RE: dnscurve and DNS hardening, was Re: Dan Kaminsky

[Skywing <Skywing () valhallalegends com>]

Of course, as long as an adversary in your packet path can force a seamless downgrade (e.g. to plain DNS or plain 
non-TLS SMTP), the hard security benefit is nowhere near as great as it's sometimes purported to be.  And this is a 
problem that we'll be stuck living with for a very long time as far as I can tell.

- S


-----Original Message-----
From: Naveen Nathan [mailto:naveen () calpop com] 
Sent: Wednesday, August 05, 2009 7:05 PM
To: John R. Levine
Cc: nanog () nanog org
Subject: Re: dnscurve and DNS hardening, was Re: Dan Kaminsky

On Wed, Aug 05, 2009 at 09:17:01PM -0400, John R. Levine wrote:
> ...
>
> It seems to me that the situation is no worse than DNSSEC, since in both 
> cases the software at each hop needs to be aware of the security stuff, or 
> you fall back to plain unsigned DNS.

I might misunderstand how dnscurve works, but it appears that dnscurve
is far easier to deploy and get running. The issue is merely coverage.
How much of DNS do you want to protect. This is analagous to SMTP
security, the more MTAs that support TLS the proportional increase
of security in the system as a whole. Dnscurve appears to be another
form of opportunistic encryption, the more servers that employ dnscurve
means an accretion in security of DNS as a whole.