Re: [saag] What does DNSSec protect? (Re: Last Call: <draft-dukhovni-opportunistic-security-01.txt> (Opportunistic Security: some protection most of the time) to Informational RFC)

[Henry B Hotz <[e-mail]>]

On Aug 10, 2014, at 7:36 AM, John C Klensin <[e-mail]> wrote:

> There is one sense in which trust models based on DNSSEC that
> seem to imply certification of non-DNS entities (like
> registrants) are more dangerous than ones based on CA chains.
> In the latter case, there are good, and obvious, analogies to
> many people's everyday experience.  If one finds someone who
> claims to be a notary but who operates out of the back of a
> taxicab, exhibits no credentials or authorization, who is
> willing to certify a document with no more identification of the
> signer than the ability to pay a few dollars in cash,  and
> trusts him to certify signatures on an important document, it is
> pretty generally understood what that certification is worth.
> We aren't quite there with CAs, but most people are able to at
> least understand applicability of the analogy.  On the other
> hand, when we build a system on top of the DNS and DNSSEC,
> relying on elaborate rituals like the signing of the root and
> layers of processes that are, for the typical user of the
> Internet, indistinguishable from magic, and fail to be clear
> that, e.g., no actual certification of registrant identity or
> integrity is involved, people may trust the magic rather than
> trusting DNSSEC as it is.  

There is one sense in which trust models based on DNSSEC are less dangerous than CA chains. The keys are issued by the same people who are responsible for directing traffic (via DNS) to a named entity, not by some other people at a different business in another country. My favorite example of this is the US Federal Bridge CA, which is not on the standard browser trust lists. At the same time a number of hostile (to the US) foreign governments *are* on those lists.

Where I think we agree is that having simple, clear, and accurate descriptions of what a technology does is critical so no one gets a really nasty surprise.

Personal email.  [e-mail]