Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?

Is DNSSec an IPv4-only technology?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

DNSSEC provides something rather different than IPSec, and either or both may meet your needs. IPSec can encrypt packets and sign them, providing evidence that they come from something you trust, IF you have a PKI (Public Key Infrastructure) you can trust. But that "IF" is a very tall order, especially given the presence these days in most common "trusted" default certificate stores of root certificates controlled by foreign governments whom I certainly wouldn't trust.

If you just want a private VPN, using only your own certificates and networks and your own DNS servers, IPSec may provide what you want. But if you want to find out from the public network where to send your packets in the first place, i.e. via a secure mapping from domain names to IP addresses, that is what DNSSEC is for.

Note also, coming in the not-so-distant future (we hope) the almost-formed Keys In DNS (kidns) working group of the Internet Engineering Task Force, which will help integrate these and other security protocols in a way which gets around the current morass of "Certificate Authorities": http://www.spinics.net/lists/ietf-ann/msg57258.html

Update: the kidns working group proposal was adopted under the name DANE: DNS-based Authentication of Named Entities. It wrote RFC6698 which was implemented in some tools and libraries and browser extensions, but did not become a mainstream browser feature.

Alternate technologies like certificate pinning (secse) potentially aided by HTTP Strict Transport Security have helped with the underlying issues.

share|improve this answer
    
Related: DANE for DNS: tools.ietf.org/html/draft-ietf-dane-protocol-21 –  LamonteCristo May 24 '12 at 18:18
    
@nealmcb, "Keys In DNS (kidns)"? Is that another name for DANE? –  Pacerier May 25 at 3:50
    
@Pacerier Yes - thanks for the prompt. I updated the answer –  nealmcb May 25 at 4:44

The DNS Section of the IPv6 Wikipedia page does not have anything about defending against bogus DNS responses so it appears that DNSSec is still necessary.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.