<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>21 jun 2013 kl. 15:05 skrev Daniel Pocock <<a href="mailto:daniel@pocock.com.au">daniel@pocock.com.au</a>>:</div><br class="Apple-interchange-newline"><blockquote type="cite"><blockquote type="cite" style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">* The config uses DNS to establish the transport available on the<br>remote proxy. It doesn't use DNSSEC to do this.<br></blockquote><br style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">I'm not sure if DNSSEC matters if the TLS certificate is valid - some</span><br style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">people may prefer to trust the TLS cert and not place any trust in the</span><br style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span style="font-family: monospace; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">DNSSEC trust model</span></blockquote></div><br><div>THat's quite a misguided statement. If DNS points to an incorrect destination that succeeds</div><div>in providing a certificate that you accept - how can that be a good solution?</div><div><br></div><div>DNSsec verification tells you that you have a authorized binding between the hostname</div><div>and the IP. </div><div><br></div><div>TLS will tell you that you have a binding between the URI you're looking for and</div><div>the server.</div><div><br></div><div>That's two different things.</div><div><br></div><div>DANE - TLS verification using DNSsec - is an alternative to the current rather insecure</div><div>way of handling CA certificates. But that's another story. I think you're mixing DANE</div><div>with DNSsec in your statement, Daniel.</div><div><br></div><div>/O</div></body></html>