rpki vs. secure dns?
Samuel Weiler
weiler+lists.nanog at watson.org
Tue Jun 5 19:39:12 UTC 2012
On Mon, 28 May 2012, David Conrad wrote:
> As far as I can tell, ROVER is simply Yet Another RPKI Access Method
> like rsync and bittorrent with its own positives and negatives.
Not quite. ROVER's SRO & RLOCK statements have different semantics
than RPKI ROAs, and there are semantics that may not be (practically)
expressible in ROVER.
ROVER's semantics depend on DNS zone structure. The protection
offered by the RLOCK statement stops when a zone cut is reached --
longer routes are allowed unless there's an RLOCK in every descendant
zone. Having DNS users care about zone structure is, to quote Rob
Austein, "not normal".
-- Sam Weiler
More information about the NANOG
mailing list