Subject: Re: [DNSOP] [dnsext] We want to have fruitful discussions - please review

From: 神明達哉 <[email-masked]>
Date: Mon, 3 Mar 2014 08:44:14 +0000

I have one quick question for my own understanding:

At Fri, 28 Feb 2014 15:55:21 +0100,
"Hosnieh Rafiee" <[email-masked]> wrote:

> [...] For DNS resolver, it
> receives this IP address securely via the option in the router advertisement
> message.

So, the security of this approach relies on how securely the client
can get the resolver's address, e.g.,
- Using SEND for RAs with RFC 6106
- (If and when it's defined) Using public-key based DHCPv6
  authentication
And, to make this part secure, the client needs to get the router's
certification or the server's public key securely beforehand.

Is my understanding correct?

--
JINMEI, Tatuya

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Mon, 3 Mar 2014 10:14:03 +0100

Hi JINMEI,

Thanks for your question and review.

> > receives this IP address securely via the option in the router
> > advertisement message.
> 
> So, the security of this approach relies on how securely the client can
get the
> resolver's address, e.g.,
certification
> or the server's public key securely beforehand.
> 

To some extend correct but not but it is not bound to that option. One
example is where you are in untrusted network like a Café. We assume that
you cannot trust your router or the router does not support SeND and you
really want to ensure that MITM attack will not happen during browsing any
websites (like your bank or etc) then you can always set an IP address of a
trusted resolver yourself. One example can be the use of an IP address of
the google resolver or any other resolver that supports cga-tsig (it can be
your home resolver as well). Your node can verify that using CGA/or SSAS
algorithm.

I hope I could answer your question. 
Smile,
Hosnieh

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Mon, 3 Mar 2014 10:23:36 +0100

Follow up,

The good thing about CGA-TSIG or using CGA or SSAS as the algorithm is that,
if you only know the IP address (set it manually for the first time or can
receive it from a secure way like you can trust your router). Then no need
for any check on the public key since there is binding between this public
key and the IP address. Not sure the chairs uploaded the slides. If so you
can find the scenarios there as well.

Thanks,
Hosnieh

> > can
the
> google resolver or any other resolver that supports cga-tsig (it can be
your
> home resolver as well). Your node can verify that using CGA/or SSAS
> algorithm.
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop