| >> Certificates bind a public key and an identity (commonly a DNS name) together. > > So, if "DNSSEC secures DNS," as you say, why do we need certificates at all? Yes and no. Note that a cert binds an identity, not just a DNS name (but
that is what is needed for web servers). DNSSEC doesn't work without resolvers checking for the DNS keys, and
it's not immediately clear (to me at least) if the various higher level
clients can transparently detect if a DNS name is secure or not (similar
to how a web browser can't tell if it's accessing a resource over a
secure IP based VPN and can therefore safely transmit credentials via
plain auth). For trust to work, there needs to be integration of the chain of trust
all the way from the user to the server. TLS/SSL already provides this
-- and with delegation the infrastructure is in place for owners to
manage trust for their own domain (and it is already possible, but
typically expensive). In it's barest form DNSSEC only makes DNS secure, which prevents DNS
spoofing. If you also place a cert (could be self-signed) in DNS, then
you have a "full" solution to securing communications. You would be able
to download the cert without DNSSEC, but unless the chain of trust of
the cert could be verified some other way, you wouldn't be able to use
that cert for secure communications. It is true that current CAs bind a cert to a domain name, but it's not
really the domain name part that is interesting, it's the entity
identifed by that name. So your browser can say, I don't care where this
authenticated (and encrypted) data stream is comming from, I just care
that it is backed by example.com (that is backed by example-ca.com) --
and if the user thinks that Example corp. owns the example.com domain,
one can then infer that the browser is really talking to a web site set
up by Example corp -- regardless of which IPs and DNS records are
involved. Keep in mind that the same CA infrastructure allows a user to indenify
to a server as user@example.org -- from any ip or doman name -- just
as securely, via mutal trust in "Example CA". I think it's somewhat
unfortunate that DNS is so tightly integrated into the user interfaces
for the web -- asserting things about IP adresses and DNS names isn't
really all that interesting -- it's asserting things about entities that
is interesting. While I'm no fan of the current CA system, I'm not convinced DNSSEC is
securing the right things at the right protocol level(s). |