Re: [dane] Behavior in the face of no answer?

[Nicholas Weaver <[e-mail]>]

On May 7, 2012, at 9:11 AM, Paul Hoffman wrote:
>> Because DANE without nearly-hard-fail [1] on no data, not just BOGUS data, AND client-side validation, is no different that browser CRLs in terms of protection to the users in the face of an actual attack.
> 
> It is very different, but I hear that you don't believe that. Many of us believe that there can be integrity-protected communication with recursive resolvers that do DNSSEC, even if that is not common today.

This requires 

a)  Changing the on the wire protocol to the recursive resolver.   Changes to both the recursive resolver and the clients.  And changes to how clients are configured to use DNS servers in order to establish this secure channel.  (sDHCP anyone?)

b)  If on port 53, the same problem with borken middleboxes as doing DNSSEC on the client.  Even on different ports over an IPsec tunnel you may have middlebox issues.

c)  Can only be used in environments where the recursive resolver can legitimately be placed within the trusted base for communication.





And if thats your argument, then DANE should have the following caveats:

In the absence of client validation, recursive resolver validation only provides a meaningful security benefit for DANE records if:

1)  The recursive resolver is trustworthy as defined by local network policy.  ISP-provided and third party public recursive resolvers MUST NOT be considered trustworthy.

2)  Client to recursive resolver communication is over a secure channel.  Establishing and securing such a channel is outside the scope of this document.