Subject: RE: [Design] Re: the KEY debate

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Thu, 8 Aug 2002 12:36:10 -0700

Your post makes two comparisons which are both inappropriate.

First the adding of security to the DNS protocol to secure DNS cannot and
should not be conflated with the use of DNS infrastructure to secure other
protocols.

Then you say nobody is proposing X and go on to propose X.

		Phill

> -----Original Message-----
> From: Ted Lemon [mailto:[email-masked]]
> Sent: Thursday, August 08, 2002 2:54 PM
> To: Hallam-Baker, Phillip
> Cc: namedroppers
> Subject: Re: [Design] Re: the KEY debate
> 
> 
> > It is a very bad idea to make a change in a deployed 
> protocol that changes
> > its status from a non-security infrastructure to a critical security
> > infrastructure.
> 
> If this statement is true, then DNSSEC is a bad idea.   The 
> whole point of 
> DNSSEC is to be able to authenticate the answers that the 
> name server gives.
>     This is done using a secret key.   Compromise of that key 
> allows the one 
> who has compromised it to claim that invalid data is valid in 
> a way that 
> can be cryptographically authenticated.
> 
> So if you use DNSSEC, the DNS server *is* part of the 
> critical security 
> infrastructure.   There is no getting around this.   Once 
> that genie is out 
> of the bottle, it doesn't make any difference how many keys 
> you store in 
> the DNS, because you *have* to treat the DNS server as part of your 
> critical security infrastructure.
> 
> BTW, please note that nobody is saying here that DNS should 
> take the place 
> of Kerberos or something like it.   Rather, what is being 
> said is that 
> there are applications where making a key available in the 
> DNS makes sense.
>     For example, an SSH host key can be used to verify that 
> you are talking 
> to the host associated with an A record that you've looked 
> up.   This doesn'
> t grant you access to the server - your private key does 
> that.   What it 
> does is to simply verify that you are talking to who you 
> think you are 
> talking to.   For this kind of security, storing keys in the 
> DNS makes a 
> lot of sense (to me, at least!).
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ted Lemon <[email-masked]>
Date: Thu, 8 Aug 2002 14:49:46 -0500

I think we have ceased to make progress (probably many messages ago).   I 
apologize for continuing to press the argument - I don't think it's 
accomplished much.   :'/