Subject: [Asrg] DNSSEC not deployable

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Fri, 4 Jul 2003 07:02:11 -0700

> Keep in mind the DNS-Sec standards exist and ICANN is even 
> implementing 
> some of them. Security of the Domain Name System is being addressed.

This is unfortunately NOT the case.

Despite objections brought by VeriSign, the operators of the .de 
registry, the author of BIND and many others the IETF has refused
to allow changes to the DNSSEC protocol to address the problem
of deployment in large zones.

These changes were agreed by the majority of the working group but 
blocked by one of the chairs.

Unless the IESG decides to intervene to reverse this situation 
ubiquitous deployment of DNSSEC will not be possible using the
IETF approved specification.

There is a lot of work going on in ICANN that concerns the security
of the root servers, but this is from an operations point of view.
There is no DNS security work taking place in ICANN of the sort that
would address the dependency of RMX type schemes.

Regretably the situation is no better with respect to BGP security.

This is going to get fixed, but it will take a couple of years
before either the IESG is forced to back down from its current 
position or there is general agreement in the industry that it
is time to take the DNS and BGP standards out of IETF process.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Fri, 04 Jul 2003 10:42:10 -0400

Crap. Lies and Crap.

---

From: Florian Weimer <[email-masked]>
Date: Mon, 07 Jul 2003 17:10:48 +0200

> IETF approved specification.

To be honest, I doubt that the technical problems are relevant.

There is simply no application for DNSSEC.  Of course, it's nice to
get rid of the insecure DNS transport protocol with its tiny request
ID, but this doesn't warrant the incredible complexity of DNSSEC.
There are name-based attacks, of course (often employing the "@" trick
in http:// URLs, in other cases suitable domain names are registered),
but DNSSEC wont prevent any of them.

Now mail control could be *the* application that pushes DNSSEC, but
the current state seems to be that no single mail control solution
will evolve, and in a situation of multiple, competing solution
attempts, a DNSSEC requirement is a huge disadvantage.  (Anyway, for
the level of mail control we are aiming at, the security of the
current DNS is probably sufficient.)

> Regretably the situation is no better with respect to BGP security.

Same here.  Even if some Secure BGP variant arrives which resolves the
trusted intermediates problem, the corresponding trusted registration
authority for relating ASNs, prefixes, and public keys won't come into
existence without government regulation.  Look at the state of current
WHOIS data to get a glimpse on the future.  I bet that many ISPs will
automatically certify customer announcements, to save money and avoid
scaring away customers.  What's worse, there are advanced frauds an
ISP is unlikely to detect.