RE: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Jesper G. Høy <[e-mail]>]

I agree - and I am not arguing against DNSSEC as a whole.
As I started out saying - "There may be other good reasons to push DNSSEC" - distributing public keys certainly may be one of those.

However, this was in regards to the Kaminsky bug, which is all about carrying IP addresses (A/AAAA RRSets in response Additional section).
So to clarify: DNSSEC doesn't make much difference when the bad guy is on-the-wire - for IP address records.

Without having thought this through, I think resolvers could probably ignore anything else (non A/AAAA RRSets) in the response Additional section - limiting the Kaminsky bug to such records. But that's a different thread...

Carrying IP addresses is still by far the biggest use of DNS.
And I am just not convinced that it is a good idea to apply DNSSEC's complexity to this most fundamental part of our Internet.
I believe a simpler solution stands a much better chance of actually being implemented and used, and therefore is more secure overall.
Especially if such a solution does not require any end-user action other than patching.

Sincerely,
Jesper



> -----Original Message-----
> From: Alex Bligh [mailto:[e-mail]]
> Sent: Tuesday, July 29, 2008 5:23 PM
> To: Jesper G. Høy; [e-mail]
> Cc: Alex Bligh
> Subject: RE: How do we get the whole world to upgrade to DNSSEC capable
> resolvers?
> 
> 
> 
> --On 29 July 2008 17:05:09 +0200 "Jesper G. Høy" <[e-mail]>
> wrote:
> 
> > If DNSSEC tell you (signed and secure) that my website is at 1.2.3.4
> -
> > the bad guy on the wire can still intercept and replace all the
> traffic
> > from your browser to 1.2.3.4 and feed his own stuff back to your
> browser
> > appearing to come from 1.2.3.4.
> >
> > Having the correct IP address of my web-server is no guarantee that
> you
> > are actually talking to the right server - when the bad guy is
> > on-the-wire that is.
> 
> Sure, but then that's true of any use of trusted information in an
> insecure manner. DNS doesn't just carry IP addresses, and there's
> nothing
> to prevent one from putting other information (e.g. public keys) in the
> DNS. You mentioned "that's what SSL is for"; it would be equally
> possible
> to secure http (or smtp or whatever) using public keys retrieved over
> DNSSEC to avoid the attack you mention over. Without DNSSEC you need
> some other mechanism of ensuring the public key is correct; whilst
> SSL certificates have got good traction for HTTP, they haven't for
> (e.g.) SMTP.
> 
> This is a useful discussion if only because it shows there are two
> meanings
> of "on the wire attacks" (i.e. attacks to DNS, and attacks based on an
> intercept of the results of the lookups).
> 
> Alex



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>