Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Dean Anderson <[e-mail]>]

[ Moderators note: Post was moderated, either because it was posted by
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. 
   Please fix your subscription addresses. ]

On Mon, 11 Aug 2008, David Conrad wrote:
> 
> > Only SSL can protect you here.
> 
> As Dan Kaminsky points out: "SSL certs themselves are dependent on the  
> DNS".

Kaminsky is wrong. SSL uses DNS to obtain an IP address to connect to a
server, and then expects the server to produce a certificate, which the
client verifies. Spoofing DNS does not enable the attacker to obtain the
private key to the valid certificate.  The DNS domain information placed
in a certificate merely allows the client to determine before
verification if it got the certificate it asked for. However the wrong
or fake certificate won't verify unless there is a fault in the
Certification Authority (this happened with MS some years ago). But a
spoofed DNS name going to a wrong server results in a failure to verify
the certificate. So SSL is NOT "dependent on DNS".

Of course, if spoofed DNS sends the SSL connection to the wrong server,
a DOS attack still results since one didn't get to the correct server. 
In that sense, everything a user does is dependent on DNS. 

But it is not the case that your bank information can be stolen by this
DNS attack, as Kaminsky seems to have told the mainstream press.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>