[83705] in cryptography@c2.net mail archive
Re: DNSSEC to be strangled at birth.
daemon@ATHENA.MIT.EDU (Paul Hoffman)
Thu Apr 5 15:51:07 2007
In-Reply-To: <024e01c776d9$7dc1eb70$2e08a8c0@CAM.ARTIMI.COM>
Date: Thu, 5 Apr 2007 07:32:09 -0700
To: "Dave Korn" <dave.korn@artimi.com>, <cryptography@metzdowd.com>
From: Paul Hoffman <paul.hoffman@vpnc.org>
<anti-rant>
At 5:51 PM +0100 4/4/07, Dave Korn wrote:
> Can anyone seriously imagine countries like Iran or China signing up to a
>system that places complete control, surveillance and falsification
>capabilities in the hands of the US' military intelligence?
No.
But how does having the root signing key allow those?
Control: The root signing key only controls the contents of the root,
not any level below the root.
Surveillance: Signing keys don't permit any surveillance.
Falsification: This is possible but completely trivially detected (it
is obvious if the zone for furble.net is signed by . instead of
.net). Doing any falsification will cause the entire net to start
ignoring the signature of the root and going to direct trust of the
signed TLDs.
> Surely if this goes ahead, it will mean that DNSSEC is doomed to widespread
>non-acceptance.
More than it is now?
>And unless it's used everywhere, there's very little point
>having it at all.
Fully disagree. Many ISPs and individuals will be happy to do direct
trust of the significant zones (com/net/org plus maybe their local
ccTLD) and simply ignore signatures on the rest. This has already
been well-discussed in the ISP community even before this event: many
are not sure they trust ICANN itself, much less its current "sponsor".
Note that I'm not supporting the US signing the root in the least.
I'm just saying that predicting doom is grossly premature.
</anti-rant>
--Paul Hoffman, Director
--VPN Consortium
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
