Re: [pkix] RFC 6125, Server Identity Check and insecure DNS lookup

[[e-mail] (Martin Rex)]

Jeffrey Walton wrote:
> What does RFC 6125 mean when they say the following:
> 
>    2.4.  Server Identity Check
> 
>    o  The client MUST use the server hostname it used to open the
>       connection as the value to compare against the server name as
>       expressed in the server certificate.  The client MUST NOT use any
>       form of the server hostname derived from an insecure remote source
>       (e.g., insecure DNS lookup).  CNAME canonicalization is not done.
> 
> Is this saying that all DNS is considered insecure, and only the
> original hostname used by the client should be used for validation?
> 
> Or is it saying its OK to follow the CNAME aliases when using a
> "secure" DNS, like DNSSEC?


The difference here is "lack of trust" in the data contained in DNS.

The two characteristics that DNSSEC provides (according to its own
specification) is data origin authentication and data integrity protection.
But using DNSSEC does not increase the trustworthyness of the data
conveyed through DNS.

Similarily using HTTPS rather than HTTP for searching Google will provide 
only data origin authentication and data integrity protection for the
search results, but will not increase the trustworthyness of the
search results (there is no trust).


-Martin