IETF Logo Mail Archive

Re: DNSCurve vs. DNSSEC - FIGHT! (was OpenDNS today announced it has adopted DNSCurve to secure DNS)

Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp> Fri, 26 February 2010 08:56 UTC

Return-Path: <mohta@necom830.hpcl.titech.ac.jp>
X-Original-To: ietf@core3.amsl.com
Delivered-To: ietf@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 184F43A8279 for <ietf@core3.amsl.com>; Fri, 26 Feb 2010 00:56:56 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.654
X-Spam-Level:
X-Spam-Status: No, score=0.654 tagged_above=-999 required=5 tests=[AWL=-0.745, BAYES_05=-1.11, HELO_EQ_JP=1.244, HOST_EQ_JP=1.265]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mDXo2wAUJYeC for <ietf@core3.amsl.com>; Fri, 26 Feb 2010 00:56:55 -0800 (PST)
Received: from necom830.hpcl.titech.ac.jp (necom830.hpcl.titech.ac.jp [131.112.32.132]) by core3.amsl.com (Postfix) with SMTP id 084723A7B03 for <ietf@ietf.org>; Fri, 26 Feb 2010 00:56:54 -0800 (PST)
Received: (qmail 79968 invoked from network); 26 Feb 2010 10:02:11 -0000
Received: from bmdk2060.bmobile.ne.jp (HELO necom830.hpcl.titech.ac.jp) (203.180.16.60) by necom830.hpcl.titech.ac.jp with SMTP; 26 Feb 2010 10:02:11 -0000
Message-ID: <4B878D2C.6080704@necom830.hpcl.titech.ac.jp>
Date: Fri, 26 Feb 2010 17:58:20 +0900
From: Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja-JP; rv:1.4) Gecko/20030624 Netscape/7.1 (ax)
X-Accept-Language: ja, en
MIME-Version: 1.0
To: Phillip Hallam-Baker <hallam@gmail.com>
Subject: Re: DNSCurve vs. DNSSEC - FIGHT! (was OpenDNS today announced it has adopted DNSCurve to secure DNS)
References: <874c02a21002231826y613b9f97ya83740ba240f7bf9@mail.gmail.com> <p06240819c7ab46c7fbf9@10.20.30.158> <4B859F15.9080106@acm.org> <4B85B7E5.1000104@necom830.hpcl.titech.ac.jp> <201002242347.o1ONlt7L023898@drugs.dv.isc.org> <4B85BF52.7030004@necom830.hpcl.titech.ac.jp> <c331d99a1002241619y47f91f50g4433a7233350dc74@mail.gmail.com> <4B85DBCA.2060407@necom830.hpcl.titech.ac.jp> <4B862D03.7060602@gnutls.org> <4B863571.40604@necom830.hpcl.titech.ac.jp> <a123a5d61002250614h36c51a42xebb54c3cc340829d@mail.gmail.com>
In-Reply-To: <a123a5d61002250614h36c51a42xebb54c3cc340829d@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Cc: Paul Hoffman <paul.hoffman@vpnc.org>, IETF Discussion <ietf@ietf.org>
X-BeenThere: ietf@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF-Discussion <ietf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ietf>
List-Post: <mailto:ietf@ietf.org>
List-Help: <mailto:ietf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ietf>, <mailto:ietf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 26 Feb 2010 08:56:56 -0000

Phillip Hallam-Baker wrote:

> SSH is not a bad security protocol. It provides a very high level of
> protection against high probability risks with little or no impact on
> the user. There is a narrow window of vulnerability to a man in the
> middle attack.

As a security researcher, I can teach you that the security you
observe is not of SSH but of return routability.

Return routability over many third party ISPs is not 'verifiable',
of course.

							Masataka Ohta

v2.23.0 | Report a Bug | By Email