4 ms·

> TLS is enough authentication of a site What about other records? MX, TXT, NS? How they are protected from tampering, both in transit and by rogue DNS servers

> TLS is enough authentication of a site What about other records? MX, TXT, NS? How they are protected from tampering, both in transit and by rogue DNS servers? > weak RSA key Better than plaintext, harder to modify, is it not?

Fnoord 8y ago
> What about other records? MX, TXT, NS? How they are protected from tampering, both in transit DNSCrypt, DNS over TLS, DNS over HTTPS. > and by rogue DNS servers By querying multiple DNSCrypt servers and comparing the results. > Better than plaintext, is it not? Depends. People are going to assume "I am using DNSSEC so I cannot be vulnerable to DNS poisoning."
- auslander 8y ago
  > By querying ... and comparing Checking crypto signature is more reliable, imho I think best way to go is both, DNSSEC and DoT. > People are going to assume "I am using DNSSEC so I cannot be vulnerable to DNS poisoning." I'm one of those suckers :D
- bluejekyll 8y ago
  Everything you mention as alternatives don’t actually solve the authentication issue. They do make joining the DNS network harder. Those technologies authenticate the DNS servers, and encrypt the channels, but they do not authenticate the records. We should have techniques for both privacy, DNSCrypt/DoT/DoH, and authenticity, DNSSEC. I won’t offer an opinion on the root key management in DNS, but the underlying technologies for authenticating and signing records in DNSSEC are good.
  - pvg 8y ago
    What does 'authenticated records' actually get you?
    - bluejekyll 8y ago
      That question is so broad. It entirely depends on what you want to use DNS for, and authenticated data allows it to be trusted for more use cases. Right now we have a system that from a security standpoint can’t stand on its own (given the internet community’s fight over DNSSEC), but yet is more widely deployed than pretty much any other protocol. Shouldn’t we harden that, and allow it to be used independently of requiring systems to connect to some other centralized system over HTTPS?
      - tptacek 8y ago
        No. What would the point be? You'd still need TLS. DNSSEC isn't even encrypted, and even if it were, it's still only addressing the name lookup. Meanwhile, TLS was designed to assume the DNS is insecure, and has worked that way for decades. Try a thought experiment: imagine the root DNSSEC keys are published to Pastebin tonight. What happens? What blows up? I think, apart from DNS operators (maybe?), you'll have trouble identifying a company who would have to do anything.

Fnoord 8y ago

> What about other records? MX, TXT, NS? How they are protected from tampering, both in transit DNSCrypt, DNS over TLS, DNS over HTTPS. > and by rogue DNS servers By querying multiple DNSCrypt servers and comparing the results. > Better than plaintext, is it not? Depends. People are going to assume "I am using DNSSEC so I cannot be vulnerable to DNS poisoning."

auslander 8y ago
> By querying ... and comparing Checking crypto signature is more reliable, imho I think best way to go is both, DNSSEC and DoT. > People are going to assume "I am using DNSSEC so I cannot be vulnerable to DNS poisoning." I'm one of those suckers :D
bluejekyll 8y ago
Everything you mention as alternatives don’t actually solve the authentication issue. They do make joining the DNS network harder. Those technologies authenticate the DNS servers, and encrypt the channels, but they do not authenticate the records. We should have techniques for both privacy, DNSCrypt/DoT/DoH, and authenticity, DNSSEC. I won’t offer an opinion on the root key management in DNS, but the underlying technologies for authenticating and signing records in DNSSEC are good.
- pvg 8y ago
  What does 'authenticated records' actually get you?
  - bluejekyll 8y ago
    That question is so broad. It entirely depends on what you want to use DNS for, and authenticated data allows it to be trusted for more use cases. Right now we have a system that from a security standpoint can’t stand on its own (given the internet community’s fight over DNSSEC), but yet is more widely deployed than pretty much any other protocol. Shouldn’t we harden that, and allow it to be used independently of requiring systems to connect to some other centralized system over HTTPS?
    - tptacek 8y ago
      No. What would the point be? You'd still need TLS. DNSSEC isn't even encrypted, and even if it were, it's still only addressing the name lookup. Meanwhile, TLS was designed to assume the DNS is insecure, and has worked that way for decades. Try a thought experiment: imagine the root DNSSEC keys are published to Pastebin tonight. What happens? What blows up? I think, apart from DNS operators (maybe?), you'll have trouble identifying a company who would have to do anything.