Subject: [IPSECKEY] IPSECKEY - man-in-the-middle

From: Michael Richardson <[email-masked]>
Date: Wed, 28 Jan 2004 16:38:04 -0500

-----BEGIN PGP SIGNED MESSAGE-----

OLD TEXT:

   Note that the danger here only applies to cases where the gateway
   field of the IPSECKEY RR indicates a different entity than the owner
   name of the IPSECKEY RR.  In cases where the end-to-end integrity of
   the IPSECKEY RR is suspect, the end client MUST restrict its use of
   the IPSECKEY RR to cases where the RR owner name matches the content
   of the gateway field.

NEW TEXT:

Note that risk of a man-in-the-middle attack mediated by the IPSECKEY
RR only applies to cases where the gateway field of the IPSECKEY RR
indicates a different entity than the owner name of the IPSECKEY RR.

An active attack on the DNS that caused the wrong IP address to be retrieved
(via forged A RR), and therefore the wrong QNAME to be queried would also
result in a man-in-the-middle attack. This situation exists independantly
of whether or not the IPSECKEY RR is used.

In cases where the end-to-end integrity of
the IPSECKEY RR is suspect, the end client MUST restrict its use
of the IPSECKEY RR to cases where the RR owner name matches the
content of the gateway field.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-
This is the [email-masked] list.
Email to [email-masked] to be removed.