Subject: DNS AS origin verification - authorization, authentication, and DNSSEC

From: Sandy Murphy <[email-masked]>
Date: Fri, 3 Apr 1998 15:38:19 -0500 (EST)

Yakov, Tony, and Randy:

I'm still confused about something:

- DNS provides a tree in which to store the authorization to announce a prefix.

- DNSSEC is used to ensure that the authorization data received from the
  tree is authentic (received from the authentic source).

- BGP Updates are not signed, so anyone could put valid, authorized origin
  data in their BGP Update - but that is not considered a drawback, because
  this technique is intended to stop damage from the recurring, frequent
  misconfiguration problems.  This technique is not attempting to
  prevent deliberate and malicious threats.

So this technique is using DNSSEC to prevent malicious people from
spoofing the authorization data - but it is not attempting to prevent
malicious people from inserting authentic authorization data in their
updates.

Put another way - if we are excluding malicious evil-doers from the
threats this technique protects against, why do we care that DNSSEC is
available?  I don't think there are huge problems with accidental
misconfigurations in the domain name space.

Of course, I've been wrong before.

--Sandy Murphy

---

From: Tony Li <[email-masked]>
Date: 04 Apr 1998 01:09:05 -0800

> malicious people from inserting authentic authorization data in their

Sandy,

The proposed technique does NOT (repeat NOT) provide security.  It is half
a loaf, which as we all know when it comes to security, is not better than
no loaf.

However, this proposal is a reasonable sanity check against accidents.  The
point about designing in DNSSEC now is so that when we DO get around to
signing paths (which as you have noted we must do and I do concur) we will
THEN have a full loaf.

Tony