Subject: RE: DNSSEC - Signature Only vs the MX/A issue.

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 11 Dec 2006 20:41:09 -0800

AS I have been saying for over a decade security is risk management, not risk elimination.

The point you make is not new, Bruce Scheneir made it together with Carl Ellison in a paper some years back. He was wrong then and Secrets and Lies is essentially explaining why.

Most cases of administrative incompetence will result in a complete loss of service. DNSSEC does not add a significant number of new ways to screw up and the remedy is exactly the same. 

The cases where administrative incompetence leads to a security breach are not as likely as direct attack and in any case very difficult to exploit successfully without inside knowledge that allows for more powerful attacks.

DNSSEC is not intended to control against administrator malfeasance. 

> -----Original Message-----
> From: Masataka Ohta [mailto:[email-masked]] 
> Sent: Monday, December 11, 2006 7:48 PM
> To: Hallam-Baker, Phillip
> Cc: Paul Vixie; Christian Huitema; Ralph Droms; bert hubert; 
> [email-masked]
> Subject: Re: DNSSEC - Signature Only vs the MX/A issue.
> 
> Hallam-Baker, Phillip wrote:
> 
> > If you want to make such statements first state your risk model.
> 
> Are you saying it to Paul's statement of "so the Secure DNS 
> model is end-to-end rather than interior-only."?
> 
> Anyway, if you use your risk model, your statements is 
> nothing more than a fantasy.
> 
> I, instead, have been stating the reality that ISPs and zone 
> administrators are equally (un)trustworthy.
> 
> As a result, DNSSEC is NOT cryptographycally secure and is as 
> secure as plain DNS.
> 
> 							Masataka Ohta
> 
> 
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 12 Dec 2006 16:20:19 +0900

> management, not risk elimination.

I fully agree with you that there ain't no such thing as
cryptographical security.

> The point you make is not new, Bruce Scheneir made it together with
> Carl Ellison in a paper some years back. He was wrong then and
> Secrets and Lies is essentially explaining why.

Hugh?

You failed to deny my point that DNSSEC and plain DNS are equally secure.

> Most cases of administrative incompetence will result in a complete
> loss of service. DNSSEC does not add a significant number of new
> ways to screw up and the remedy is exactly the same. 

Complex protocols are more complex to implement and operate and,
thus, insecure.

For example, it is a lot more likely that DNSSEC software has
buffer overflow valunerability than plain DNS software.

> The cases where administrative incompetence leads to a security
> breach are not as likely as direct attack and in any case very
> difficult to exploit successfully without inside knowledge that
> allows for more powerful attacks.

I'm not sure what you mean "direct attack" but I understand that
you failed to make a point on the merits of deploying DNSSEC.

						Masataka Ohta

---

From: bert hubert <[email-masked]>
Date: Tue, 12 Dec 2006 09:34:27 +0100

> buffer overflow valunerability than plain DNS software.

This is not only a lot more likely, but actual fact if we look at most DNS
security advisories of the past few years.

For example, look at SIG Query Processing (CVE-2006-4095), "BIND: Self Check
Failing" (2005-25-01), "BIND: Remote Execution of Code"  A/K/A "sigrec",
"OpenSSL buffer overflow", "tsig bug", "sigdiv0 bug", etc, all found on
the fine page http://www.isc.org/index.pl?/sw/bind/bind-security.php

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services