| |||||||||||||
What to do about DNS?What to do about DNS?Posted Apr 12, 2007 10:54 UTC (Thu) by job (guest, #670)Parent article: What to do about DNS?
I think the article misses what I see as the big idea with DNSSEC, that it is a key distribution mechanism. And what better global distributed database than the one we already use and trust on a daily basis?
Anyone who thinks that HTTPS or SSH magically gets the correct host key is blind to the obvious problem: Everyone accepts unknown keys, signing key distribution has to be performed manually by the web browser authors (which you must trust), key revocation remains largely unsolved, etc. Perhaps the biggest problem that remains is about identity. Remember the time someone got a false Microsoft key? Does this sound like a scheme we would like to trust all our future banking with?
DNSSEC presents a much more promising approach, that identity is the domain name and that key distribution is best done with DNS. Not all the details are in place yet and not all the software is written but it is by far the best solution yet.
The fact that DNSSEC makes zone transfer restrictions pointless is somewhat of a feature to me, that was a dumb idea anyway. The correct way to ensure that attackers don't access your internal data is to set up a split horizon configuration. Zone transfer restrictions inhibit my work on a regular basis when I can't find other people's errors properly.
I live in one of the few countries where we have a national DNSSEC system in place and from what I can see it's mostly working although very few people actually use it yet, but I think it's safe to say it works in practice. If there are better ideas, let's hear them, but you can't just stick your head in the sand and pretend HTTPS solves anything.
(Log in to post comments)
Point of DNSSEC? Posted Apr 13, 2007 2:40 UTC (Fri) by ldo (subscriber, #40946) [Link]
And how will DNSSEC succeed where SSL and SSH have not? People don't bother checking certificates or host key digests now, why will they check the authentications provided by DNSSEC? How will existing applications like FTP, SSH, host, ping, traceroute and so on present such authentications to the user? If they block access to unauthenticated domains, that will simply annoy the user. If they let accesses through, then it's up to the user to check the authentication, and we've already seen that they can't be bothered. If you warn the user each time, then the sheer number of warnings will take its toll and lead to demands for the warnings to be turned off. And so you're right back to square one.
Point of DNSSEC? Posted Apr 13, 2007 8:28 UTC (Fri) by job (guest, #670) [Link] I'm not sure I understand your questions right, but if you present a DNSSEC key that's not properly signed the resolver returns with an error code. It would be a truly malicious application that came with its own resolver and forced a connection anyway.
So the answers would be, in order, that DNSSEC does not replace SSL, but the latter can take advantage of the former. There's no need to prompt the user as the resolver can prove a key belongs to a certain DNS domain.
I think nobody advocates blocking access to unauthenticated domains completely, but to domains with bad signatures. So applications can work just like today when a domain is not signed, but can take advantage of it when it is.
Point of DNSSEC? Posted Apr 14, 2007 0:37 UTC (Sat) by ldo (subscriber, #40946) [Link]
And how is that different from what SSL and SSH do already?
Point of DNSSEC? Posted Sep 26, 2007 13:42 UTC (Wed) by job (guest, #670) [Link] Sorry for the late answer, but you fail to see the distinction between the encryption protocol and the key distribution. With DNSSEC in place, SSL still works just as before, but instead of trusting CAs you trust the DNS root certificate. The delegation then follows the hierarchical DNS tree. It has been shown again and again that the CA trust model is flawed. With DNSSEC, the person in control of the domain name is also in control of the signing keys for that particular domain.
|
|||||||||||||