Subject: [DNSOP] Review request- DNS Secure authentication

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sun, 7 Sep 2014 17:30:44 +0200

Hello,

I just wonder whether or not any of you had a chance to take a look on the
new version of cga-tsig. If you haven't yet take a look please do it. I
welcome your inputs. 

Do you think the problem statement is clear? 

http://tools.ietf.org/html/draft-rafiee-intarea-cga-tsig-10

Thanks,

Best,
Hosnieh

---

From: Roland Bless <[email-masked]>
Date: Tue, 09 Sep 2014 19:36:38 +0200

Hi,

> Do you think the problem statement is clear? 

No, IMHO it is not. Usually you need clear attacker models
to explain existing vulnerabilities. The current problem
statement is quite a mixup of various different security aspects
and thus not clear.

Just a few examples:
"DNS records can become compromised." => this is an attack
on the _integrity_, but it can be launched at different
locations and at different levels (e.g., in the DNS databased,
with the DNS server, on the wire in transit, etc.)

(TSIG)
"No protection against IP spoofing and DNS amplification"
- spoofed IP addresses are not a problem if the DNS RR
  integrity is assured...

- "Does not easily protect DNS data confidentiality"
  -> confidentiality where? Against an attacker on the
  wire? The DNS (recursive) resolver provider will always know what
  has been asked for...

and so on. Section 1 is therefore quite confusing.
Clearly define an attacker model and describe why
existing protocols do not protect against these
attacks.

Regards,
 Roland

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Tue, 9 Sep 2014 23:31:30 +0200

Hi Roland,

Thanks a lot for your comments. 

> No, IMHO it is not. Usually you need clear attacker models to explain
existing
> vulnerabilities. The current problem statement is quite a mixup of various
> different security aspects and thus not clear.
> 
> Just a few examples:
> "DNS records can become compromised." => this is an attack on the
> _integrity_, but it can be launched at different locations and at
different levels
> (e.g., in the DNS databased, with the DNS server, on the wire in transit,
etc.)

This is true. Do you think it is enough only I add briefly the level of
protection in parenthesis and for more information probably I use RFC 3833
as a reference? 

I also have a section at the end (section 9) that explains the protection
level in more detail. In first versions, I had this section in problem
statement but I removed it due to the fact that some reviewers thought that
I haven't yet explained about CGA-TSIG algorithm and explaining its
protection level does not make sense.  This was the case I moved it to the
end of the document and in problem statement I only left a brief explanation
of different mechanisms.

So if this is wrong. What do you suggest as a best organization?

Thanks,
Best,
Hosnieh.