<<<
Chronological Index
>>> <<<
Thread Index
>>>
Re: [ga] Progress of DNSSEC?: Can .gov trust .com?
- To: Matthew Pemble <matthew@xxxxxxxxxx>, rod_beckstrom@xxxxxxxxx, info@xxxxxxx, steve@xxxxxxxxxxxxxxxx
- Subject: Re: [ga] Progress of DNSSEC?: Can .gov trust .com?
- From: "Jeffrey A. Williams" <jwkckid1@xxxxxxxxxxxxx>
- Date: Tue, 8 Jun 2010 16:04:00 -0500 (GMT-05:00)
<HEAD>
<STYLE>body{font-family:
Geneva,Arial,Helvetica,sans-serif;font-size:10pt;font-family:arial,sans-serif;background-color:#ffffff;color:black;}p{margin:0px}</STYLE>
<META name=GENERATOR content="MSHTML 8.00.6001.18904"></HEAD>
<BODY id=compText>
<P>Matthew and all,</P>
<P> </P>
<P> I am not sure as the link you provided is a PDF file that seems to
have some security</P>
<P>problems that my filters caught that will not allow me to open that
file. Given </P>
<P>Adobe's problems with their products recently, it may be that you have not
put on</P>
<P>the latest patch/fix accordingly. Otherwise review the archives as I
posted the</P>
<P>appropriate link regarding this matter some time ago now. But I fully
agree that</P>
<P>'Only/simply' using longer keys will not adaquately/fully prevent the hack
or </P>
<P>other hacks. Using better/stronger hashes and ag's 'along with' longer
key lengths </P>
<P>will and do according to our tests thus far. Hence we are in the
process of</P>
<P>going to 2048k key lengths from 512k, 'along with' much stronger
crypto ag's.</P>
<P> </P>
<P> Regarding, Adobe Working on Fix for Critical Flaw in Flash, Reader
and Acrobat<BR>see:</P>
<P><BR><A href="http://news.bbc.co.uk/2/hi/technology/10257411.stm";
target=_blank>http://news.bbc.co.uk/2/hi/technology/10257411.stm</A><BR><A
href="http://www.computerworld.com/s/article/9177705/Update_Attackers_exploit_critical_bug_in_Adobe_s_Flash_Reader?taxonomyId=85";
target=_blank>http://www.computerworld.com/s/article/9177705/Update_Attackers_exploit_critical_bug_in_Adobe_s_Flash_Reader?taxonomyId=85</A><BR><A
href="http://krebsonsecurity.com/2010/06/adobe-warns-of-critical-flaw-in-flash-acrobat-reader/";
target=_blank>http://krebsonsecurity.com/2010/06/adobe-warns-of-critical-flaw-in-flash-acrobat-reader/</A><BR><A
href="http://www.informationweek.com/news/software/enterpriseapps/showArticle.jhtml?articleID=225402104&subSection=All+Stories";
target=_blank>http://www.informationweek.com/news/software/enterpriseapps/showArticle.jhtml?articleID=225402104&subSection=All+Stories</A><BR><A
href="http://www.scmagazineus.com/critical-adobe-flash-and-reader-vulnerability-being-exploited/article/171864/";
target=_blank>http://www.scmagazineus.com/critical-adobe-flash-and-reader-vulnerability-being-exploited/article/171864/</A><BR><A
href="http://www.computerworld.com/s/article/9177705/Update_Attackers_exploit_critical_bug_in_Adobe_s_Flash_Reader?source=rss_news";
target=_blank>http://www.computerworld.com/s/article/9177705/Update_Attackers_exploit_critical_bug_in_Adobe_s_Flash_Reader?source=rss_news</A><BR><BR>Seems
ICANN nor the IETF has gotten this critical flaw info yet either, which sets
one to wondering in</P>
<P>regards to the current DNSSEC implimentation exercise...<BR><BR><BR></P>
<BLOCKQUOTE style="BORDER-LEFT: #0000ff 2px solid; PADDING-LEFT: 5px;
MARGIN-LEFT: 0px">-----Original Message----- <BR>From: Matthew Pemble
<MATTHEW@xxxxxxxxxx><BR>Sent: Jun 8, 2010 2:08 AM <BR>To: "Jeffrey A. Williams"
<JWKCKID1@xxxxxxxxxxxxx><BR>Cc: ga@xxxxxxxxxxxxxx <BR>Subject: Re: [ga]
Progress of DNSSEC?: Can .gov trust .com? <BR><BR>Jeff,<BR><BR>
<DIV class=gmail_quote>On 7 June 2010 22:19, Jeffrey A. Williams <SPAN
dir=ltr><<A href="mailto:jwkckid1@xxxxxxxxxxxxx";
target=_blank>jwkckid1@xxxxxxxxxxxxx</A>></SPAN> wrote:<BR>
<BLOCKQUOTE style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt
0.8ex; PADDING-LEFT: 1ex" class=gmail_quote><BR>What<BR>bothers us is that some
organizations have had DNSSEC implemented<BR>for some years now and uses much
stronger domain keys that the<BR>NIST standard currently calls for simply
because 256k is far<BR>too weak as 1024k has already been broken by the
University of<BR>Michigan, </BLOCKQUOTE>
<DIV><BR><BR>Do you mean this <A
href="http://www.eecs.umich.edu/%7Etaustin/papers/DATE10-rsa.pdf";
target=_blank>paper</A> (Pellegrini, Bertacco and Austin)? If not, would you
please provide your references. <BR><BR>I would hazard that if an attacker had
physical access to the hardware of your DNS Server, to the extent that they can
copy the logic state and model it on an FPGA, then you have rather more
fundamental problems than practical weaknesses in the use of general purpose
computing hardware for cryptographic purposes (hence, of course, the widespread
use of HSMs / SCMs in govt and finance applications.)<BR><BR>I would also point
out that the UM attack will probably scale more-or-less linearly with key
length - as do many attacks against flawed hardware crypto (as opposed to the
geometrical scaling you would expect from a brute force attack against a key),
therefore simply using longer key lengths is not a suitable prophylactic
measure.<BR><BR><BR></DIV>
<BLOCKQUOTE style="BORDER-LEFT: rgb(204,204,204) 1px solid; MARGIN: 0pt 0pt 0pt
0.8ex; PADDING-LEFT: 1ex" class=gmail_quote>and as such the security that the
current DNSSEC<BR>implimentation NIST set standard will from the beginning
offer<BR>little protection for a ver short period of time
accordingly.<BR><BR></BLOCKQUOTE></DIV>
<P><BR><BR>One of the problems with standards implementations is that they
generally need to take account of compatibility issues, whereas wild
condemnations don't.<BR clear=all><BR>What is the threat model here? Are you
demanding universally pristine security? Are you trying to stop the (insert TLA
of choice) spoofing your DNS? Or just spammers and other
fraudsters?<BR><BR>Matthew<BR>-- <BR>Matthew Pemble<BR>Technical Director,
Idrach Ltd<BR><BR>Mobile: +44 (0) 7595 652175<BR>Office: + 44 (0) 1324
820690<BR></P>
<P>Regards,<BR><BR>Jeffrey A. Williams<BR>Spokesman for INEGroup LLA. - (Over
300+k members/stakeholders and growing, strong!)<BR>"Obedience of the law is
the greatest freedom" -<BR> Abraham Lincoln<BR><BR>"Credit should
go with the performance of duty and not with what is very<BR>often the accident
of glory" - Theodore Roosevelt<BR><BR>"If the probability be called P; the
injury, L; and the burden, B; liability<BR>depends upon whether B is less than
L multiplied by<BR>P: i.e., whether B is less than PL."<BR>United States v.
Carroll Towing (159 F.2d 169 [2d Cir.
1947]<BR>===============================================================<BR>Updated
1/26/04<BR>CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS.
div. of<BR>Information Network Eng. INEG. INC.<BR>ABA member in good
standing member ID 01257402 E-Mail jwkckid1@xxxxxxxxxxxxx<BR>Phone:
214-244-4827<BR></P></BLOCKQUOTE></BODY>
<<<
Chronological Index
>>> <<<
Thread Index
>>>
|