Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[David Conrad <[e-mail]>]

Joe,

On Jul 25, 2008, at 10:03 AM, Joe Abley wrote:
> I think that's wrong. I think that once someone is in the position  
> of being able to meddle with the query/response stream, all bets are  
> off and DNSSEC is no cure.

The whole point of DNSSEC is to allow for the validation of responses  
by a validator to ensure they haven't been mucked with in transit.   
The most that an attacker, anywhere in a properly configured DNSSEC- 
protected query/response path, can do is denial of service.

Once the response leaves the validator on its way to the application,  
either via the response to an unprotected stub resolver call over the  
network or via a intra-machine IPC, it can, of course be mucked with.   
This is why I believe that if people want to be safe, they need to run  
a validating caching server on their local machine (if the intra- 
machine IPC can be compromised, you've got bigger problems).

But maybe I'm lacking context here...

Regards,
-drc


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>