Re: [9fans] Are we ready for DNSSEC ?

[erik quanstrom <quanstro@quanstro.net>]

On Sun Jan 24 08:21:50 EST 2010, 23hiro@googlemail.com wrote:
> so you need to have a more "secure" dns because you don't trust your ssl?

do you feel dnssec provides the same or worse security?  why?

the simple answer to your question is yes.  the renegotiation bug
in ssl requires you to start talking to the wrong server.  (this attack
wouldn't be necessary if you're attacker is behind the ssl termination pts.)
a similar attack could work against imperfect certificate checking.
since the easiest way to get someone to the wrong place is to give
them the wrong address, i think a more secure dns helps.

as to fixing the renegotiation bug by turning it off: do you feel
confident that you know how to do this (is it possible) with every
bit of ssl-capable equipment you own?  i don't.  i also don't think
it's the only attack than can be facilitated by first owning dns.

more food for thought.  the ca chains just aren't that well-verified.  it
was easy enough to get a bogus microsoft certificate a few years
back.  if you can own dns, and get a bogus bigco.com cert, you're
in business.

- erik