Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[David Conrad <[e-mail]>]

On Aug 13, 2008, at 9:17 AM, Eric Rescorla wrote:
> At Tue, 12 Aug 2008 15:45:57 -0400 (EDT),
>>>> Only SSL can protect you here.
>>> As Dan Kaminsky points out: "SSL certs themselves are dependent on  
>>> the
>>> DNS".
>> Kaminsky is wrong.
> Based on my brief skim of Kaminsky's presentation, I think his
> argument is that because CAs often use e-mail answerback as a
> certificate validation mechanism, a compromise of DNS can be used to
> obtain a fake SSL/TLS certificate.

That is (as I understand) part of it.

> Of course, there's nothing stopping
> CAs from requesting more validation (in fact, I believe that's what EV
> certificates already do), in which case there would not be a DNS-based
> threat.

Right.  And if the CA uses VOIP that does a DNS lookup, or if the  
databases the CA uses are reached via DNS, or if the CA uses software  
that does self-updates after looking up the 'phone home' server via  
DNS, or ....

I believe what Dan was pointing out is the DNS is an underlying  
infrastructure which all sorts of other infrastructure relies upon and  
if you can crack the DNS infrastructure, lots of other stuff becomes  
much more "interesting" (in the Ebola virus sense of 'interesting'),  
sometimes in ways that aren't necessarily obvious.

Regards,
-drc


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>