Re: rpki vs. secure dns?

On Mon, 28 May 2012, David Conrad wrote:

As far as I can tell, ROVER is simply Yet Another RPKI Access Method like rsync and bittorrent with its own positives and negatives.

Not quite. ROVER's SRO & RLOCK statements have different semantics than RPKI ROAs, and there are semantics that may not be (practically) expressible in ROVER. ROVER's semantics depend on DNS zone structure. The protection offered by the RLOCK statement stops when a zone cut is reached -- longer routes are allowed unless there's an RLOCK in every descendant zone. Having DNS users care about zone structure is, to quote Rob Austein, "not normal". -- Sam Weiler