Subject: RE: Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13
From: Christian Huitema <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Mon, 13 Jul 2015 19:11:30 +0000
List-Id: IETF-Discussion <ietf.ietf.org>

On  Monday, July 13, 2015 11:47 AM, Viktor Dukhovni wrote 
> On Mon, Jul 13, 2015 at 02:36:18PM -0400, Sam Hartman wrote:
> 
> > I have never been convinced that DNSsec validation of A or AAAA
> > records has value.  I understand I am a heretic in the security
> > community for saying that, but there it is.
> 
> I'm inclined to agree that the value is marginal.
>
> ...
>
> Forging IP address records in DNS is rather tamper-evident.  It is far more
> attractive to attack BGP, and MiTM or just monitor the traffic transparently.

Consider the use case. The hot spot controls the default router, and often implements a NAT. They can decide to terminate the A or AAAA address wherever they please. The value of ensuring proper name to address resolution is indeed marginal.

-- Christian Huitema