Subject: Re: IAB statement on the RPKI.

From: [email-masked] (Noel Chiappa)
Date: Fri, 19 Feb 2010 20:04:49 -0500 (EST)

> From: Masataka Ohta <[email-masked]>

    >> What DNSsec will provide is ... data origin authentication and data
    >> integrity protection.

    > That is already offered with plain old DNS with UDP checksum, cookie
    > and return routability, though UDP checksum is optional and cookie of
    > message ID is a little bit too short.

??? There is clearly something here I don't understand.

How does the UDP checksum plus a cookie (nonce) protect against a MITM attack,
on the path from the server back to the querying entity?

	Noel

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 20 Feb 2010 10:16:23 +0900

> ??? There is clearly something here I don't understand.

No, you don't.

> on the path from the server back to the querying entity?

As DNSSEC is not protected from MitM attacks on zones on the path
between client and server zones, how can you expect plain old DNS
is better protected?

						Masataka Ohta