Subject: RE: DNSSEC - Signature Only vs the MX/A issue.

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 11 Dec 2006 06:40:58 -0800

If you want to make such statements first state your risk model.

Otherwise we end up engaged in hairsplitting debates that have no basis in common sense. There is no perfect security, get over it.

DNSSEC provides certain cryptographic controls in certain instances. DNSSEC is clearly not necessary to do anything we do today otherwise we could not do it. 

The point is that Internet security is kind of a mess. There is no coherent architecture.

The utility in DNSSEC lies in the deployment of the next generation of Internet security infrastructure which uses DNS to perform policy distribution. Protocols like DKIM and architectures that address the issue of deperimeterization.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Masataka Ohta
> Sent: Sunday, December 10, 2006 8:38 PM
> To: Paul Vixie
> Cc: Christian Huitema; Ralph Droms; bert hubert; 
> [email-masked]
> Subject: Re: DNSSEC - Signature Only vs the MX/A issue.
> 
> Paul Vixie wrote:
> 
> > so the Secure DNS model is
> > end-to-end rather than interior-only.
> 
> It is not e2e.
> 
> With DNSSEC, zone administrators between you and your peer 
> are the intelligent intermediate entities subject to all the 
> technical and social hacking attacks.
> 
> E2e security can be enjoyed if and only if you and your peer 
> directly share secret information without intelligent 
> intermediate entities.
> 
> DNSSEC does not provide cryptographic security.
> 
> PKI does not provide cryptographic security.
> 
> 						Masataka Ohta
> 
> 
> 
> --
> to unsubscribe send a message to 
> [email-masked] with the word 'unsubscribe' 
> in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 12 Dec 2006 09:48:09 +0900

> If you want to make such statements first state your risk model.

Are you saying it to Paul's statement of "so the Secure DNS model is
end-to-end rather than interior-only."?

Anyway, if you use your risk model, your statements is nothing more
than a fantasy.

I, instead, have been stating the reality that ISPs and zone
administrators are equally (un)trustworthy.

As a result, DNSSEC is NOT cryptographycally secure and is as secure
as plain DNS.

							Masataka Ohta