North American Network Operators Group
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Historical
Re: DNS cache poisoning attacks -- are they real?
- From: Florian Weimer
- Date: Sun Mar 27 17:20:51 2005
* Sean Donelan:
> Signatures don't create trust. A signature can only confirm an existing
> trust relationship. DNSSEC would have the same problem, where do you get
> the trustworthing signatures? By connecting to the same root you don't
> trust?
>
> As a practical matter, you can stop 99% of the problems with a lot less
> effort. Why has SSH been so successful, and DNSSEC stumbled so badly?
Because SSH "signatures" do create trust. SSH uses the key continuity
model, not the PKI model.
|
