Re: on NAT-PT

[Erik Nordmark <Erik.Nordmark@sun.com>]

> 	you are generalizing it too much by saying "in IPv6 networks" - what
> 	i'm suggesting is to use "AD is secure" for NAT-PT, that's all.
> 	it doesn't have to be imposed for all IPv6 networks.

Suppose I have a host that doesn't want to trust "AD is secure".
This might be because I'm only wanting to trust it when talking to
my trusted "home" resolver.
Suppose I visit a place which provides nice IPv6 functionality using NAT-PT.
Can my box validate the DNSSEC signatures itself?

As far as I understand it can't, since it doesn't know which AAAA records
have been made up by the DNS ALG in the NAT-PT box.

Reading draft-ietf-dnsext-dns-threats-02.txt makes me believe this would
be unacceptable.

Oh - and I think DNSSEC will be deployed in our lifetime, just like
I think IPv6 will be deployed in our lifetime. But are likely to happen over
the next 5-10 years.

  Erik