Re: [keyassure] Objective: Restrictive versus Supplementary Models

[Martin Rex <[e-mail]>]

Martin Rex wrote:
> 
> > 
> > I think this is an important consideration. However a relevant
> > question for a 2119-level MUST seems to be whether we wish to have
> > this data rejected if not DNSSEC signed.
> > What's your view on that?
> 
> I'm much less worried about false positives resulting in DoS, which
> can be more easily achieved attacking at the network layer (IP, TCP).

Actually, a DoS based on spoofing an DANE TLSA record with incorrect
data and a long TTL into a DNS cache might turn out to be devastatingly
effective when unsiged TLSA records are accepted.

-Martin