Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Brian Dickson <[e-mail]>]

Joe Abley wrote:
>
> On 24 Jul 2008, at 18:14, Jelte Jansen wrote:
>
>> how would you verify anything without a trust anchor?
>
> Surely that's a mechanical detail.
>
>> I don't think anyone here implies that DNSSEC works when you do not
>> actually turn it on on the resolver you are using.
>
> The implication I was replying to seemed to state fairly clearly that 
> DNSSEC would make it impossible for middleboxes to meddle with DNS 
> queries and replies and provide answers that were not those that would 
> be received from the authority-only servers concerned.
>
> I think that's wrong. I think that once someone is in the position of 
> being able to meddle with the query/response stream, all bets are off 
> and DNSSEC is no cure.
>
> What is required to circumvent such sabotage is not the ability to 
> verify the integrity of the data in-band, but either the ability to 
> signal that signatures should be present out-of-band, or a means of 
> verifying transport integrity to a resolver which is trusted, or 
> something. DNSSEC on its own isn't enough.

Would this be something analogous to the NSEC3 thing which gives the 
ability to "authenticate" NXDOMAIN responses by giving information about 
adjacent actual domains, modulo hashing to prevent zone enumeration?

I.e. something which would return authoritative "no DS record present" 
in a similar sense, with extra information to allow the receiver to 
trust the response (about no DS being present, that is)?

This would enable in-band resolvers to validate both the data, and the 
presence or absence of zone signatures, on delegation chains, and 
prevent downgrade attacks even by man-in-the-middle interference.

Well, not so much prevent, as much as make it obvious that it is 
happening, and to allow the resolver to reject suspect data when the 
signature has been stripped...

Brian

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>