6 ms·

This statement is not provably true. With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it

This statement is not provably true. With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root. If someone were to sign a different root with the same key we would no longer be sure which was the right one. An attacker could redirect traffic away from TLD nameservers to their own nameservers. I think you understand this. What I don't understand is why you think this scenario would not be a problem.

TazeTSchnitzel 10y ago
TLS works on the assumption that DNS is insecure. So, since everything that matters happens over TLS, it's not a problem if DNSSEC is compromised. It wouldn't matter if DNSSEC wasn't invented to begin with. It might be better that way, actually, given its problems.
- AndyMcConachie 10y ago
  Let's Encrypt, and pretty much any other CA, will issue me a TLS cert based on what they find in DNS. So how's that for circular reasoning :) But seriously, wouldn't it be better if DNS wasn't so insecure? Or do you think that DNS being insecure provides a net good?
  - tptacek 10y ago
    No, it wouldn't be better if DNS was less insecure: applying cryptography to address security problems adds cost (along several dimensions), and those costs outweigh the marginal benefit. It's like asking, "wouldn't the Internet be better if ARP were secure?"
    - AndyMcConachie 10y ago
      I don't get the Internet ARP reference? That's just false equivalence. I think we're just going to continue to disagree. We've argued over DNSSEC on HN many times and it's clear to me we don't see eye-to-eye. That's fine, and I respect your opinion. I just think you're wrong, and I doubt anything you say will convince me otherwise.
tptacek 10y ago
Practically 100% of all commercial DNS lookups --- that is, lookups done in the service of actual commerce --- are done without DNSSEC. Moreover, no modern browser implements DANE, and 3 (Safari, Firefox, and Chrome) have started and later retracted DANE support, so the TLS infrastructure also does not rely on DNSSEC in any way. My earlier statement is surprising, and I understand why. But it's true.
- AndyMcConachie 10y ago
  DANE is relatively new, but already we have over 50,000 MX records with associated TLSA records. So DANE is actually being used regularly, and these numbers are growing. There's more to the Internet than just the web and browsers. > Practically 100% of all commercial DNS lookups --- that is, lookups done in the service of actual commerce --- are done without DNSSEC. Wait what? I'm not sure what you categorize as a 'commercial DNS lookup', and I'm not even sure it matters, because this statement is so completely false I don't even know where to begin. All of Comcast's subscriber base are using recursive resolvers that use DNSSEC, are none of them performing 'commercial DNS lookups'?
  - tptacek 10y ago
    No, in fact, virtually nobody in the real world uses DANE, because no browser supports DANE. Chrome and Firefox briefly attempted DANE a few years ago, and both removed it. The Chromium team --- the single most important mover in SSL/TLS security --- has been pretty plain about the fact that DANE isn't on the agenda. You might start with this Adam Langley post: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
    - AndyMcConachie 10y ago
      So after I bring up the fact that DANE is being used for SMTP you state that no one is using it because it's not being used for HTTPS? BTW I'm not even arguing for DANE in this thread. I was arguing for DNSSEC specifically. You brought up DANE to make some point about DNSSEC. But we can have DNSSEC without DANE.
Panino 10y ago
> With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root. If that's the best counterpoint, then I'm sorry to say that this has already been possible for a long time. I remember it being available at least 10 or 15 years ago. https://www.internic.net/domain/ https://www.internic.net/domain/ At the above link you can download, over HTTPS, the root zone including PGP signatures. With everything taken into account, DNSSEC causes far more problems than it solves.
- AndyMcConachie 10y ago
  The root zone has always been publicly available. But isn't it nice that you can cryptographically verify that this is the root-zone with DNSSEC? I'm not sure how you're verifying it using PGP, but I think you mean public key encryption, which is what DNSSEC is using.
  - tptacek 10y ago
    DNSSEC does not in fact use public-key encryption; it uses public-key signatures, with an outmoded RSA construction that would have been rejected for new protocols 5 years ago. In fact: TLS 1.3 just jettisoned RSA.

TazeTSchnitzel 10y ago

TLS works on the assumption that DNS is insecure. So, since everything that matters happens over TLS, it's not a problem if DNSSEC is compromised. It wouldn't matter if DNSSEC wasn't invented to begin with. It might be better that way, actually, given its problems.

AndyMcConachie 10y ago
Let's Encrypt, and pretty much any other CA, will issue me a TLS cert based on what they find in DNS. So how's that for circular reasoning :) But seriously, wouldn't it be better if DNS wasn't so insecure? Or do you think that DNS being insecure provides a net good?
- tptacek 10y ago
  No, it wouldn't be better if DNS was less insecure: applying cryptography to address security problems adds cost (along several dimensions), and those costs outweigh the marginal benefit. It's like asking, "wouldn't the Internet be better if ARP were secure?"
  - AndyMcConachie 10y ago
    I don't get the Internet ARP reference? That's just false equivalence. I think we're just going to continue to disagree. We've argued over DNSSEC on HN many times and it's clear to me we don't see eye-to-eye. That's fine, and I respect your opinion. I just think you're wrong, and I doubt anything you say will convince me otherwise.

tptacek 10y ago

Practically 100% of all commercial DNS lookups --- that is, lookups done in the service of actual commerce --- are done without DNSSEC. Moreover, no modern browser implements DANE, and 3 (Safari, Firefox, and Chrome) have started and later retracted DANE support, so the TLS infrastructure also does not rely on DNSSEC in any way. My earlier statement is surprising, and I understand why. But it's true.

AndyMcConachie 10y ago
DANE is relatively new, but already we have over 50,000 MX records with associated TLSA records. So DANE is actually being used regularly, and these numbers are growing. There's more to the Internet than just the web and browsers. > Practically 100% of all commercial DNS lookups --- that is, lookups done in the service of actual commerce --- are done without DNSSEC. Wait what? I'm not sure what you categorize as a 'commercial DNS lookup', and I'm not even sure it matters, because this statement is so completely false I don't even know where to begin. All of Comcast's subscriber base are using recursive resolvers that use DNSSEC, are none of them performing 'commercial DNS lookups'?
- tptacek 10y ago
  No, in fact, virtually nobody in the real world uses DANE, because no browser supports DANE. Chrome and Firefox briefly attempted DANE a few years ago, and both removed it. The Chromium team --- the single most important mover in SSL/TLS security --- has been pretty plain about the fact that DANE isn't on the agenda. You might start with this Adam Langley post: https://www.imperialviolet.org/2015/01/17/notdane.html https://www.imperialviolet.org/2015/01/17/notdane.html
  - AndyMcConachie 10y ago
    So after I bring up the fact that DANE is being used for SMTP you state that no one is using it because it's not being used for HTTPS? BTW I'm not even arguing for DANE in this thread. I was arguing for DNSSEC specifically. You brought up DANE to make some point about DNSSEC. But we can have DNSSEC without DANE.

Panino 10y ago

> With a DNSSEC signed root anyone can host their own copy of the root zone, and we can all cryptographically verify that it is the same root. If that's the best counterpoint, then I'm sorry to say that this has already been possible for a long time. I remember it being available at least 10 or 15 years ago. https://www.internic.net/domain/ https://www.internic.net/domain/ At the above link you can download, over HTTPS, the root zone including PGP signatures. With everything taken into account, DNSSEC causes far more problems than it solves.

AndyMcConachie 10y ago
The root zone has always been publicly available. But isn't it nice that you can cryptographically verify that this is the root-zone with DNSSEC? I'm not sure how you're verifying it using PGP, but I think you mean public key encryption, which is what DNSSEC is using.
- tptacek 10y ago
  DNSSEC does not in fact use public-key encryption; it uses public-key signatures, with an outmoded RSA construction that would have been rejected for new protocols 5 years ago. In fact: TLS 1.3 just jettisoned RSA.