Subject: Re: [DNSOP] [dnsext] draft-jabley-dnsop-validator-bootstrap-00

From: Tony Finch <[email-masked]>
Date: Tue, 1 Feb 2011 20:40:19 +0000

On Mon, 31 Jan 2011, John Bashinski wrote:

> > A validator must confirm that its local clock is sufficiently
> > accurate before trust anchors can be established, and before
> > processing of DNSSEC signatures can proceed.
>
> How?

There are two possibilities here: you can't reach a time server because of
some screwup, or someone is deliberately lying to you about the time.

The latter for DNSSEC is a denial of service attack, and the other network
comms in the bootstrap process is similarly vulnerable to DoS.

I agree it is a concern but I'm not sure it needs to cause angst.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.

---

From: Jakob Schlyter <[email-masked]>
Date: Wed, 2 Feb 2011 11:06:46 +0100

On 1 feb 2011, at 01.40, Phillip Hallam-Baker wrote:

> My advice to Cisco would be to use their existing root to sign the published CSR for the DNS root KSK in the short term at least.

That's why we (the Root DNSSEC Design Team) included a CSR as one output from the key generation ceremony.

	jakob