Subject: secure entry point

From: Miek Gieben <[email-masked]>
Date: Mon, 31 Mar 2003 15:35:21 +0200

How is a secure entry point defined? From the dnssec drafts I gather that a
secure entry point is defined by a key signing key. But should we not also
include the nameserver IP address(es) for the secure entry point? 

grtz  Miek

--
:wq!

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Donald Eastlake 3rd <[email-masked]>
Date: Mon, 31 Mar 2003 08:51:46 -0500 (EST)

If you trust a public key to sign DNS data and can verify the signature
over that data, it doesn't make any difference where you got the data
from. There is no reason to worry about the IP address of the
nameserver.

Thanks,
Donald
======================================================================
 Donald E. Eastlake 3rd                       [email-masked]
 155 Beaver Street              +1-508-634-2066(h) +1-508-851-8280(w)
 Milford, MA 01757 USA                   [email-masked]

On Mon, 31 Mar 2003, Miek Gieben wrote:

> Date: Mon, 31 Mar 2003 15:35:21 +0200
> From: Miek Gieben <[email-masked]>
> To: namedroppers <[email-masked]>
> Subject: secure entry point
>

---

From: Miek Gieben <[email-masked]>
Date: Mon, 31 Mar 2003 16:20:44 +0200

[On 31 Mar, @15:51, Donald wrote in "Re: secure entry point ..."]
> from. There is no reason to worry about the IP address of the

But this opens up a huge dos attack (this has nothing to do with "dnssec does
help against doc attacks"). You will only have to spoof the IP address of a
secure entry point and you're done. The resolver will notice that the signatures
do not match and will declare the thing BAD.

This can easily be prevented by also configuring secure entry point ip adresses. 
(you already have to configure the secure entry point keys anyway, so this adds
little more work)

grtz Miek

---

From: "Scott Rose" <[email-masked]>
Date: Mon, 31 Mar 2003 09:28:36 -0500

I've always taking "secure entry point" to basically mean a "pre-configured
key"  It could be any trusted key that can be used to start a chain of
authentication.  It doesn't technically have to be a key signing key, but
could be a zone key, or even a hash of a key, like in a DS RR.

My take anyway,
Scott

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 31 Mar 2003 17:44:12 +0200

> could be a zone key, or even a hash of a key, like in a DS RR.

But we just established (in another thread) that it is not required to
have the 'secure entry point key' in the apex key set and directly use the
configured public key to verify signatures of the KSKs in the apex keyset.
Thereby reducing the size of the root KEY RRs and having more space for
ZSKs.

Or am I confused again :-)

--Olaf

--------------------------------------------| Olaf M. Kolkman
                                            | www.ripe.net/disi

---

From: Edward Lewis <[email-masked]>
Date: Mon, 31 Mar 2003 17:16:34 -0500

That's how I defined it in the 1998 secure resolver, using a file 
called "/etc/sresolv.conf" as a replacement for /etc/resolv.conf. 
It worked well.

'Course, SEP as referred to in the KSK-flag draft doesn't necessarily 
need to use the same definition.

One reason I stored the IP addresses was to be able to use dnssec in 
a disconnected environment.  'Course, there are many ways to do that, 
I was just experimenting with some running code just for the 
experience.  (Ahh, those were the days.)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

I've had it with world domination.  The maintenance fees are too high.