Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Jelte Jansen <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Jesper G. Høy wrote:
> I agree - and I am not arguing against DNSSEC as a whole.
> As I started out saying - "There may be other good reasons to push DNSSEC" - distributing public keys certainly may be one of those.
> 
> However, this was in regards to the Kaminsky bug, which is all about carrying IP addresses (A/AAAA RRSets in response Additional section).
> So to clarify: DNSSEC doesn't make much difference when the bad guy is on-the-wire - for IP address records.
> 

Any protocol that uses A/AAAA addresses could be in danger if it doesn't
 have its own protection (and indeed still would be with DNSSEC, if an
attacker has full wire access). But, this includes DNS itself. Someone
nasty could, for instance, not change a www or smtp A record, but an
actual NS A record, thereby becoming authoritative for an entire zone,
and all its data.

> Without having thought this through, I think resolvers could probably ignore anything else (non A/AAAA RRSets) in the response Additional section - limiting the Kaminsky bug to such records. But that's a different thread...
> 

They should already :) (as well as ignore out-of-bailiwick etc)

Jelte

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIj0ju4nZCKsdOncURAk+UAJ9qNcxfhrAEDrZHM/OYf0Vs454sZwCgjrAd
3V0cDX5Re3zD+JS5gjBd/IA=
=t2RX
-----END PGP SIGNATURE-----

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>