Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[David Conrad <[e-mail]>]

Jesper,

On Aug 10, 2008, at 11:02 AM, Jesper G. Høy wrote:
> My point was that it doesn't matter that you get the correct IP  
> address
> (signed by DNSSEC) if the bad buy is on the wire.

> In that scenario he can just spoof that IP address and replace web- 
> sites etc. with his own data.


Ignoring for the moment the fact that 134 million (or even 4 billion)  
packets isn't that much anymore (and will be less and less over time),  
the DNS lookup 'wire' is logically distinct from the content 'wire'.   
The ability to "intercept spoof" a DNS response can occur anywhere on  
the DNS lookup 'wire', not only on the content producer/consumer's  
local LAN.  By not protecting the packet content, you open yourself up  
to a distinct set of attackers beyond the local wire.

> Only SSL can protect you here.

As Dan Kaminsky points out: "SSL certs themselves are dependent on the  
DNS".

> I see nothing in the slides that suggest that DNSSEC is the only true
> solution or that rule out other solutions.

Indeed.  DNSSEC may not be the 'only true solution' and there may be  
other solutions.  The vast majority of folks who have burned brain  
cells and stomach lining on DNSSEC could be complete idiots and an  
obvious, complete, lightweight, and architecturally clean solution  
could be staring all of us in the face.  I look forward to reading  
your draft on the topic  (note that I wouldn't consider a solution  
that ignores the risk on the DNS lookup 'wire' complete, but maybe  
that's just me).

I would however note that partly as a result of this latest incident  
of having it pointed out that it is better to protect data content  
than the data channel, the amount of DNS infrastructure out there  
capable of supporting DNSSEC (and the political will to see it  
deployed) has likely taken a very significant jump...

Regards,
-drc


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>