IETF Logo Mail Archive

Re: [dnsext] Historical root keys: The Large Router Vendor Speaks

Ted Lemon <Ted.Lemon@nominum.com> Fri, 28 January 2011 19:32 UTC

Return-Path: <Ted.Lemon@nominum.com>
X-Original-To: dnsext@core3.amsl.com
Delivered-To: dnsext@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7B3D83A6962 for <dnsext@core3.amsl.com>; Fri, 28 Jan 2011 11:32:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.595
X-Spam-Level:
X-Spam-Status: No, score=-106.595 tagged_above=-999 required=5 tests=[AWL=0.004, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cJjaEghlTeKo for <dnsext@core3.amsl.com>; Fri, 28 Jan 2011 11:32:44 -0800 (PST)
Received: from exprod7og117.obsmtp.com (exprod7og117.obsmtp.com [64.18.2.6]) by core3.amsl.com (Postfix) with ESMTP id A93E73A695D for <dnsext@ietf.org>; Fri, 28 Jan 2011 11:32:44 -0800 (PST)
Received: from source ([64.89.228.229]) (using TLSv1) by exprod7ob117.postini.com ([64.18.6.12]) with SMTP ID DSNKTUMal6Qkh/efvoxafpj7wiWqiDbayM4n@postini.com; Fri, 28 Jan 2011 11:35:52 PST
Received: from archivist.nominum.com (archivist.nominum.com [64.89.228.108]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by shell-too.nominum.com (Postfix) with ESMTP id 7556E1B8314 for <dnsext@ietf.org>; Fri, 28 Jan 2011 11:35:51 -0800 (PST)
Received: from webmail.nominum.com (webmail.nominum.com [64.89.228.50]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (Client CN "webmail.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by archivist.nominum.com (Postfix) with ESMTP id 5246319005D; Fri, 28 Jan 2011 11:35:51 -0800 (PST)
Received: from vpna-148.vpn.nominum.com (64.89.227.148) by exchange-01.win.nominum.com (64.89.228.50) with Microsoft SMTP Server (TLS) id 8.2.176.0; Fri, 28 Jan 2011 11:35:50 -0800
MIME-Version: 1.0 (Apple Message framework v1082)
Content-Type: text/plain; charset="us-ascii"
From: Ted Lemon <Ted.Lemon@nominum.com>
In-Reply-To: <4D4310D6.7090007@cisco.com>
Date: Fri, 28 Jan 2011 14:35:46 -0500
Content-Transfer-Encoding: quoted-printable
Message-ID: <4118D421-D55D-46EF-8138-4470DAD7BB29@nominum.com>
References: <4D41D3E2.6060107@cisco.com> <3125F45F-7594-498F-AFA3-D2D738A228F5@hopcount.ca> <4D42ED13.5030000@cisco.com> <562C7583-B719-482F-B201-EFB54138BAF1@icsi.berkeley.edu> <E4865E48-383B-4591-AF27-34571C4AA367@nominum.com> <4D430265.8020100@cisco.com> <CC2F983A-2F05-46D9-8901-326105577864@nominum.com> <4D4310D6.7090007@cisco.com>
To: John Bashinski <jbash@cisco.com>
X-Mailer: Apple Mail (2.1082)
Cc: Nicholas Weaver <nweaver@ICSI.Berkeley.EDU>, dnsext List <dnsext@ietf.org>, george.barwood@plueyonder.co.uk
Subject: Re: [dnsext] Historical root keys: The Large Router Vendor Speaks
X-BeenThere: dnsext@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: DNS Extensions working group discussion list <dnsext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsext>
List-Post: <mailto:dnsext@ietf.org>
List-Help: <mailto:dnsext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsext>, <mailto:dnsext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 Jan 2011 19:32:45 -0000

On Jan 28, 2011, at 1:54 PM, John Bashinski wrote:
> I guess my answer is that enemies that powerful may indeed be out of
> scope for default behavior. If you're worried about that, you may need
> to do something out of band to validate your DNSSEC keys.  The current
> plan requires every product to enable you to do that, by the way.

Your local ISP (or, indeed, the criminal with no arrest record who got a job at your local ISP) is perfectly capable of setting this up.   It's not even difficult.

v2.23.0 | Report a Bug | By Email