Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Mark Andrews <[e-mail]>]

> At Thu, 14 Aug 2008 10:43:46 +1000,
> Mark Andrews wrote:
> > 
> > 
> > > The problem here is not PKI or DNSSEC but that we have no good
> > > mechanisms in the generic case for determining whether a given
> > > individual is authorized to control a given domain. This makes any
> > > cryptographic authentication of domain name ownership problematic.
> > 
> > 	Most zones are created when they are bought.  The buyer
> > 	specifies the NS, DS and glue records as part of that
> > 	transaction.  The credentials for future transactions are
> > 	established as part of that initial transaction.
> > 
> > 	Now when zones are sold there are issues but those issues
> > 	exist independent of whether DNSSEC is in use or not.
> > 
> > 	If you are authorised to update the delegation information
> > 	in the parent then you should be authorised to change the
> > 	DS records in the parent as they are just part of the
> > 	delegation.  Changes to NS, A, AAAA and DS records as part
> > 	of the delegation are equally dangerous as each other.
> > 
> > 	There is no need to make the parent / child trust relationship
> > 	more complicated with DNSSEC than it is without DNSSEC.
> 
> Yes, I agree with that. But in many of these cases, the credentials
> are "here's the email address to contact the technical contact with".
> This is of course just as problematic as e-mail answerback for 
> certificate authorites. 

	And how does this change with DNSSEC?  DNSSEC doesn't
	magically make this any more or less important / difficult.

	This is NOT a DNSSEC issue.  It is a delegation management
	issue and DNSSEC does NOT change the level of care required
	when managing a delegation.  All DNSSEC changes is whether
	a DS record is recorded at the delegation or not.

	Labeling this a DNSSEC deployment issue is doing DNSSEC a
	dis-service.

	What would help would be for ICANN to list which registrars
	support DS and/or AAAA records as part of normal operations
	and which ones don't.  By normal operations I mean that you
	don't have to send special email to get the records added.

	At the moment it's hard to find a registrar which supports
	AAAA and/or DS records.

> And to the extent to which the registrars/registries have a
> DNS-independent way of validating the domain owners, the CAs 
> (who in at least some cases are the same people!) could
> presumably leverage that to determine whether to issue
> the certs.
> 
> -Ekr
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>