Re: [dnsext] Possible DNSSECbis clarifications

[Michael Graff <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 3/28/11 6:13 PM, Miek Gieben wrote:
> [ Quoting Marc Lampo at 17:55 on March 28 in "Re: [dnsext] Possible  DNSSECbis cl"... ]
>> A "theorical" attack would be a "man-in-the-middle" change the trailing
>> SOA, thus causing the secondary server to throw away each zone transfer it
>> attempts (if it "believes" the second SOA is correct, in the absence of a
>> valid RRSIG for it - that trailing SOA).
> 
> If you are scared of mitm attacks you should use tsig to secure the
> transfer IMO.

+1

DNSSEC is a query thing to me.  I don't know of any servers that
validate the transfer on load, but I am most familiar with BIND 9.

But, suppose there was a MITM attack and data was changed, the server
validated the data during transfer, and the data failed validation.  It
would then reject the transfer, just like if the SOAs don't match.

- --Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNkLY6AAoJEDRzoY2A7tzbNKAH/24AgRvdQZP14Bq5pJRM9MAk
C7YUXaCaHCHS0W7ZX/r1idcqwFDQIAvMojPSRPfy7Tky+XXcNQ2OuctARaDKC41W
MxhCy70T9KFLBI+mlIt543chxyibRQqJ9q/2d9TTu8NTqanUnm0PhX1TZdZruZUd
4A02K44iRKQpOPN1dJHbQ+zrG/JeG2K8tFGkOqm6h9ZDvWQLQnoWExUB2O/ufRsr
kKaoLuUcIDXc5Q9ci3Ayf0DlD/77Hkbnuge6MI4cLc/wT8mzEJizeG3aawP/pJOE
aU3mTw5w1PJxqj9D62hxhVBe9Qo+qlFLB8wYmzva8ns/QkprVUH+ZSGj+SLK8uQ=
=7YMA
-----END PGP SIGNATURE-----