Subject: RE: Secure DNS is just weakly secure

From: Edward Lewis <[email-masked]>
Date: Wed, 15 Mar 2006 14:39:08 -0500

At 13:02 -0500 3/15/06, Loomis, Rip wrote:

>stand today.  I invite you to either propose an actual
>valid alternative or contribute on updates to the existing
>RFCs.

For those not old enough to remember:

http://www.watersprings.org/pub/id/draft-ohta-simple-dns-02.txt

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 17 Mar 2006 08:21:55 +0900

Loomis, Rip wrote:

>>Secure DNS removes "control" of ISPs, which are as reliable as
>>registries, but still leaves "control" of registries.

> The assertion you make above is not only not provably
> true, but is in my experience completely false.

You may be running your own DNS server by yourself. However, many
people use ISPs as registrars and ask them operate their name
servers.

Of course, they don't have to use DNS service of the providers.

> Many providers
> of recursive DNS service with which I deal on a regular basis
> are *much* less reliable than the registries for DNS
> information that I use on a regular basis.

You don't have to use recursive DNS service of the providers.

> In particular, securing DNS based on shared keys (which
> you appear to advocate) does not scale well at all and

It is just as scalable as the following suggestion of Ben Laurie.
 
: There is no requirement in DNSSEC to trust the registry. If you would
: prefer to trust your peer, then you should add his key as a trusted key
: to your resolver.

> has significant issues due to the inability to strongly
> correlate a key with a particular individual (since it
> is by definition shared with others).

If you share your key with a KDC, which is as reliable as a CA,
it is just as safe as public key cryptography (since the CA can
forge a pair of public and private keys, which is signed by the CA).

That is, your point is merely that secure DNS is just weakly
secure and as secure as plain DNS.

						Masataka Ohta