Re: [DNSOP] [Int-area] Review request- DNS Secure authentication

[Roland Bless <[e-mail]>]

Hi,

Am 07.09.2014 um 17:30 schrieb Hosnieh Rafiee:
> I just wonder whether or not any of you had a chance to take a look on the
> new version of cga-tsig. If you haven't yet take a look please do it. I
> welcome your inputs. 
> 
> Do you think the problem statement is clear? 

No, IMHO it is not. Usually you need clear attacker models
to explain existing vulnerabilities. The current problem
statement is quite a mixup of various different security aspects
and thus not clear.

Just a few examples:
"DNS records can become compromised." => this is an attack
on the _integrity_, but it can be launched at different
locations and at different levels (e.g., in the DNS databased,
with the DNS server, on the wire in transit, etc.)

(TSIG)
"No protection against IP spoofing and DNS amplification"
- spoofed IP addresses are not a problem if the DNS RR
  integrity is assured...

- "Does not easily protect DNS data confidentiality"
  -> confidentiality where? Against an attacker on the
  wire? The DNS (recursive) resolver provider will always know what
  has been asked for...

and so on. Section 1 is therefore quite confusing.
Clearly define an attacker model and describe why
existing protocols do not protect against these
attacks.

Regards,
 Roland