To: Paul Vixie <vixie@vix.com>
Cc: nanog@merit.edu
In-Reply-To: <g3vfz3mz7z.fsf@as.vix.com>
Errors-To: owner-nanog-outgoing@merit.edu
Thank you very much, but no.
DNS (and DNSSEC) relies on working IP transport for its operation.
Now you effectively propose to make routing (and so operation of IP
transport) dependent on DNS(SEC).
Am I the only one who sees the problem?
--vadim
PS. The only sane method for routing info validation I've seen so far is
the plain old public-key crypto signatures.
On 1 Mar 2003, Paul Vixie wrote:
>
> > It wouldn't be too hard for me to trust:
> >
> > 4969.24.origin.0.254.200.10.in-addr.arpa returning something like "true."
> > to check whether 4969 is allowed to originaate 10.200.254.0/24. ...
>
> at last, an application for dnssec!
