rpki vs. secure dns?

Tue Jun 5 19:39:12 UTC 2012

On Mon, 28 May 2012, David Conrad wrote:

> As far as I can tell, ROVER is simply Yet Another RPKI Access Method 
> like rsync and bittorrent with its own positives and negatives.

Not quite.  ROVER's SRO & RLOCK statements have different semantics 
than RPKI ROAs, and there are semantics that may not be (practically) 
expressible in ROVER.

ROVER's semantics depend on DNS zone structure.  The protection 
offered by the RLOCK statement stops when a zone cut is reached -- 
longer routes are allowed unless there's an RLOCK in every descendant 
zone.  Having DNS users care about zone structure is, to quote Rob 
Austein, "not normal".

-- Sam Weiler