Subject: Re: DNSSEC is NOT secure end to end

From: Joe Baptista <[email-masked]>
Date: Mon, 1 Jun 2009 09:08:11 -0400

On Mon, Jun 1, 2009 at 12:30 AM, Mark Andrews <[email-masked]> wrote:

>
>        If you believe that I have a bridge to sell you.

Keep the bridge - it's all yours.  Remember - in order to sell the bridge
you first have to own it.  Your convenced you have something to sell.  I am
not.

> > Totally different from DNSSEC.
>

>
>        You can disagree all you want but it doesn't change the
>        fact that DNSSEC and DNSCurve both have chains of trusts.
>        The proponents of DNSCurve even say this.
>
>        Note the chain of trust as described on
>        http://www.dnscurve.org/tld.html/.

The correct URL is http://www.dnscurve.org/tld.html not
http://www.dnscurve.org/tld.html/

And yet again - it has nothing to do with chains of trust.  It does learn
how to trust and whom to trust.  Thats part of the job.  What DNSCurve does
do is it "adds link-level public-key protection to DNS packets" therefore
guaranteeing the integrity of the packets end to end.

Totally different from DNSSEC which indeed uses chains of trust - i.e. root
to tld to sld etc.etc.

I am totally amazed at the propaganda that comes out of ISC these days.
When you guys start comparing DNSSEC to DNSCurve - we'll - all I can say is
this - I have this really nice bridge on the Hudson I'd like to sell you
that will compliment the bridge you've already have.

cheers
joe baptista

-- 
Joe Baptista

www.publicroot.org
PublicRoot Consortium
----------------------------------------------------------------
The future of the Internet is Open, Transparent, Inclusive, Representative &
Accountable to the Internet community @large.
----------------------------------------------------------------
 Office: +1 (360) 526-6077 (extension 052)
    Fax: +1 (509) 479-0084

Personal: www.joebaptista.wordpress.com

---

From: Mark Andrews <[email-masked]>
Date: Tue, 02 Jun 2009 01:09:39 +1000

> guaranteeing the integrity of the packets end to end.

	DNSCurve protects authoritative server to iterative resolver
	if and only if you can authenticate the names of the
	nameservers and that they are supposed to be serving the
	zone you are querying against.  If you can't do that then
	you are just talking to some random server using a cryptographic
	channel and you shouldn't be trusting the results.
 
> Totally different from DNSSEC which indeed uses chains of trust - i.e. root

	And DNSCurve uses chains of trust from root servers to tld
	servers to sld servers etc. etc.

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Dave Cridland <[email-masked]>
Date: Mon, 01 Jun 2009 16:21:53 +0100

As a disinterested third party...

> 	servers to sld servers etc. etc.

After skimming DNSCurve to get the general idea, I agree with Mark  
here. I don't see any particular way in which the NS records (which  
specify the keys) from the parent are themselves validated, other  
than by trusting the parent domain's nameservers, which essentially  
means they give equivalent protection to DNSSEC from that standpoint.

I did wonder whether there was additional scope for "leap of faith",  
but I'm not sure even that exists.

Moreover, since DNSCurve only operates hop-by-hop, rather than  
end-to-end (in the sense of the DNS resolution process as a whole) it  
relies on a hop-by-hop trust arrangement. In particular, my servers  
here would have to use either a trusted resolver, or no resolver at  
all.

I do note that DNSCurve looks like a neat hack, just one that, on  
closer inspection, turns out to have no obvious benefits in this  
particular respect.

Dave.
-- 
Dave Cridland - mailto:[email-masked] - xmpp:[email-masked]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade