Robert Watson wrote: | Is there any concensus on the use of DNSsec in the network community, as | it has not yet been made widely available (or at least, it is available, | but not largely used.) The key namespace here could be used however one | desired, nor necessarily in a DNS-style way. The entity-name, whatever | that is, simply suggests which key/algorithm should be used, a server | could be configured to pull that information from DNSsec, or from an | internal key-file (or both.)

I don't trust the DNS right now. I also don't see a need to put keys there for local use. Use ssh to distribute them. :)

| An ACK message has already been stated as desirable -- would a simple | signature over the last packet (or header + signature) using the shared | secret, entity public key, or whatever, back on the TCP connection | suffice? Maybe something lighter-weight?

I'm leaning to acks being simpler than involving the last packet, and towords them involving just a sequence number:

ACK log://somehost.evil.net:234566, HMAC

Adam