Subject: RE: Secure DNS is just weakly secure

From: "Loomis, Rip" <[email-masked]>
Date: Wed, 15 Mar 2006 13:02:50 -0500

(I know that there have been requests to shut down this
thread, so my apologies for continuing it, but...)

> Secure DNS removes "control" of ISPs, which are as reliable as
> registries, but still leaves "control" of registries.

The assertion you make above is not only not provably
true, but is in my experience completely false.  Many providers
of recursive DNS service with which I deal on a regular basis
are *much* less reliable than the registries for DNS
information that I use on a regular basis.

And if you drop that assertion (since it's not generally
true) I don't think your argument sheds any useful light.
In particular, securing DNS based on shared keys (which
you appear to advocate) does not scale well at all and
has significant issues due to the inability to strongly
correlate a key with a particular individual (since it
is by definition shared with others).  And if one tries
to use public/private key pairs...well whaddaya know,
that's what DNSSEC is doing!  And yes, there are potential
issues if a DNSSEC signing key at a registry is
compromised--which is why that's an area of particular
interest for me (and others).  The good news is that there
are, in fact, technologies and procedures that can
address such issues.

This will be my last message to you in response to one of
these threads you occasionally start.  Thanks very much
for caring about securing DNS--I only wish that your efforts
to date had come up with a useful way to address the real
(but not fatal) flaws in the DNSSEC extensions as they
stand today.  I invite you to either propose an actual
valid alternative or contribute on updates to the existing
RFCs.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Wed, 15 Mar 2006 14:39:08 -0500

>valid alternative or contribute on updates to the existing

For those not old enough to remember:

http://www.watersprings.org/pub/id/draft-ohta-simple-dns-02.txt

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 17 Mar 2006 08:21:55 +0900

> true, but is in my experience completely false.

You may be running your own DNS server by yourself. However, many
people use ISPs as registrars and ask them operate their name
servers.

Of course, they don't have to use DNS service of the providers.

> Many providers

You don't have to use recursive DNS service of the providers.

> you appear to advocate) does not scale well at all and

It is just as scalable as the following suggestion of Ben Laurie.
 
: There is no requirement in DNSSEC to trust the registry. If you would
: prefer to trust your peer, then you should add his key as a trusted key
: to your resolver.

> is by definition shared with others).

If you share your key with a KDC, which is as reliable as a CA,
it is just as safe as public key cryptography (since the CA can
forge a pair of public and private keys, which is signed by the CA).

That is, your point is merely that secure DNS is just weakly
secure and as secure as plain DNS.

						Masataka Ohta