Re: [dbound] draft-brotman-rdbd

["John R. Levine" <[e-mail]>]

>> If you can believe the
>> signature record has integrity because whatever, you can believe the
>> same thing about a much simpler pointer record.
>
> Wrong. As previously explained.
>
> Your "whatever" above ignores all I said about public keys
> known with integrity. And your "the same thing" is not true
> on its face, when DNSSEC is not universal.

No, really, it doesn't.  You're saying the public key is a token that 
people can find credible through a variety of routes, DNSSEC, stable 
publication, whatever.  But exactly the same routes to credibility apply 
to pointer records.

I also note that in practice, there doesn't ever seem to have been a 
spoofing attack on DKIM key records so in practice mail validators always 
accept them as valid.  Mine have DNSSEC signatures but I'm not aware of 
any DKIM software that gives extra points to signed DKIM keys.

I suppose that if there were some very high value application that 
depended on rdbd records there might be more of an incentive to use DNS 
attacks to fake them, but it all seems like a lot of extra work for 
utterly speculative benefits.

Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly