4 ms·

> Almost every time anyone mentions DNSSEC here on HN, you pop up like a jack-in-the-box to claim that nobody is using it and that it is dead. And it’s always y

> Almost every time anyone mentions DNSSEC here on HN, you pop up like a jack-in-the-box to claim that nobody is using it and that it is dead. And it’s always you, nobody else. Yup. > You might have some valid criticism about the cryptography; I would not be able to judge that (except when you are basing it on wildly outdated information). Yes—context matters. Unless someone knows the details of how DNSSEC works, they wouldn't necessarily recognize how disingenuous chronic DNSSEC detractors often are. In addition to DANE, I'd also add SSHFP [1], another protocol enabled by DNSSEC that addresses SSH's default trust on first use (TOFU) issue in a pretty straightforward way. Anyone new just has to read "For DNSSEC And Why DANE Is Needed" [2], where the author debunks the talking points that DNSSEC detractors often use. There's often a hint of truth to these talking points but the reality is more nuanced than they would lead you to believe. [1]: https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and-dnssec.html https://www.redpill-linpro.com/techblog/2019/05/06/sshfp-and... [2]: https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...

tptacek 3y ago
I can't think of a less compelling DNSSEC use-case than enrolling your own SSH servers, which strangers on the Internet never log into, into a global PKI. That's a complete mismatch of threat models. Why would you give the United States Government a say in whether you trust your own server? It's your own server! You don't have the problem DNSSEC tries to solve. I don't like trust-on-first-use either. Fortunately, it's easy to solve: just use an SSH CA, which is what most shops with significant numbers of servers do (because it's drastically easier to administer than individual keys). I've never seen this "technitium" blog before. It's very long. If you want to see me pick it apart, submit it tomorrow and see if you can get it on the front page. Very few people are reading this thread, so I'm definitely not going to close-read it just for this.
- alwillis 3y ago
  > Fortunately, it's easy to solve: just use an SSH CA Sure, you could use SSH certificates, but that does mean deploying user certificates to your users and server certificates to your servers, etc. And for some use cases, this would be the right thing to do. Yes, a 10,000 person enterprise with dozens of servers should use SSH certificates. On the other hand, using SSHFP is also a viable solution, depending on the use case. In general, it's less work than creating a SSH CA, signing keys, distributing certificates, etc, especially when SSH certificates would be overkill. On the other hand, with SSHFP, you run ssh-keygen -r examplehost.example.org and add the records to the server's DNS configuration. On the client side, a user adds VerifyHostKeyDNS yes to their OpenSSH configuration and they're done. > Why would you give the United States Government a say in whether you trust your own server? It's your own server! SSHFP records are just the fingerprint of the server's public keys—no 3rd party has a say in the ssh-keygen command generating the records. I just made some SSHFP records—no government involved: SSHFP <KEY-ALGO> <HASH-TYPE> <FINGERPRINT> localhost IN SSHFP 1 1 78aefcdf726dfd71160c8dd9e31b385174da4189 localhost IN SSHFP 1 2 830313e0f1c70de6db7431f22f488e715f5882b7ad82a11bcb0b784fba618cfc localhost IN SSHFP 3 1 8140d1ed33ee45e0d078e1c0ef61df03332eac5c localhost IN SSHFP 3 2 748fdd9a6795626ec4c201cc41fb62c7407227db3e810e1a26d2e0b8cb82e896 localhost IN SSHFP 4 1 c75294aa5909c2dbfcd5606005bc4f2d1ec37ff6 localhost IN SSHFP 4 2 795480afe1777c3438f40bc269c25667cf366ef24c14f264456ff10844b818fb KEY-ALGO Algorithm 0 reserved 1 RSA 2 DSA 3 ECDSA 4 ED25519 5 unassigned 6 ED448 HASH-TYPE Algorithm 0 reserved 1 SHA1 2 SHA256 The role that DNSSEC plays is ensuring that when a SSH client does a DNS lookup, it can trust the DNS reply hasn't been tampered with.
akerl_ 3y ago
Didn't both Chrome and Firefox decline to include DANE support?
- bodgie 3y ago
  Yes however DANE is not just for web use cases.
  - akerl_ 3y ago
    Is there any use case that's actively deployed, where DANE is being used? I tried to look up use cases that exist today, and it seems like it's "people who run their own postfix/exim servers", 2 niche email providers, and... GPG?
    - bodgie 3y ago
      I don't follow DANE but I think support among the mail community is wider than you suggest unless Microsoft Exchange Online is one of the niche email providers you're referring to.

tptacek 3y ago

I can't think of a less compelling DNSSEC use-case than enrolling your own SSH servers, which strangers on the Internet never log into, into a global PKI. That's a complete mismatch of threat models. Why would you give the United States Government a say in whether you trust your own server? It's your own server! You don't have the problem DNSSEC tries to solve. I don't like trust-on-first-use either. Fortunately, it's easy to solve: just use an SSH CA, which is what most shops with significant numbers of servers do (because it's drastically easier to administer than individual keys). I've never seen this "technitium" blog before. It's very long. If you want to see me pick it apart, submit it tomorrow and see if you can get it on the front page. Very few people are reading this thread, so I'm definitely not going to close-read it just for this.

alwillis 3y ago
> Fortunately, it's easy to solve: just use an SSH CA Sure, you could use SSH certificates, but that does mean deploying user certificates to your users and server certificates to your servers, etc. And for some use cases, this would be the right thing to do. Yes, a 10,000 person enterprise with dozens of servers should use SSH certificates. On the other hand, using SSHFP is also a viable solution, depending on the use case. In general, it's less work than creating a SSH CA, signing keys, distributing certificates, etc, especially when SSH certificates would be overkill. On the other hand, with SSHFP, you run ssh-keygen -r examplehost.example.org and add the records to the server's DNS configuration. On the client side, a user adds VerifyHostKeyDNS yes to their OpenSSH configuration and they're done. > Why would you give the United States Government a say in whether you trust your own server? It's your own server! SSHFP records are just the fingerprint of the server's public keys—no 3rd party has a say in the ssh-keygen command generating the records. I just made some SSHFP records—no government involved: SSHFP <KEY-ALGO> <HASH-TYPE> <FINGERPRINT> localhost IN SSHFP 1 1 78aefcdf726dfd71160c8dd9e31b385174da4189 localhost IN SSHFP 1 2 830313e0f1c70de6db7431f22f488e715f5882b7ad82a11bcb0b784fba618cfc localhost IN SSHFP 3 1 8140d1ed33ee45e0d078e1c0ef61df03332eac5c localhost IN SSHFP 3 2 748fdd9a6795626ec4c201cc41fb62c7407227db3e810e1a26d2e0b8cb82e896 localhost IN SSHFP 4 1 c75294aa5909c2dbfcd5606005bc4f2d1ec37ff6 localhost IN SSHFP 4 2 795480afe1777c3438f40bc269c25667cf366ef24c14f264456ff10844b818fb KEY-ALGO Algorithm 0 reserved 1 RSA 2 DSA 3 ECDSA 4 ED25519 5 unassigned 6 ED448 HASH-TYPE Algorithm 0 reserved 1 SHA1 2 SHA256 The role that DNSSEC plays is ensuring that when a SSH client does a DNS lookup, it can trust the DNS reply hasn't been tampered with.

akerl_ 3y ago

Didn't both Chrome and Firefox decline to include DANE support?

bodgie 3y ago
Yes however DANE is not just for web use cases.
- akerl_ 3y ago
  Is there any use case that's actively deployed, where DANE is being used? I tried to look up use cases that exist today, and it seems like it's "people who run their own postfix/exim servers", 2 niche email providers, and... GPG?
  - bodgie 3y ago
    I don't follow DANE but I think support among the mail community is wider than you suggest unless Microsoft Exchange Online is one of the niche email providers you're referring to.