From owner-freebsd-security Wed Oct 9 17:29:35 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E05A637B404 for ; Wed, 9 Oct 2002 17:29:32 -0700 (PDT) Received: from orthanc.ab.ca (orthanc.ab.ca [216.123.203.186]) by mx1.FreeBSD.org (Postfix) with ESMTP id 53E6143E65 for ; Wed, 9 Oct 2002 17:29:32 -0700 (PDT) (envelope-from lyndon@orthanc.ab.ca) Received: from orthanc.ab.ca (localhost.orthanc.ab.ca [127.0.0.1]) by orthanc.ab.ca (8.12.6/8.12.6) with ESMTP id g9A0TLGI015286; Wed, 9 Oct 2002 18:29:21 -0600 (MDT) (envelope-from lyndon@orthanc.ab.ca) Message-Id: <200210100029.g9A0TLGI015286@orthanc.ab.ca> From: Lyndon Nerenberg Organization: The Frobozz Magic Homing Pigeon Company To: Mike Hoskins Cc: security@FreeBSD.ORG Subject: Re: md5 checksum server In-reply-to: Your message of "Wed, 09 Oct 2002 16:45:06 PDT." <20021009164341.E88705-100000@fubar.adept.org> Date: Wed, 09 Oct 2002 18:29:21 -0600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Mike Hoskins writes: >> 1) it requires DNSSEC to ensure the MD5 record data isn't forged > >Easy enough. Technically, yes. But until we have offficially signed roots, it's not practical to deploy. >> 2) DNS caching would hide updates for the duration of the TTL >> attached to the TXT record > >Tuneable. Yes, but a log of implementations silently enforce a 5 minute minimum TTL, leaving a window where incorrect information could be presented. >I didn't say this was ideal, but it's easy to setup does work in the wild >now for some datasets. Regardless, I'm not attached to any one >proposal... Feel free to make others. :) I like the idea of basing this on the PGP web of trust. I also sense a business opportunity for anyone willing to build an Akami-like secure software distribution service. --lyndon To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message