Subject: RE: What I mumbled at the mike today...

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 9 Aug 2004 12:01:43 -0700

> Okay, so don't use it there.  Split DNS, by definition, would be
> considered tangential to an extranet.  ie, the extranet is on 
> one side of
> the split and doesn't know about the other.  If your extranet 
> needs a peek
> inside, I suggest evaluating a VPN or alternate solution.

Without meaning disrespect here, I don't think you appreciate
the scale of this issue. We are not talking about trivial numbers of
participants here. 

Think infrastructure to support merchants using RFID applications.

We are talking about very large, deperimeterized networks here.
And no, deperimeterization does not mean throwing away your 
firewall as many in the IETF seem to think, an idea considered 
so kooky in the real security world that it took me several 
minutes to convince some of the folk in the deperimeterization
movement that there are serious advocates.

I can't have a VPN that includes every manufacturer in north 
america. IPSEC is still not up to the task - in part because 
DNSSEC is not there.

If you make DNSSEC dependent on IPSEC for deployment then you
have just created a dependency cycle.

Ben knows what he is doing here. From a security point of view
the requirement is absolutely sound. 

> > The UDDI services used to advertise an connect the services 
> is protected
> > using SSL and access control.
> 
> ...unrelated...?

No, the point is that the directory mechanism does not leak DNS names.

> >
> > If it is not possible to store names securely in DNS then 
> either that
> > function will have to be served in UDDI or we will have to develop
> > a suitable DNS security fix in another forum.
> 
> define "store names securely" -- the machine can be secured, the split
> horizons (or views) can be secure.  

It is possible to publish a name in DNS without alerting an attacker 
to the existence of the node.

> the network can be secure.  what part
> of secure do you really want?  The ability for it to not be 
> enumerated?  I thought this discussion was over.

So did I, but folk seem to keep re-opening it and trying to kill the
requirement.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Mon, 09 Aug 2004 20:20:23 +0100

--On 09 August 2004 12:01 -0700 "Hallam-Baker, Phillip" 
<[email-masked]> wrote:

> DNSSEC is not there

Equally the suggestion to introduce a VPN when the underlying data is
already SSL encrypted, merely to prevent the leak of information from DNS
seems a bit bizarre.

AIUI (going back to Rip's request to collect inputs for the requirements),
your concern, Phillip, is that enumeration does not leak (potential) names.
You are thus presumably not concerned (here) about wire-tap /
man-in-the-middle type attacks where queries (and answers) get recorded
by third parties - IE it is not a requirement in your book to (for
instance) encrypt the query and/or response?

Alex