Subject: Stub DNSSec Resolution, Or Use DNSScurve

From: Sabahattin Gucukoglu <[email-masked]>
Date: Thu, 25 Feb 2010 13:35:18 +0000

I'm thinking that maybe there's something in having DNSCurve be used for one leg of the journey, between customer and cache.  Then the cache can use DNSSec to get the desired validity of data, withstanding all attempts to subvert it, and not needing to depend on any tricky key retrieval process that is out of band of the security mechanism.

Will it work?  Should it work?  Is it reasonable?  And why aren't stub resolvers being encouraged to do their own DNSSec validation?

Cheers,
Sabahattin

---

From: Tony Finch <[email-masked]>
Date: Thu, 25 Feb 2010 14:14:01 +0000

On Thu, 25 Feb 2010, Sabahattin Gucukoglu wrote:

> I'm thinking that maybe there's something in having DNSCurve be used for
> one leg of the journey, between customer and cache.

That won't work because DNScurve gets its key from the server name, but
recursive servers are configured by IP address not by name.

> And why aren't stub resolvers being encouraged to do their own DNSSec
> validation?

It's very slow if you don't have a cache.

The stub / recursive link can be secured using TSIG or SIG(0) but this
hasn't yet been turned from principle to practice.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.

---

From: Florian Weimer <[email-masked]>
Date: Thu, 25 Feb 2010 14:16:42 +0000

> It's very slow if you don't have a cache.

Note that most stubs actually have a cache these days, so I don't
think this is a major architectural issue.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Thu, 25 Feb 2010 15:50:18 +0000

On 25 Feb 2010, at 14:14, Tony Finch wrote:
> recursive servers are configured by IP address not by name.

We would have to initialise clients, perhaps with a local DHCP option, giving the initial key.  I don't see how you get full trust any other way.

Cheers,
Sabahattin

---

From: David Conrad <[email-masked]>
Date: Thu, 25 Feb 2010 08:04:30 -0800

On Feb 25, 2010, at 6:16 AM, Florian Weimer wrote:
> Note that most stubs actually have a cache these days,

They do?  Maybe that explains the 98% of the crap hitting the roots these days...

Regards,
-drc