[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: DNSSEC for IPSEC?
At 03:08 PM 7/26/96 EDT, Derek Atkins wrote:
>> There is an issue. Storing the private key off-line is not
>> a deterrent: the mischievous person simply generates a
>> new key pair and re-signs the zone.
>
>Actually, this doesn't work. The problem is that the parent zone
>needs to have signed the zone's key. So, I couldn't go and forge
>a zone key for MIT.EDU, because the MIT.EDU key needs to be signed
>by the EDU key, which in turn needs to be signed by the root key.
>
>So, you can't forge a key without forging the whole hierarchy.
>
Gee it sounds like a job for an AlterNIC...
Robert Moskowitz
Chrysler Corporation
(810) 758-8212