Subject: RE: Now: Next Generation Domains and DNS -- Was: Re: No More Cent ral Authority: Not NSI/ICAN! Not ORSC!

From: Francois Menard Distribution List Management Account <[email-masked]>
Date: Tue, 26 Jan 1999 07:12:43 -0500

An Idea that has stuck in my mind since Christian Huitema pointed this out
in the San-Jose IETF,

What about dynamic resolution based on trusts of "namespace ownership
claims" ?

I trust more www.ford.com (which I already trust) to trust that
www.mercury.com is the authoritative site than that site operated by
www.istealdnsnamesforaliving.com which claims to sell mercury cars.

The resolver, which is the complex piece of code that you do not want to
make ultra-complicated for small systems, could defer this election process
to a DNS server.  Of course, this would make the DNS server a bit
client/server, but nonetheless, we could find scalability in this.  Maybe
not for www.sex.com, but certainly not 600 people will begin to claim
ownership of www.ietf.org ...

This seems like a nice way to extend the concept of trusts in public key
cryptography.

Surely this has already been debated ?

-=Francois=-

---

From: [email-masked]
Date: Tue, 26 Jan 1999 09:57:44 -0500

> to a DNS server.  Of course, this would make the DNS server a bit

You don't want this in a DNS server.  Consider - *you* might trust
'ford.com' to be authoritative for 'mercury.com'.  But why?  It's
because of a perceived business relationship between the two.  But
what about the case of a less well-known business relationship (say,
things owned by Ralston-Purina, or one of the cigarette giants)?

Which do you trust more for 'www.tmbg.org'?  Do you trust me? (I
happen to know the person who registered it, and ran a DNS secondary
for it for a while - but how do you know that?)  Do you trust the
band's recording label's server?

And worst of all - for each DNS request, you would have to carry along
the 'trust web' that the requestor wants used - which could be *quite*
complicated.  Who you trust is certainly not who I trust.

A lot of these issues are discussed in the PGP documentation, where
it's a *lot* more complicated than you might think.  It gets
especially nasty when you start considering transitive trust - who do
you trust to only identify themselves, and who do you trust to
identify others, and how far along a chain you want to go.  Sure,
ford.com may own mercury.com, but if you're trusting ford.com to
identify mercury.com, do you *also* trust ford.com to make sure that
when mercury.com identifies monster-trucks.com, that it's
authoritative?

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Tue, 26 Jan 1999 09:57:44 -0500

---

From: Christian Huitema <[email-masked]>
Date: Tue, 26 Jan 1999 10:22:16 -0500 (EST)

On Jan 26,  7:12am, Francois Menard Distribution List Management Accou
wrote:
> Subject: RE: Now: Next Generation Domains and DNS -- Was: Re: No More
Cent
> What about dynamic resolution based on trusts of "namespace ownership

I floated this idea in the specific context of phone numbers to DNS name
mapping.  In this case, there is a practical solution -- the relation
between a user and one or a few telephone service providers gives a point
to start the mapping.

One of the rationale for a "web" solution is the tricky "ownership"
problem posed by a centralized, single tree, solution.  In the latter
case, you get to decide the ownership of each area.  For example, you get
to decide who "owns" the name server for "+1 212", among Bell-Atlantic,
six or seven competitive local carriers, the mayor of New York, the New
York state utility commission.

Obviously, there is some similarity between that and the "DNS root"
problem, but specific solutions are easier to engineer in the phone number
mapping case.

-- 
Christian Huitema

---

From: Christian Huitema <[email-masked]>
Date: Tue, 26 Jan 1999 10:22:16 -0500 (EST)

Cent

-- 
Christian Huitema

---

From: Randy Bush <[email-masked]>
Date: Tue, 26 Jan 1999 07:57:23 -0800 (PST)

>  *you* might trust 'ford.com' to be authoritative for 'mercury.com'.

i certainly would not.  what does ford know about chemical/metal supplies?
<grin>

this discussion lacks a certain basis in reality.  or maybe i just don't
understand it because it's origins were from the crazies from which procmail
protects me.

randy

---

From: Randy Bush <[email-masked]>
Date: Tue, 26 Jan 1999 07:57:23 -0800 (PST)

randy

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 26 Jan 1999 16:26:39 +0000 (GMT)

> complicated.  Who you trust is certainly not who I trust.

http://www.acm.org/classics/sep95/

has Ken Thompson's "Reflections on Trusting Trust" paper.

L.

<[email-masked]>PGP<http://www.ee.surrey.ac.uk/Personal/L.Wood/>

---

From: Lloyd Wood <[email-masked]>
Date: Tue, 26 Jan 1999 16:26:39 +0000 (GMT)

L.