IETF Logo Mail Archive

Re: [DNSOP] DNSSEC as a Best Current Practice

Paul Wouters <paul@nohats.ca> Tue, 22 March 2022 12:38 UTC

Return-Path: <paul@nohats.ca>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1175B3A11BA for <dnsop@ietfa.amsl.com>; Tue, 22 Mar 2022 05:38:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NljWbov0lHzx for <dnsop@ietfa.amsl.com>; Tue, 22 Mar 2022 05:37:58 -0700 (PDT)
Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFC1F3A11F6 for <dnsop@ietf.org>; Tue, 22 Mar 2022 05:37:55 -0700 (PDT)
Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 4KN9xY3KbVz3mt; Tue, 22 Mar 2022 13:37:53 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1647952673; bh=CqFbDf7PY8I08/TtBidZTxVmMbJT4CNM7oeTTcNsKOY=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=QoSN2rY+tWfqBwYN2v1yIR7zEIyUDNYQGiC5b+qMoV0kEAqwMPWh/y/yTyq6Rr112 5DNV+R9VQPb+v1GBYzDM0eEsZ3Sp/u6soIUaA2Nb270oU0QswdFpjG+t9xLz1ylbG8 AqAZfi66S4WMYCwPooWz3os9iWWxTbQh4INKxmew=
X-Virus-Scanned: amavisd-new at mx.nohats.ca
Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id 41ve6zf5YGtA; Tue, 22 Mar 2022 13:37:52 +0100 (CET)
Received: from bofh.nohats.ca (bofh.nohats.ca [193.110.157.194]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Tue, 22 Mar 2022 13:37:52 +0100 (CET)
Received: by bofh.nohats.ca (Postfix, from userid 1000) id 983792CEF24; Tue, 22 Mar 2022 08:37:51 -0400 (EDT)
Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 949892CEF23; Tue, 22 Mar 2022 08:37:51 -0400 (EDT)
Date: Tue, 22 Mar 2022 08:37:51 -0400
From: Paul Wouters <paul@nohats.ca>
To: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>
cc: "dnsop@ietf.org WG" <dnsop@ietf.org>
In-Reply-To: <e722a37a-1476-d90b-b4df-e9d4604bea59@necom830.hpcl.titech.ac.jp>
Message-ID: <e8566381-d8e8-b99f-67c3-2e89dc9cb85@nohats.ca>
References: <163bfd78-c21d-084c-9f6d-9d29b80bcbd1@necom830.hpcl.titech.ac.jp> <7B3A5D3D-2E84-45A7-BE5F-3BAC3650E95C@hopcount.ca> <e722a37a-1476-d90b-b4df-e9d4604bea59@necom830.hpcl.titech.ac.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/CI4WUOPeMsUGmBf4Oq25vW71wV4>
Subject: Re: [DNSOP] DNSSEC as a Best Current Practice
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Mar 2022 12:38:03 -0000

On Tue, 22 Mar 2022, Masataka Ohta wrote:

> Partially yes, because DNSSEC is not cryptographically secure.

> Wrong. DNSSEC as PKI is not cryptographically secure subject to
> MitM attacks on CA chains, which is not more difficult than
> MitM attacks on ISP chains.

I think at this point we have reached a point where your repeated
claims lack any merit and you keep refusing to elaborate so we
cannot further progress on this topic.

Perhaps the chairs can ask you to either substantiate your claims,
or for you to stop making false misleading claims.

Paul

v2.23.0 | Report a Bug | By Email