Subject: RE: General comments on DNSSEC

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 17 Jun 2002 12:47:35 -0700

I was actually attempting to address the limit of scope. The point
illustrates the difference between a security analysts perspective and a
cryptographer's perspective.

It is never possible to control for every possible risk. Security is
therefore risk control and not risk elimination. Cryptography allows for a
deceptively thorough control of a certain subset of risk types.

The risk of DoS through physical means can never be entirely eliminated, viz
nuclear strike against all replicas of the facilities, in the extreeme it is
expected that the sun will turn into a red giant at some point in the future
but no control is proposed against that risk.

So when it is said that a system is 'secure' it is always with repect to a
set of risks.

The lawyers have a quite specific formula to determine when a control should
be applied:
cost of control < probaility of harm x cost of harm.

Bruce S. goes into this at some length in his latest book 'secrets and
lies'. The insufferable part being that he wrote the whole damn book as if
it was a sudden revalation that only he was privy to rather than something
that is taught in every good computer security 101 course.

		Phill

> 
> I fully agree with everything you say here, except for the
> first paragraph.
> 
> According to the draft, draft-ietf-dnsext-dns-threats-01.txt,
> the current mandate for DNSSEC is:
> 1) data integrity, and
> 2) data origin authentication.
> 
> "to secure the DNS" is a little too vague. If we were to implement
> a solution that did not protect against DoS attacks (as is 
> very likely), 
> then we could be deemed to have failed "to secure the DNS".
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>