Point of DNSSEC? [LWN.net]

Point of DNSSEC?

Posted Apr 13, 2007 8:28 UTC (Fri) by job (subscriber, #670)
In reply to: Point of DNSSEC? by ldo
Parent article: What to do about DNS?

I'm not sure I understand your questions right, but if you present a DNSSEC key that's not properly signed the resolver returns with an error code. It would be a truly malicious application that came with its own resolver and forced a connection anyway.

So the answers would be, in order, that DNSSEC does not replace SSL, but the latter can take advantage of the former. There's no need to prompt the user as the resolver can prove a key belongs to a certain DNS domain.

I think nobody advocates blocking access to unauthenticated domains completely, but to domains with bad signatures. So applications can work just like today when a domain is not signed, but can take advantage of it when it is.

(Log in to post comments)

Point of DNSSEC?

Posted Apr 14, 2007 0:37 UTC (Sat) by ldo (subscriber, #40946) [Link]

If you present a DNSSEC key that's not properly signed the resolver returns with an error code.

And how is that different from what SSL and SSH do already?

Point of DNSSEC?

Posted Sep 26, 2007 13:42 UTC (Wed) by job (subscriber, #670) [Link]

Sorry for the late answer, but you fail to see the distinction between the encryption protocol and the key distribution. With DNSSEC in place, SSL still works just as before, but instead of trusting CAs you trust the DNS root certificate. The delegation then follows the hierarchical DNS tree. It has been shown again and again that the CA trust model is flawed. With DNSSEC, the person in control of the domain name is also in control of the signing keys for that particular domain.