RE: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Jesper G. Høy <[e-mail]>]

Danny Mayer wrote:
> > I agree - and I am not arguing against DNSSEC as a whole.
> > As I started out saying - "There may be other good reasons to push
> DNSSEC" - distributing public keys certainly may be one of those.
> > However, this was in regards to the Kaminsky bug, which is all about
> carrying IP addresses (A/AAAA RRSets in response Additional section).
> > So to clarify: DNSSEC doesn't make much difference when the bad guy
> > is on-the-wire - for IP address records.
> That's not true either way. DNSSEC will protect you from the bad guy on
> the wire.

My point was that it doesn't matter that you get the correct IP address
(signed by DNSSEC) if the bad buy is on the wire.
In that scenario he can just spoof that IP address and replace web-sites
etc. with his own data.
Only SSL can protect you here.


> But the A/AAAA records in the additional section is not the
> only part that needs protection. The authority section also needs
> protection since they contain the authorative nameserver names. By
> diverting further queries to their own nameservers they no longer need
> a cachepoisoning attack.

Right - but NS-records point to host names which point to A/AAAA records
which point to IP addresses.
Comes back to the same thing - if the bad guy is on the wire, you are still
in trouble...
DNSSEC or not.


> > Without having thought this through, I think resolvers could probably
> > ignore anything else (non A/AAAA RRSets) in the response Additional
> section - limiting the Kaminsky bug to such records. But that's a
> different thread... 
> And what about the authority section?

Se above.


> > Carrying IP addresses is still by far the biggest use of DNS.
> No it isn't. MX records are almost as big. And then there are SRV
> records.

OK - but MX-records point to host names which point to A/AAAA records which
point to IP addresses...
If the bad guy is on the wire, he can intercept and replace your SMTP
traffic anyway. 
DNSSEC or not.

SRV-records also point to host names which...


> > And I am just not convinced that it is a good idea to apply DNSSEC's
> complexity to this most fundamental part of our Internet.
> > I believe a simpler solution stands a much better chance of actually
> being implemented and used, and therefore is more secure overall.
> > Especially if such a solution does not require any end-user action
> other than patching.
> Go look at Dan Kaminsky's slides for the fuller picture

I see nothing in the slides that suggest that DNSSEC is the only true
solution or that rule out other solutions.
On the contrary it seems to me that Dan Kaminsky himself is suggesting other
solutions in his latest blog entry on the matter...


Sincerely,
Jesper



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>