Subject: Re: dnssec discussion today at noon

From: [email-masked]
Date: Tue, 16 Jul 2002 15:50:08 +1000

> Mark;
> 
> > 	And what does this have to do with DNSSEC?
> 
> The theory explains the reality that public key cryptography
> (including DNSSEC) is not used for serious purposes.
 
	No.  It explains why it may not be useful for some purposes.
	In no way does it demostrate that it not useful for DNSSEC.

> The theory can be used to explain some (or most or all) of
> operational difficulty of DNSSEC deployment.
> 
> > 	DNSSEC is designed to allow you to verify that the data you
> > 	receive from the DNS is that which was entered.  That your
> > 	transactions havn't been spoofed.
> 
> Such security is not useful for serious purposes, when no one is
> really responsible if your transactions are spoofed.

	Actually once DNSSEC is available there is a person responible
	if the data spoofed.  The person that entered the data in such
	away that it could be spoofed.

> So,
> 
> > > We can live with the weak security, security level of which is,
> > > with proper 3 way handshaking with cookies, equivalent to that
> > > of the telephone network.
> 
> Just as you can rely on people operating name servers, you
> can rely on people operating routers.

	Getting routers fixed to block spoofed traffic relies on
	*everyone* doing the right thing.  Getting DNSSEC working
	only requires that the operators of the root servers, down
	to the zone servers do the right thing.

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Brad Knowles <[email-masked]>
Date: Tue, 16 Jul 2002 17:07:47 +0200

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

>  (including DNSSEC) is not used for serious purposes.

	Not used for serious purposes?!?  Okay, let's have you run a B2B 
website where billions of dollars can be moved with the click of a 
single mouse button.  Now, we have to ensure that you really are 
interacting with the real B2B website and not some clever fake, or 
worse, some site that performs a man-in-the-middle attack on you 
while you are conducting a real transaction, so that they can later 
go in and conduct multiple fake transactions.

	How about home banking?  Sure, hundreds, thousands, tens of 
thousands, etc... of dollars may not be a whole lot of money to you, 
but they may be the entire life savings of a family.  Multiply that 
by 250 million people in the US alone, and you're talking about some 
real money.

	I'm sorry.  I don't buy your argument at all.  Not in the least.

	I'm not saying that DNSSEC is necessarily the only solution to 
the problem, or even the best solution to the problem, or necessarily 
even one solution to the problem, but it is at least a step closer to 
one solution to the problem, and by working with DNSSEC and seeing 
where it works and where it fails, we can get closer to a real 
solution.

>  really responsible if your transactions are spoofed.

	Okay, so we can all sue you for billions and trillions of dollars 
worth of damages when someone spoofs a DNS response packet which then 
leads us to be vulnerable to man-in-the-middle attacks.

>  can rely on people operating routers.

	No, in both cases.  There are a multitude of heinously screwed up 
servers in this world, and a multitude of heinously screwed up 
routers, too.

	If you don't believe me, then believe KC Claffy from CAIDA (see 
<http://www.caida.org/outreach/presentations/dns0701/mgp00003.html>).

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.