Subject: FW: [dnsext] Re: A custom DNS record for mandatory SSL/TLS

From: "Aki Tuomi" <[email-masked]>
Date: Wed, 25 Feb 2009 13:58:51 +0200

> -----Original Message-----
> From: [email-masked] [mailto:owner-
> [email-masked]] On Behalf Of Ted Lemon
> Sent: Wednesday, February 25, 2009 1:27 AM
> To: Jeffrey A. Williams
> Cc: Olafur Gudmundsson; [email-masked]
> Subject: Re: [dnsext] Re: A custom DNS record for mandatory SSL/TLS
>
> On Feb 23, 2009, at 6:03 PM, Jeffrey A. Williams wrote:
> >  This is not a new debate as you seem to believe.  I along
> > with others have had this debate with Paul and others several
> > times some time 5 years? ago.
> 
> I know, and perhaps I should apologize for bringing it up.   Last
> time
> I was involved in this debate, I was on the other side.   :'}
>
>
 
After reading up this discussion, I would like to make small
contribution. I can see some reasons that would justify using DNS for
storing various hashes of public keys.

But then again, more than often, DNS is not under control of the domain
owner, in fact, quite often it's under control of someone else. Thus,
it means that this another party becomes the weak link in security.
 
DNSSEC cannot remedy this, because the problem is in the processes and
procedures of third party hosting the domain. I appreciate that the
same problem exists today if you hand over your entire website to
someone else, but then you at least know this.

My few cents regarding why not put keys in DNS if you don't have to.

---
Aki Tuomi
TDC Oy
������r��zǧu���Ơz�'jg���iz�+z����)�'�~���+a����n�˛���m�jȧ�W��w���^��,j�{[�ܚ��b��m�����"z����l�v�y�覗��