Subject: Re: [Design] Re: the KEY debate

From: Derek Atkins <[email-masked]>
Date: 07 Aug 2002 16:52:49 -0400

"Jason Coombs" <[email-masked]> writes:

> > Can we _PLEASE_ stop with this FUD?
> 
> There IS a valid infosec perspective within this FUD.
> 
> Adapting DNS to distribute keys for applications other than DNS creates a
> single point of security failure that impacts many applications instead of
> just one, and that's bad.

This is why I stated that it is a niche, only for applications that
understand the implications.  It is _NOT_ a general solution -- it is
a general framework for a couple of specific solutions (e.g. SSH and
IPsec).

I think the players well understand the implications involved.  Note
that using X.509 certificates is not necessarily any better
(c.f. Verisign's "fake" Microsoft certificate).  There are not
additional issues using DNSSEC for security, they are just wearing
different colors than the same issues in other venues.

You can only push those issues off so far until _somebody_ needs to
address them (or not, as the case may be).

-derek

PS: I think the proponents of "application keys in dns" are trying to
get "good enough" security as opposed to "world-class, military grade
security".

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ted Lemon <[email-masked]>
Date: Wed, 7 Aug 2002 16:33:32 -0500

> just one, and that's bad.

No, sorry, this is just more FUD.   This is a problem that *any* key 
management daemon would have - it's got nothing to do with DNS per se.