full-disclosure - Re: DNS Cache Dan Kamikaze (Actual Exploit Discussion)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200807160117.m6G1H7AY020697@drugs.dv.isc.org>
Date: Wed, 16 Jul 2008 11:17:07 +1000
From: Mark Andrews <Mark_Andrews@....org>
To: Paul Schmehl <pschmehl_lists_nada@...rr.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: DNS Cache Dan Kamikaze (Actual Exploit
	Discussion)


> The real problem isn't signing or resigning zones, or even successfully=20
> completing the original configuration (although those are not trivial for=20
> the average person trying to setup their own dns).  It's the trust=20
> anchors.  Until the root is signed, trust anchors are a PITA.  And until=20
> the root is signed, why should anyone believe that DNSSEC will achieve=20
> wide adoption?

	Well there are a number of ccTLD's that are already signed.
	RIPE sign their part of the reverse space.  ORG is in the
	process of getting signed.  It's happening.

	There are existing solutions to dealing with lack of support
	in the infrastructure zones (includes the root).  You let
	someone you trust collect the trust anchors for you then
	incorporate them on a regular basis.

	We effectively do this everyday with https but for some
	reason people are scared to do the same thing with dns
	despite private parts of the keys never being available to
	the entity doing the certification.  With https the certifying
	authority can spoof any site they certify.

	Mark

> Paul Schmehl
> If it isn't already obvious,
> my opinions are my own and not
> those of my employer.
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark_Andrews@....org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/