Re: [websec] Use of DNS/DNSSEC for strict security

"Yngve N. Pettersen" <yngve@opera.com> Tue, 12 October 2010 19:02 UTC

Content-Type: text/plain; charset="iso-8859-15"; format="flowed"; delsp="yes"
To: websec <websec@ietf.org>, Phillip Hallam-Baker <hallam@gmail.com>
References: <AANLkTikt4=dVbTf_tj8HHc=whpU0S+Pv40LrBQHbK6yz@mail.gmail.com>
Date: Tue, 12 Oct 2010 21:04:04 +0200
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: "Yngve N. Pettersen" <yngve@opera.com>
Organization: Opera Software ASA
Message-ID: <op.vkg8k2eukvaitl@lessa-ii.oslo.os>
In-Reply-To: <AANLkTikt4=dVbTf_tj8HHc=whpU0S+Pv40LrBQHbK6yz@mail.gmail.com>
User-Agent: Opera Mail/10.62 (Win32)
Subject: Re: [websec] Use of DNS/DNSSEC for strict security
Precedence: list

On Tue, 12 Oct 2010 20:21:05 +0200, Phillip Hallam-Baker  
<hallam@gmail.com> wrote:

> I am not arguing against doing the HTTP header approach. Given the  
> attacks
> we are facing I do not want strict security to be dependent on successful
> DNSSEC deployment. But I would like to see a HTTP header approach that is
> consistent with eventual deployment of a DNSSEC based approach.

I am not against the suggestion, and I recognize that there are problems  
with the bootstrapping process, but:

Any such system would need to define an API akin to that specified by RFC  
3493 (the APIs used to do namelookups for IPv6) that must be implemented  
in every Operating System.

Anything else would require the client to implement full DNS(SEC) support,  
discover the network configuration, or go direct to deduced nameservers,  
and as a result cause at least potential interoperability problems and  
inefficiencies due to less use of DNS caching.

Additionally, there is the problem with network configurations that does  
not allow any external network traffic except through an HTTP proxy. IOW:  
General DNS is not always available. A workaround for that might be a  
HTTP(s?) based webservice interface to DNS(SEC).

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: yngve@opera.com
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************

[websec] Use of DNS/DNSSEC for strict security Phillip Hallam-Baker
Re: [websec] Use of DNS/DNSSEC for strict security Yngve N. Pettersen
Re: [websec] Use of DNS/DNSSEC for strict security Steingruebl, Andy
Re: [websec] Use of DNS/DNSSEC for strict security Steingruebl, Andy
Re: [websec] Use of DNS/DNSSEC for strict security Phillip Hallam-Baker
Re: [websec] Use of DNS/DNSSEC for strict security Steingruebl, Andy
Re: [websec] Use of DNS/DNSSEC for strict security Sam Caldwell
Re: [websec] Use of DNS/DNSSEC for strict security Tobias Gondrom
Re: [websec] Use of DNS/DNSSEC for strict security Paul Hoffman
Re: [websec] Use of DNS/DNSSEC for strict security Yoav Nir
Re: [websec] Use of DNS/DNSSEC for strict security Phillip Hallam-Baker
Re: [websec] Use of DNS/DNSSEC for strict security Paul Hoffman
Re: [websec] Use of DNS/DNSSEC for strict security Phillip Hallam-Baker
Re: [websec] Use of DNS/DNSSEC for strict security Steingruebl, Andy
Re: [websec] Use of DNS/DNSSEC for strict security Tobias Gondrom
Re: [websec] Use of DNS/DNSSEC for strict security Steingruebl, Andy
Re: [websec] Use of DNS/DNSSEC for strict security Paul Hoffman
Re: [websec] Use of DNS/DNSSEC for strict security Marsh Ray
Re: [websec] Use of DNS/DNSSEC for strict security Mark Nottingham