3 ms·

and it uses woefully outdated crypto to provide the chain of trust Turns out DNSSEC supports the modern algorithms you could want, including ECDSA P-256 and P-

and it uses woefully outdated crypto to provide the chain of trust Turns out DNSSEC supports the modern algorithms you could want, including ECDSA P-256 and P-384. Most validating resolvers support ED25519 as well. Using P-256 creates smaller signatures and enables DNSSEC lookups to fit within the original DNS packet size of 512 bytes. It also turns out that Cloudflare's Universal DNSSEC has supported ECDSA P-256 since 2015; as a percentage of implementation, more DNSSEC users are using fast, modern crypto than not. And it turns out that the old, crappy algorithms are being deprecated and the DNSSEC eco-system is being updated to not sign zones using them or validate them: https://www.isc.org/docs/matthijs-mekking-oarc30-unsupported-algorithms.pdf https://www.isc.org/docs/matthijs-mekking-oarc30-unsupported... I'm sure there are TLDs and ccTLDs using older algorithms, but as a zone operator, you can use the latest, greatest crypto. And because operational guidelines suggest rolling Zone Signing Keys (and Key Signing Keys) regularly, everyone will be on the latest crypto soon. I just signed a zone I operate using ECDSAP256SHA256 even though the parent zone is using RSASHA1. So DNSSEC's crypto is good and getting better all the time.

akerl_ 7y ago
The crypto is as strong as the weakest link for each domain; if a root or intermediary for my domain is using old crypto, it doesn’t matter what I’m using as the end zone operator.
- alwillis 7y ago
  Regarding outdated crypto, that’s a common DNSSEC trope that’s been debunked: https://easydns.com/blog/2015/08/06/for-dnssec/#weak https://easydns.com/blog/2015/08/06/for-dnssec/#weak
  - tptacek 7y ago
    Not only has it not been "debunked", but DNSSEC's own proponents openly acknowledge that the DNSSEC hierarchy is littered with 1024-bit RSA keys; see the chain-extension fiasco on the TLS working group mailing list. Or, see the stats you yourself posted to this thread a few days ago, which included key breakdowns. Further, despite the fact that DNSSEC uses outmoded P-curve ECC, and that modern signature schemes aren't even implemented for it, curve usage in DNSSEC is a tiny fraction of all keys. The author of this post is simply wrong; what's more, he was wrong five years ago, and the situation has not improved.

akerl_ 7y ago

The crypto is as strong as the weakest link for each domain; if a root or intermediary for my domain is using old crypto, it doesn’t matter what I’m using as the end zone operator.

alwillis 7y ago
Regarding outdated crypto, that’s a common DNSSEC trope that’s been debunked: https://easydns.com/blog/2015/08/06/for-dnssec/#weak https://easydns.com/blog/2015/08/06/for-dnssec/#weak
- tptacek 7y ago
  Not only has it not been "debunked", but DNSSEC's own proponents openly acknowledge that the DNSSEC hierarchy is littered with 1024-bit RSA keys; see the chain-extension fiasco on the TLS working group mailing list. Or, see the stats you yourself posted to this thread a few days ago, which included key breakdowns. Further, despite the fact that DNSSEC uses outmoded P-curve ECC, and that modern signature schemes aren't even implemented for it, curve usage in DNSSEC is a tiny fraction of all keys. The author of this post is simply wrong; what's more, he was wrong five years ago, and the situation has not improved.