Subject: Re: [keyassure] "Trusted third parties"

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 16 Dec 2010 17:00:08 -0600 (GMT-06:00)

Mark and all,

-----Original Message-----
>From: Mark Andrews <[email-masked]>
>Sent: Dec 16, 2010 4:19 PM
>To: Matt McCutchen <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [keyassure] "Trusted third parties"
>
>
>In message <[email-masked]>, Matt McCutchen writes:
>> On Thu, 2010-12-16 at 14:23 -0500, Paul Wouters wrote:
>> > On Thu, 16 Dec 2010, Matt McCutchen wrote:
>> > 
>> > > Let no one miss that DANE as it is to be commonly practiced still
>> > > depends on third parties: ICANN/Verisign and whoever else is on the path
>> > > to one's zone.  Hopefully they will be less unruly than the public CAs,
>> > > but people who are serious about not trusting third parties will still
>> > > need something else.
>> > 
>> > The big difference is that if you are mobile, attackers will have to falsify
>> > the public's view of DNS(SEC), so this becomes very obvious.
>> 
>> Really?  I remember someone describing how a rogue registrar could
>> target a false answer to one user, but I haven't been able to find the
>> message now.
>
>A rogue registry that controls all of the DNS servers for the zone
>could do this.  A registrar could not as they just add data to the
>zone without control of to whom it is being sent.

  This is essentially correct, but a hosting company that is
closely associated with a registrar that controls all of the
above mentione DNS servers for the zone could also do the
same at the insistance of the parent/owning registrar and likely
would in some instances without know for certain that they should
or for other rogue/nafarious purposes.
>
>Mark
>-- 
>Mark Andrews, ISC
>1 Seymour St., Dundas Valley, NSW 2117, Australia
>PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827

---

From: Mark Andrews <[email-masked]>
Date: Fri, 17 Dec 2010 10:30:28 +1100

In message <[email-masked]
> or for other rogue/nafarious purposes.

The zone maintainer should be generating the DNSKEY records and
pushing DS records into the parent zone.  It should NEVER be accepting
DNSKEYs from the parent.  It should also not be accepting changes
from the parent either and this applies to plain DNS as well so it
is nothing new.

There really isn't a way for this to be done without active collusion
when more than one party is involved.

Mark