Subject: Re: New versions of DNSSECbis drafts posted

From: Paul Vixie <[email-masked]>
Date: 21 May 2004 01:22:13 +0000

[email-masked] (Erik Aronesty) writes:

> Quick question:  if ip-spoofing were impossible, would DNSSEC be obsolete?

no.  dnssec creates end to end trust between a zone owner/editor/publisher
and a resolver.  attacks it guards against include not only ip spoofing, but
corrupting forwarders like NAT boxes, and corrupt authority servers.
-- 
Paul Vixie

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 21 May 2004 11:05:59 +0900

>>Quick question:  if ip-spoofing were impossible, would DNSSEC be obsolete?

Yes.

> corrupting forwarders like NAT boxes, and corrupt authority servers.

Anything behind NAT does not worth considering.

Corrupt authority servers are just as harmful and likely as
corrupt resolvers.

Moreover, complexity of DNSSEC increases the possibility of
resolver corrupts, a lot.

							Masataka Ohta