Re: [DNSOP] If DNSSEC signatures do not validate ...

[Shumon Huque <[e-mail]>]

On Tue, Apr 28, 2020 at 11:22 AM Paul Wouters <[e-mail]> wrote:

> On Tue, 28 Apr 2020, Davey Song wrote:
>
> > OK. It make sense to try every name servers to defend the case if the
> adversary only intercept one path. But the adversary also know the resolver
> will
> > retry other servers. So a smarter adversary may intercept in the
> aggregated upstreaming path where all queries are sent.
>
> Then those adversaries that seem able to block any packets from reaching
> you, can also block 8.8.8.8 and all known DoT and DoH servers by IP ?
> And send you RST packets.
>
> But if the attacks have that much power, they can also just RST all your
> TLS connections to webservers and just let let you have your DNS
> packets.
>
> I think you need to be a little more exact on the attack you are
> describing and what would be a sensible defense.
>
> Paul
>

+1

Davey - if there is a pervasive/omnipresent man-in-the-middle attacker,
then no security protocol (DNSSEC, TLS, HTTPS or any other) can
_prevent_ the attack. All they can do is to _detect_ that an attack is
taking
place (and probably abort).

Shumon.