Re: [DNSOP] DNSSEC as a Best Current Practice

[Masataka Ohta <[e-mail]>]

Paul Wouters wrote:

>>  Constructive thing to do to make DNS secure is to totally
>> abandon DNSSEC and rely on DNS cookie or something like that.

> DNS cookies provide no data origin security, only a weak transport
> security against non-onpath attackers.

If a resolver correctly knows an IP address of a nameserver of a
parent zone and the resolver and the nameserver can communicate
with long enough ID, the resolver can correctly know an IP
address of a nameserver of a child zone, which is secure enough
data origin security.

As for MitM attacks, PKI, in general, is insecure against
them as was demonstrated by diginotar. So, don't bother.

IETF can do nothing if some government legally force
people to install some government provided certificates
to some PKI, including DNSSEC, which is as easy as
MitM attacks on ISP chain may be by government order.

					Masataka Ohta