Re: secure entry point

[Miek Gieben <miekg@atoom.net>]

[On 01 Apr, @12:14, Jakob wrote in "Re: secure entry point ..."]
> On Tue, 1 Apr 2003, Miek Gieben wrote:
> 
> > Spoof the nameserver ip, and the resolver gets bad data, there is no
> > way the resolver can guard against such an attack.
> 
> the resolver can always detect if it had received bad data.

yes.. so if I spoof the secure entry IP for .nl, the whole of .nl is bad

> > And if you change nameservers you will probably also change the key, so
> > the resolver already has to update something.
> 
> why would you ever change the key if you change nameserver? distributing
> the signed zone and signing it is very different.

I'm in the process of writing down how DNS operations will look like when
DNSSEC is deployed. Maybe we should take this up on the cafax list.

grtz Miek

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>