Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: AW: Odd policy question.

  • From: David W. Hankins
  • Date: Tue Jan 17 12:30:54 2006

On Sat, Jan 14, 2006 at 05:31:12PM -0500, Jeffrey I. Schiller wrote:
> If registrars regularly checked for lame delegations (or checked on
> demand). Then a way to attack a domain would be to forge DNS responses
> to cause the registrar to remove the domain because it is lame. So
> DNSSEC would be needed to be sure...

Something more than merely DNS-SEC.

DNS-SEC is about proving zone contents ("object security").  To prove
lame delegation you'd need a means to identify the nameserver ("channel
security") that's supplying the response.

The difference between "this zone contains (or doesn't) an RR" versus
"this DNS packet is from the server named George."

You could prove inconsistent delegation - that the parent and child
differ.  But this is not necessarily lame.

-- 
David W. Hankins		"If you don't do it right the first time,
Software Engineer			you'll just have to do it again."
Internet Systems Consortium, Inc.		-- Jack T. Hankins

Attachment: pgp00015.pgp
Description: PGP signature




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.