[148053] in cryptography@c2.net mail archive
Re: [Cryptography] DNSSEC = completely unnecessary?
daemon@ATHENA.MIT.EDU (Kelly John Rose)
Wed Nov 6 14:45:40 2013
X-Original-To: cryptography@metzdowd.com
Date: Wed, 06 Nov 2013 14:13:50 -0500
From: Kelly John Rose <iam@kjro.se>
To: cryptography@metzdowd.com
In-Reply-To: <CAG5KPzzwVjS-983RU5XQuJXDO=TToJiKom3JQzj7oUE20O5gZA@mail.gmail.com>
Errors-To: cryptography-bounces+crypto.discuss=bloom-picayune.mit.edu@metzdowd.com
On 11/6/2013 10:52 AM, Ben Laurie wrote:
> On 6 November 2013 01:48, Paul Wouters <paul@cypherpunks.ca> wrote:
>> That's a nonsense argument. Abuse of such powers, unlike the plethora of
>> CA certs, would need to be world visible, that is untargetted. It would
>> be very very visible. It is a huge win over CAcerts that can target
>> individuals with specifically crafted signed certs.
>>
>> With dnssec, if the Government of Canada causes my nohats.ca to be
>> modified (appear red on your above map), then my domain's public
>> information changes. I would notice that. This is not an invisible
>> MITM like some CA cert injection.
>
> How did DNS get this magic un-MITM-able property?
>
> Surely if the GoC wants to cause nohats.ca to be modified, for some
> specific target(s), they can do that?
He didn't say it isn't MITM-able. He said that it cannot do so
invisibly. In his model Eve would be able to perform a MITM attack, but
it would be immediately apparent to any party since the public
information would have to change.
_______________________________________________
The cryptography mailing list
cryptography@metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
