Re: Interpreting DNSSEC was Re: [dnsext] flip-flopping secure and unsecure DNAME/CNAME

[Edward Lewis <[e-mail]>]

At 12:03 +0400 10/27/08, Stephane Bortzmeyer wrote:
>[Warning, most of the ideas here come from my colleeague Mohsen
>Souissi but he is too busy to write now.]

He provides a good "straight man" [http://en.wikipedia.org/wiki/Comic_foil]...

>The reasonable thing to do, security-wise, is to decide that the
>validity of the "DNS session" is the validity of the *worse*
>iteration. If all the "DNS iterations" yield Secure and one yields
>Insecure, the whole session is Insecure. If some yield Secure, some
>Insecure, and one yields Bogus, the net result is Bogus.

That's valid - but remember that DNSSEC does not protect the DNS 
session, just the passing of data through the system of servers.

Consider the query for "T_ANY" towards any authoritative server's 
apex (of any zone hosted).  The return includes SOA, NS, and maybe 
other record sets.  DNSSEC can be used to set-wise individually 
validate, but not report a status for the entire answer.  (As in, 
there's just one RCODE field, no way to say "this is good, that bad, 
that good.)

We were frustrated by that inability when writing the code way back.

>More complicated to handle since it is not purely DNS. Is the HTTP
>redirection done over TLS? :-)

And that's also directly working into the point I was making, the 
security of the session is dependent on all sorts of things, in this 
case external to DNSSEC.  DNSSEC can't (as in lacks the bit fields 
to) "protect" the chain from what the consuming user types into the 
browser and where the HTTP protocol ultimately sends the user.

Yes, a bit far fetched and out of bounds for a DNS argument.  I 
mentioned this example to show why we really can't go even "half-way" 
to securing a CNAME/DNAME/query re-direction/write "path" through the 
DNS, just the data as it is presented.  You have to also trust the 
software correctly implements the protocol, not just sign the data.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                [phone]
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>