Subject: Re: [dane] #36: Only requiring DNSSEC where it is needed

From: Martin Rex <[email-masked]>
Date: Sat, 8 Oct 2011 02:44:00 +0200 (MEST)

[email-masked] wrote:
> 
> On Sat, Oct 08, 2011 at 01:57:03AM +0200, Martin Rex wrote:
> > Scott Schmit wrote:
> > > 
> > > If DNSSEC is required, there are two failure cases:
> > > A) The DNSSEC data is secure, but the PKIX chain doesn't match
> > > B) The DNSSEC data is bogus
> > 
> > "DNSSEC data is secure" lumps two situations together, and
> 
> 	define "secure" please.
> 
> 	DNSSEC NSEC(x) records provide a check to ensure additioanl RRs are not 
> 	injected into a cache - which are not part of the authoritative zone data.
> 	DNSSIG records provide a cryptogrpahic signature over the RR's being moved.
> 
> 	DNSSEC tools protect caches by ensuring the accuracy and integrity of RR's
> 	which are fetched.  So if this is what you mean by "lumps two situations together"
> 	then  sure, I agree w/ you.   For many/most of the folks in the DNSSEC space,
> 	this is enough to call DNSSEC processed data -secure- even though the data is 
> 	not covered by the other facets of  "security".  DNSSEC, for example, does 
> 	not provide  confidentiality - which is reason enough for some to say DNSSEC
> 	is not secure.
> 
> 	so - please define secure in this  (DANE/DNSSEC) context.

DANE-enabled TLS clients will encounter TLS servers where
the DNS zone has DNSSEC enabled, but no TLSA records are maintained.

In that case a DNS lookup www.example.com. will return an IP address,
but the DNS lookup for _443._tcp.www.example.com. would have to
result in an NSEC/NSEC3 response rather than NXDOMAIN, I assume.

-Martin