Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right

From: "Jeffrey A. Williams" <[email-masked]>
Date: Tue, 7 Sep 2010 18:21:16 -0500 (GMT-05:00)

Phillip and all,

  Very good point and one that should not be discounted
or missed.  Additionally the channel approach doesn't
deal well with bad domains that proliferate phishing or
pharming E-mail scams either.

-----Original Message-----
>From: Phillip Hallam-Baker <[email-masked]>
>Sent: Sep 7, 2010 5:17 PM
>To: Stephane Bortzmeyer <[email-masked]>
>Cc: Jiankang YAO <[email-masked]>, [email-masked]
>Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right
>
>The channel approach is definitely not suited for inter-domain trust.
>
>It does have definite advantages for intra-domain trust however. It
>allows the resolver to be used as a security proxy, filtering out
>known bad domains (e.g. malware infested, run by the mafia), caching
>DNSSEC results, using state to establish security context etc.
>
>
>On Tue, Sep 7, 2010 at 10:16 AM, Stephane Bortzmeyer <[email-masked]> wrote:
>> On Tue, Sep 07, 2010 at 04:03:53PM +0800,
>>  Jiankang YAO <[email-masked]> wrote
>>  a message of 139 lines which said:
>>
>>> frankly said, I got the inspiration from the DNScurv draft
>>> draft-dempsky-dnscurve-01 - DNSCurve,
>>
>> Indeed, MSIG is in the same league than DNScurve (and TSIG and IPsec),
>> it protects the channel, not the message. For instance, it does not
>> protect you against a rogue slave authoritative name server.
>>
>>> MSIG is very useful for the registries or the DNS zone which has the
>>> millions of domain names since it will reduce the size of the zone
>>> dramatically.
>>
>> NSEC3+opt-out is sufficient for me.
>>
>>
>>
>
>
>
>-- 
>Website: http://hallambaker.com/
>

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: "Jiankang YAO" <[email-masked]>
Date: Wed, 8 Sep 2010 09:04:13 +0800

when considering the full dnssec function (heavy dnssec) or ligitweight dnssec such as MSIG,

performance price ratio is also a factor to decide that which one is used.

eithor heavy dnssec or lightweight dnssec has the advantages or disadvantages.

since the DNSSEC parent servers  store the DS RR of children, the MSIG proposal does not change it,  and still keeps the trust chain .
the servers can decide whether they use the heavy dnssec or the lightweight dnssec based on the consideration of performance price ratio.

MSIG proposal provides one more option for the customers.

Jiankang Yao

----- Original Message ----- 
From: "Jeffrey A. Williams" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, September 08, 2010 7:21 AM
Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right

Phillip and all,

-----Original Message-----

Regards,
Jeffrey A. Williams

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 7 Sep 2010 21:31:46 -0400

What a lot of people miss is that maybe it is not a good idea if ICANN
is responsible for bouncing the phishing gangs, fake pharmacies and
other malefactors off the net.

ICANN has to move with deliberation, they cannot be cutting people off
the net in seconds. But that is exactly what you want for protection.