8 ms·

> If I wanted to steal these keys The question is: Why would you want to steal these keys? What are you going to do with it? This is all big theatre around a

by hannob 7y ago

> If I wanted to steal these keys The question is: Why would you want to steal these keys? What are you going to do with it? This is all big theatre around a technology that has barely any meaning in practice. Nothing relevant would break if you publish these private keys on the Internet tomorrow.

sneak 7y ago
Stealing the KSKs for DNSSEC would enable an isp or government to spoof signed dns replies to any validating resolver they wished to lie to sometime in the future. Some people, somewhere are relying on public keys or fingerprints published in DNS. Presumably, more will do so in the future.
- sp332 7y ago
  Some people, somewhere are relying on public keys or fingerprints published in DNS. I think this is begging GP's question. Is there really any such person?
  - jacobr1 7y ago
    Everyone using email under conditions where DKIM is important
- tptacek 7y ago
  This is circular. All you've said here is that stealing the KSKs for DNSSEC would enable an ISP or government to defeat DNSSEC. The comment you're responding to accepts that, but argues (correctly) that it doesn't matter if you defeat DNSSEC, because nothing important relies on it.
  - alwillis 7y ago
    it doesn't matter if you defeat DNSSEC, because nothing important relies on it. Not true. I would say secure email is something important and that relies on DANE, which requires DNSSEC. Good video on this: https://youtu.be/BhvU19RJrPY https://youtu.be/BhvU19RJrPY DANE’s TLSA records is the only method available to ensure that email is always encrypted between hosts. Otherwise it’s too easy for someone to MITM a connection and downgrade the connection. And actual data on DNSSEC and DANE usage shows DANE usage is way up: https://stats.dnssec-tools.org/ https://stats.dnssec-tools.org/
    - tptacek 7y ago
      There is so little confidence in DNSSEC's utility to secure email that all the major email providers banded together and created a new standard, MTA-STS, specifically to route around ever needing to use DNSSEC.
      - alwillis 7y ago
        I doubt there’s a lack of confidence since DNSSEC/DANE is obviously handling tens of millions of email messages everyday. Since DANE gives you more than just email, it has the advantage right now.
        tptacek 7y ago
        Since no major email provider uses it, and since they're the driving force behind a standard designed to avoid its use, I think the burden is on you to show that there's confidence in DNSSEC for email.
        alwillis 7y ago
        It’s not DNSSEC for email; it’s DANE and TLSA for email. Postfix and Exim, the two most popular MTAa support DANE. I did post data showing that nearly 2 million email servers are using DANE and that number continues to increase.
        tptacek 7y ago
        Why is it even remotely interesting that 2 pieces of open source software support a protocol? And why do I care that email forwarders run by registrars that automatically sign domains "support" DNSSEC? What matters is the percentage of all email that uses the protocol. Never use Exim, by the way.
      - sneak 7y ago
        "nothing relies on it" and "there is not a majority consensus that it is valuable or useful" is not the same assertion. The first is both falsifiabile and demonstrably false. The second may well be true. Your opinion about the usefulness of DNSSEC is well-documented. That's not the topic of this specific thread: here we are discussing the theoretical case where the DNSSEC KSKs were copied to an unauthorized party, and what damage they may be able to wreak. As I mentioned, they could use it to forge DNSSEC responses to validating resolvers, now and in the future. It is a fact that some small number of people rely on DNSSEC responses today, so that would be the attack surface. If DNSSEC usage declines, as it seems you wish it does, then the consequence of such a leak of key material would also decline with that. If it increases, then the consequence of such a leak would also increase, as more people in that hypothetical future would be theoretically vulnerable to forged responses. If you're a group that steals high value keys for a living, it would be nice to steal the DNSSEC long-term keys when DNSSEC is small and unimportant, because it might be a lot more difficult later if DNSSEC becomes widely adopted to protect critical infrastructure. Already at least a few dozen people think that these keys are sufficiently important to spend thousands of dollars and dozens of valuable witness-hours traveling to these key ceremonies and storing these safes and whatnot. Perhaps they are entirely misguided and should abandon the entire endeavor. I don't think the "DNS TLDs are simply a proxy for governments" is enough of a disqualifying argument when several governments or even large corporations have implicitly trusted CAs in widespread use. I think it's useful to have another choice of validated data to cross-check with. Perhaps you are worried that it would de facto replace the existing corporate-managed PKI with a government-managed one entirely? I also think that what another commenter mentioned, that you have a choice in governments (and could theoretically publish your signed certificate data in multiple zones, controlled by multiple different governments) is an extremely beneficial set of possibilities. Multiple-TLD-publishing is certainly a better system than the attempts at public-key pinning and observatories/transparency we've seen as attempts to solve the "anyone can issue for any domain" problem as it stands. ...unless, of course, the root zone KSKs get stolen. Then all the TLD zones are unsafe. :)
  - alwillis 7y ago
    “today I count 1,815,489 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections.” https://mail.sys4.de/pipermail/dane-users/2020-February/000548.html https://mail.sys4.de/pipermail/dane-users/2020-February/0005... BTW: the US is #2 in the world in terms of DANE-enabled email hosts.
tialaramex 7y ago
Before I critique it, I should point out for those at home that Hanno's position here is absolutely the conventional position, lots of important smart people will tell you Hanno is right about this, not just a few kooks. If it's important to you to have popular opinions about such topics - rather than thinking about it on your own - this is the "correct" opinion to have. Now, having explained that, I'm sure it's quite wrong after spending many years thinking about this (more than 10 years but probably less than 20) and I'll try to briefly explain why. The DNS is a key source of truth, and so we need to actually secure the DNS hierarchy. Because of the belief Hanno espouses, there have been a lot of attempts to dodge this work over the years but it's the nature of the problem that dodging it can't work, it just moves the problem and then we're back again from a different angle. DNSSEC is narrowly tailored to solve only the problem we actually had, securing the source of truth, and nothing else. It isn't a privacy technology, or an anti-censorship technology, or a delicious new flavour of ice cream, it just secures the source of truth. The thing about security is that the Happy Path looks exactly the same whether you have security or not. You've all been here with HTTP. Remember when most sites you visited either didn't use HTTPS or only used it for a "login" step and then kicked you back to HTTP? How often did a site you visited actually have a breach because it used HTTP? Probably never. The happy path, where nobody was trying to steal your credentials or whatever was nearly always the path you were on anyway, HTTP was dangerous but you didn't really feel it. In hindsight that seems crazy but people put up with it for years. For DNS we're still in that dark period, and unfortunately lots of people are wrongly confident that it's for the best.
- akerl_ 7y ago
  I think is a pretty rough mischaracterization to say “lots of people are wrongly confident that it’s for the best [that we stay in that ‘dark period’]”. Speaking as one of those “people”, I’m confident that DNSSEC doesn’t meaningfully improve the security of DNS. The root of trust for DNSSEC is TLD operators, who are in many cases direct subsidiaries of governments and in other cases are effectively controlled by governments, and it uses woefully outdated crypto to provide the chain of trust. And the failure more for when anything goes wrong is that your site drops off the internet at the DNS resolution step, which is pretty gnarly. I’d be happy for a proposal that aimed to improve the threat model for network connections, but DNSSEC does not do that.

by hannob 7y ago

sneak 7y ago

Stealing the KSKs for DNSSEC would enable an isp or government to spoof signed dns replies to any validating resolver they wished to lie to sometime in the future. Some people, somewhere are relying on public keys or fingerprints published in DNS. Presumably, more will do so in the future.

sp332 7y ago
Some people, somewhere are relying on public keys or fingerprints published in DNS. I think this is begging GP's question. Is there really any such person?
- jacobr1 7y ago
  Everyone using email under conditions where DKIM is important
tptacek 7y ago
This is circular. All you've said here is that stealing the KSKs for DNSSEC would enable an ISP or government to defeat DNSSEC. The comment you're responding to accepts that, but argues (correctly) that it doesn't matter if you defeat DNSSEC, because nothing important relies on it.
- alwillis 7y ago
  it doesn't matter if you defeat DNSSEC, because nothing important relies on it. Not true. I would say secure email is something important and that relies on DANE, which requires DNSSEC. Good video on this: https://youtu.be/BhvU19RJrPY https://youtu.be/BhvU19RJrPY DANE’s TLSA records is the only method available to ensure that email is always encrypted between hosts. Otherwise it’s too easy for someone to MITM a connection and downgrade the connection. And actual data on DNSSEC and DANE usage shows DANE usage is way up: https://stats.dnssec-tools.org/ https://stats.dnssec-tools.org/
  - tptacek 7y ago
    There is so little confidence in DNSSEC's utility to secure email that all the major email providers banded together and created a new standard, MTA-STS, specifically to route around ever needing to use DNSSEC.
    - alwillis 7y ago
      I doubt there’s a lack of confidence since DNSSEC/DANE is obviously handling tens of millions of email messages everyday. Since DANE gives you more than just email, it has the advantage right now.
      - tptacek 7y ago
        Since no major email provider uses it, and since they're the driving force behind a standard designed to avoid its use, I think the burden is on you to show that there's confidence in DNSSEC for email.
        alwillis 7y ago
        It’s not DNSSEC for email; it’s DANE and TLSA for email. Postfix and Exim, the two most popular MTAa support DANE. I did post data showing that nearly 2 million email servers are using DANE and that number continues to increase.
        tptacek 7y ago
        Why is it even remotely interesting that 2 pieces of open source software support a protocol? And why do I care that email forwarders run by registrars that automatically sign domains "support" DNSSEC? What matters is the percentage of all email that uses the protocol. Never use Exim, by the way.
    - sneak 7y ago
      "nothing relies on it" and "there is not a majority consensus that it is valuable or useful" is not the same assertion. The first is both falsifiabile and demonstrably false. The second may well be true. Your opinion about the usefulness of DNSSEC is well-documented. That's not the topic of this specific thread: here we are discussing the theoretical case where the DNSSEC KSKs were copied to an unauthorized party, and what damage they may be able to wreak. As I mentioned, they could use it to forge DNSSEC responses to validating resolvers, now and in the future. It is a fact that some small number of people rely on DNSSEC responses today, so that would be the attack surface. If DNSSEC usage declines, as it seems you wish it does, then the consequence of such a leak of key material would also decline with that. If it increases, then the consequence of such a leak would also increase, as more people in that hypothetical future would be theoretically vulnerable to forged responses. If you're a group that steals high value keys for a living, it would be nice to steal the DNSSEC long-term keys when DNSSEC is small and unimportant, because it might be a lot more difficult later if DNSSEC becomes widely adopted to protect critical infrastructure. Already at least a few dozen people think that these keys are sufficiently important to spend thousands of dollars and dozens of valuable witness-hours traveling to these key ceremonies and storing these safes and whatnot. Perhaps they are entirely misguided and should abandon the entire endeavor. I don't think the "DNS TLDs are simply a proxy for governments" is enough of a disqualifying argument when several governments or even large corporations have implicitly trusted CAs in widespread use. I think it's useful to have another choice of validated data to cross-check with. Perhaps you are worried that it would de facto replace the existing corporate-managed PKI with a government-managed one entirely? I also think that what another commenter mentioned, that you have a choice in governments (and could theoretically publish your signed certificate data in multiple zones, controlled by multiple different governments) is an extremely beneficial set of possibilities. Multiple-TLD-publishing is certainly a better system than the attempts at public-key pinning and observatories/transparency we've seen as attempts to solve the "anyone can issue for any domain" problem as it stands. ...unless, of course, the root zone KSKs get stolen. Then all the TLD zones are unsafe. :)
- alwillis 7y ago
  “today I count 1,815,489 domains with correct SMTP DANE TLSA records at every primary MX host that accepts connections.” https://mail.sys4.de/pipermail/dane-users/2020-February/000548.html https://mail.sys4.de/pipermail/dane-users/2020-February/0005... BTW: the US is #2 in the world in terms of DANE-enabled email hosts.

tialaramex 7y ago

Before I critique it, I should point out for those at home that Hanno's position here is absolutely the conventional position, lots of important smart people will tell you Hanno is right about this, not just a few kooks. If it's important to you to have popular opinions about such topics - rather than thinking about it on your own - this is the "correct" opinion to have. Now, having explained that, I'm sure it's quite wrong after spending many years thinking about this (more than 10 years but probably less than 20) and I'll try to briefly explain why. The DNS is a key source of truth, and so we need to actually secure the DNS hierarchy. Because of the belief Hanno espouses, there have been a lot of attempts to dodge this work over the years but it's the nature of the problem that dodging it can't work, it just moves the problem and then we're back again from a different angle. DNSSEC is narrowly tailored to solve only the problem we actually had, securing the source of truth, and nothing else. It isn't a privacy technology, or an anti-censorship technology, or a delicious new flavour of ice cream, it just secures the source of truth. The thing about security is that the Happy Path looks exactly the same whether you have security or not. You've all been here with HTTP. Remember when most sites you visited either didn't use HTTPS or only used it for a "login" step and then kicked you back to HTTP? How often did a site you visited actually have a breach because it used HTTP? Probably never. The happy path, where nobody was trying to steal your credentials or whatever was nearly always the path you were on anyway, HTTP was dangerous but you didn't really feel it. In hindsight that seems crazy but people put up with it for years. For DNS we're still in that dark period, and unfortunately lots of people are wrongly confident that it's for the best.

akerl_ 7y ago
I think is a pretty rough mischaracterization to say “lots of people are wrongly confident that it’s for the best [that we stay in that ‘dark period’]”. Speaking as one of those “people”, I’m confident that DNSSEC doesn’t meaningfully improve the security of DNS. The root of trust for DNSSEC is TLD operators, who are in many cases direct subsidiaries of governments and in other cases are effectively controlled by governments, and it uses woefully outdated crypto to provide the chain of trust. And the failure more for when anything goes wrong is that your site drops off the internet at the DNS resolution step, which is pretty gnarly. I’d be happy for a proposal that aimed to improve the threat model for network connections, but DNSSEC does not do that.