Subject: RE: dnssec discussion today at noon

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 22 Jul 2002 10:14:46 -0700

> > 	This assumes perfect implementation of the cryptography and the 
> > manner in which cryptography is used (and the whole rest of the 
> > system).  Schneier teaches us that this is a highly unlikely 
> > situation to occur anywhere.
> 
> I'm teching you Schneier (whoever he is) is wrong, then.

I am not too sure that Bruce made quite the point originally stated,
and if he did make it one should take a look at some other statements
Bruce has been known to state before necessarily taking his word as
gospel.

In fact I would suspect that a more accurate representation of
Bruce's position would be 'think about the protocol, don't depend
on dogma, including dogma that you might find attributed to me.'

		Phill

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 22 Jul 2002 13:22:06 -0700

> You have clearly never been to an hotel where their Internet services
> intercept all DNS queries regardless of where you send the message...
> You cannot trust the infrastructure not to misbehave.  

Answer, I tend not to pay $10 per night just to surf the Internet
from a hotel room and when I have I have been using a VPN which 
encrypts all the trafic.

Question, what do you want the infrastructure to do in this 
situation? I believe that what a secure DNS infrastructure should
do is inform you that you are subject to a DNS MiM attack.

If you are going to use secure DNS then you probably want to 
use IPSEC to protect you trafic from hotel rooms and the like.
If the institution blocks IPSEC then you should probably apply
Moscow rules and not use the Internet at all.

		Phill