IETF Logo Mail Archive

Re: [Asrg] DNSSEC is NOT secure end to end (more tutorial than debating)

Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> Wed, 03 June 2009 06:35 UTC

Return-Path: <mohta@necom830.hpcl.titech.ac.jp>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1CBE3A6ED5 for <asrg@core3.amsl.com>; Tue, 2 Jun 2009 23:35:27 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.09
X-Spam-Level:
X-Spam-Status: No, score=-0.09 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_JP=1.244, HOST_EQ_JP=1.265]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tlcr3KQD1BQX for <asrg@core3.amsl.com>; Tue, 2 Jun 2009 23:35:27 -0700 (PDT)
Received: from necom830.hpcl.titech.ac.jp (necom830.hpcl.titech.ac.jp [131.112.32.132]) by core3.amsl.com (Postfix) with SMTP id A57913A6E83 for <asrg@irtf.org>; Tue, 2 Jun 2009 23:34:53 -0700 (PDT)
Received: (qmail 87998 invoked from network); 3 Jun 2009 07:59:03 -0000
Received: from bmdk2253.bmobile.ne.jp (HELO necom830.hpcl.titech.ac.jp) (203.180.16.253) by necom830.hpcl.titech.ac.jp with SMTP; 3 Jun 2009 07:59:03 -0000
Message-ID: <4A2617DE.9030709@necom830.hpcl.titech.ac.jp>
Date: Wed, 03 Jun 2009 15:27:42 +0900
From: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: ja, en
MIME-Version: 1.0
To: Mark Andrews <marka@isc.org>
References: <200906030047.n530lVKF084525@drugs.dv.isc.org>
In-Reply-To: <200906030047.n530lVKF084525@drugs.dv.isc.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailman-Approved-At: Wed, 03 Jun 2009 12:09:27 -0700
Cc: Christian Huitema <huitema@windows.microsoft.com>, Francis Dupont <Francis.Dupont@fdupont.fr>, Anti-Spam Research Group - IRTF <asrg@irtf.org>, "ietf@ietf.org" <ietf@ietf.org>
Subject: Re: [Asrg] DNSSEC is NOT secure end to end (more tutorial than debating)
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 03 Jun 2009 06:35:28 -0000

Mark Andrews wrote:

>>A problem of blindly believing a zone administration is that it is
>>only as secure as blindly believing an ISP administration.
>>
>>Attacking a router of a large ISPs is as easy/difficult as attacking
>>a signature generation mechanism of a large zone.

> 	The difference is we *have* to trust the zone administration.

Zone administration involves multiple operations.

Though we have to trust the zone administration put correct referral
and glue data in a master zone file, unless we use DNSSEC, we don't
have to trust the zone administration never issue certificates over
forged keys of child zones.

You know, the former operation is much simpler, thus more secure,
than the latter.

						Masataka Ohta

v2.23.0 | Report a Bug | By Email