DNSSEC is NOT secure end to end

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Bill Manning wrote:

> If you are so interested in transport layer security, then
> by all means, encourage, promote, and develop solutions.

The discussion of the paper of David Clark about public key is not
on a transport but on an administrative layer.

The paper says:

	However, there is a key role for a third party, which is to
	issue a Public Key Certificate and manage the stock of such
	certificates; such parties are called certificate authorities.

and the issuance and management of certificates, which is the key,
involves no transportation of the certificates and is not transport
but local (local to zone) administrative issues.

Or, if you insist the paper discusses on transport layer security
of public key cryptography, please feel free to quote the relevant
part of the paper.

I mention transport security merely because it is still required
with DNSSEC, because administrative security of DNSSEC is
cryptographically weak.

So, let's throw away DNSSEC and the broken-from-the-beginning
idea of bailiwick. Let's move on to lock the doors and windows.

						Masataka Ohta

_______________________________________________

Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf

[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]