Re: [[email protected]: [dns-dir] Heads up on a London BoF]

Hi,

At least for IPv6, this is possible by using both asymetric and symetric
encryption. One solution might be the use of CGA-TSIG
(http://tools.ietf.org/html/draft-rafiee-intarea-cga-tsig  ). I wrote a
paper about it and called it CGA-TSIGe (e represents encryption)

How?

1- Client asks for a public key of the server
2- Server answers with his own public key that is binded to his IP address
3- Client encrypt a session key using the public key of the server and also
encrypt the whole message using this session key and also can generate a
signature and sign the whole message.
4- server receive this message and decrypt the session key using his own
private key and decrypt the whole message using this session key.

I also evaluted the encryption and decryption using a public key
cryptography. If the message size or the session key is small(less than 100
bytes) then the encryption is in microseconds.

Security Analysis of this approach
- Nobody can spoof the public key of the server since there is a binding
between this public key and the server's IP address
- It provides both data integrity and confidentiality

Disadvantage
- It only supports IPv6 since CGA or SSAS that is the main algorithm in this
approach is supported by IPv6

Smile,
Hosnieh
P.S. I would need to update the draft and will do this soon.  


> -----Original Message-----
> From: dnsext [mailto:[email protected]] On Behalf Of Andrew Sullivan
> Sent: Saturday, January 25, 2014 3:12 AM
> To: [email protected]
> Subject: [dnsext] [[email protected]: [dns-dir] Heads up on a
London
> BoF]
> 
> Dear colleagues,
> 
> Please see Brian's note below.  It will be important to get people with
protocol
> expertise into this room.
> 
> A
> 
> ----- Forwarded message from Brian Haberman <[email protected]> ---
> --
> 
> Date: Fri, 24 Jan 2014 08:31:19 -0500
> From: Brian Haberman <[email protected]>
> To: IETF DNS Directorate <[email protected]>
> Subject: [dns-dir] Heads up on a London BoF
> List-Id: IETF DNS directorate discussion list <dns-dir.ietf.org>
> 
> All,
>     I have agreed to sponsor a BoF in London to look into adding
confidentiality
> to DNS.  The current description of the DNSE BoF is available at:
> 
> http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Internet
> 
> I want to encourage the DNS protocol experts to participate in the BoF.
>  The primary focus will be on discussing whether there are existing ways
to
> accomplish the goals described in the problem statement draft targeted for
> the DNSOP WG.
> 
> If you have any questions, feel free to let me know.
> 
> Regards,
> Brian
> 
> 
> 
> 
> _______________________________________________
> dns-dir mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/dns-dir
> 
> 
> ----- End forwarded message -----
> 
> --
> Andrew Sullivan
> [email protected]
> _______________________________________________
> dnsext mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/dnsext

_______________________________________________
dnsext mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dnsext