Re: OFFTOPIC: DNSSEC groupthink versus improving DNS

[Mark Andrews <[e-mail]>]

> bert hubert wrote:
> > Or 79 page presentations called "DNSSEC in six minutes" - giving people 4.6
> > seconds per page. It is just not real.
> > http://www.isc.org/sw/bind/docs/DNSSEC_in_6_minutes.pdf 
> 
> I've seen this document in the past and it actually turned me and others
> completely off the idea of DNSSEC, which in part was what led to me
> playing with encryption funnily enough, because it seems to me most are
> promoting 30 day TTLs on the sigs, which means 30 days of replay attacks
> potentially,

	and the alterative is arbitary data insertion.

	You could have online keys and sign every response with a
	ttl + clock skew based window.  This requires that the
	private key is on all slaves.  The crypto hardware guys
	will love you :-)

	Note this is a implementation / deployment trade off.  The
	protocol supports either senario.

> not to mention the whole re-signing every 30 days.

	Which can be completely automated.  Has already been in
	some senarios.  I havn't re-signed my zones for months
	despite using a 30 day expiry period on the signatures.

	It is set and forget.  More and more of the process will
	become "set and forget" as the tools develop.

> Who ever thought that does not live in the real world, people
> administering servers with X.509 certs that expire yearly is bad enough,
> but every 30 days or less???

	Well if you know that the data will be stable for a year
	you can sign once a year.
 
> That alone is going to be a show stopped for most if not all admins with
> too many things to do and not enough time to do everything.

	The tools today can take a signed zone and re-sign it as
	well as incrementing the SOA serial in the process.  Re-signing
	then reloading can be run from cron on a weekly basis.

	Note the tools will only get better so the costs will
	continue to go down.  They have gone down enormously from
	the original design costs.

	Mark
> -- 
> 
> Best regards,
>  Duane
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>