RE: DNSSEC - Signature Only vs the MX/A issue.
> Of course, a spoofing-phishing attack turns into a DoS attack if the[color=blue]
> discards the bogus DNS info but never gets the DNSSEC validated info.[/color]
Actually, if you look at market motivation, there is a case to be made
for focusing on DOS attacks.
Suppose someone is trying to secure a transaction with
"www.example.com". In practice, they will use some form of end-to-end
security, TLS or SSL, as in "https://www.example.com". The end to end
security should provide a proof that they are communicating with the
In these conditions, what is the point of securing the DNS look-up? The
end-to-end verification of the certificate will validate it.
Certificates allow for third party signature, and thus are somewhat
easier to deploy than a strict hierarchical scheme. The verification
will not implicitly validate the mapping of name to address. It will
also protect against routing attacks that might divert the traffic to a
bogus site, an attack not addressed by securing the DNS look-up.
End-to-end security mitigates a spoofing attack and reduces it to a
denial of service attack. If the name to address mapping was wrong, or
unavailable, or if the routing was bogus, the secure transaction will
simply not happen. The focus of DNS security should thus be a protection
against DOS attacks, i.e. ensure that if a record exists, it will be
-- Christian Huitema
to unsubscribe send a message to [email]firstname.lastname@example.org[/email] with
the word 'unsubscribe' in a single line as the message text body.