Subject: RE: ENUM Privacy (was RE: [Enum] User ENUM vs Operator ENUM)

From: "Peter Williams" <[email-masked]>
Date: Tue, 29 Jun 2004 12:21:24 -0400

you wrote. .
> Operators can (and probably should) use a private version of
e164.arpa today. This doesn't need any involvement in the Tier-0 and
Tier-1 stuff or ITU's interim procedures. e164.arpa is the IETF/IAB
agreed domain name for ENUM. It's neutral and not controlled by any
commercial interest or nation. So it's the obvious choice for the
unique and consistent naming scheme that Infrastructure ENUM
needs. There is no viable alternative. [BTW don't confuse the domain
name e164.arpa with its public expression on the internet today.] This
would also make it easier for operators to interwork and perhaps link
their private trees: ie nobody has to figure out the DNS gunk needed
to merge say enum.pulver.com with e164.at or enum.bt.intra.
cdel:--< what specifically do you propose? It sounds like you are proposing
non routable private e164.arpa zones behind firewalls?
not firewalls: SSL VPNs... (which also give you the security negotiation, 
the single signon, and the layer-independent privacy handling) Adding ENUM 
discovery to SSL single signon makes a lot of sense, when the SSL layer is 
tuned for setting up the SIP proxys' sessions.  The E.164 address can also 
be added to the SAML, which when signed and issued by authorities can 
implement the semantics of the national authorities that Richard seeks to 
preserve (who knows why some people wish to preserve dinosaurs).

But as you imply, behind every VPN there is a private DNS. Inter-VPN routing 
can allow references to the DNS access points of some of the other providers 
in the n confederations.

Jim's idea is use e164.arpa as a name, not as a zone administration point.If 
I go one step further, in the SSL world, we just have each SSL VPN issue a 
self-signed cert, asserting a binding between this .arpa name and the local 
tunnel endpoinf to the DNS server reachable to the community using the 
particular SSL-net interface.

Dump DNS zone delegation, and use VPN management system mechanism, instead - 
and use the SSL culture to handle the politics of confederated naming (given 
SSL management works on an critical infrastructure scale).

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Tue, 29 Jun 2004 13:12:47 -0400

>>>>> "Peter" == Peter Williams <home_pw at msn.com> writes:

    Peter> Jim's idea is use e164.arpa as a name, not as a zone
    Peter> administration point.

EXACTLY!!! Thanks for saying this more clearly than I could! :-)

---

From: "Christian de Larrinaga" <[email-masked]>
Date: Tue, 29 Jun 2004 14:00:54 -0400

Peter Williams
Sent: 29 June 2004 17:14

christian :--> Thanks for the clear presentation of this idea.

But does it matter if it is SSL or IPSEC with or without BGP4 policy? i.e.,
would it be better to allow user to define network architecture rather than
imposing SSL only for ENUM use as a one size fits all? Or have I
misunderstood you?

Christian