Subject: Re: [keyassure] "Trusted third parties"

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 16 Dec 2010 14:06:24 -0600 (GMT-06:00)

Paul and all,

-----Original Message-----
>From: Paul Wouters <[email-masked]>
>Sent: Dec 16, 2010 1:53 PM
>To: Matt McCutchen <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [keyassure] "Trusted third parties"
>
>On Thu, 16 Dec 2010, Matt McCutchen wrote:
>
>>> The big difference is that if you are mobile, attackers will have to falsify
>>> the public's view of DNS(SEC), so this becomes very obvious.
>>
>> Really?  I remember someone describing how a rogue registrar could
>> target a false answer to one user, but I haven't been able to find the
>> message now.
>
>I am not sure how they would distinguish me from someone else's DNS query?

  This IMO is a good point and question.  Trusted third parties are
an anacranism in many ways.  How is such a determination of a Trusted
third party to be defined and therefore determined?  What are the
criterion?
>
>Also, I would recommend to preload your own zone's trust anchor in your local
>resolver, so that outages and possibly subversion attempts will at least fail
>for all of the resoures under your own (zone) control.

Good idea.  But doesn't this then sort of thwart the 'Trusted Third
parties" approach as well?  
>
>Paul
>(yes my resolvers have xelerance.com/xelerance.net DNSKEY's preloaded)
>_______________________________________________
>keyassure mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/keyassure

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Thu, 16 Dec 2010 14:09:29 -0600 (GMT-06:00)

Matt and all,

-----Original Message-----
>From: Matt McCutchen <[email-masked]>
>Sent: Dec 16, 2010 1:45 PM
>To: Paul Wouters <[email-masked]>
>Cc: [email-masked]
>On Thu, 2010-12-16 at 14:23 -0500, Paul Wouters wrote:
>> > Let no one miss that DANE as it is to be commonly practiced still
>> > depends on third parties: ICANN/Verisign and whoever else is on the path
>> > to one's zone.  Hopefully they will be less unruly than the public CAs,
>> > but people who are serious about not trusting third parties will still
>> > need something else.
>> 

  I've seen this occurance and there have been several rogue
registrars in the past 2 years as has been reported.  Should any
of them be considered as or for "Trusted Third parties"?
>-- 
>Matt
Regards,
Jeffrey A. Williams