3 ms·

> This is a common tactic among DNSSEC advocates. Hmm... as a "DNSSEC advocate", I can say that I've never dismissed the lack of last-mile security as a "straw

• tptacek 12y ago
  A protocol already exists that does a significantly better job both of providing query integrity and confidentiality on the "last mile" for DNS: it's DNSCurve. DNSSEC on the other hand is almost perfectly unsuited for last mile security, requiring as it does every enabled resolver to act as it's own fully recursive cache. DNSSEC almost petulantly fails to provide confidentiality, too. 2014 advocacy for DNSSEC seems to me like distilled sunk-cost fallacy. It sucks that people spent 2 entire decades working on this protocol (most of the design is still traceable to TIS!), but they did, and it didn't work out, and now they should move on. The manifold weaknesses of DNSSEC are completely unnecessary. The protocol has no meaningful deployment. Inflicting it on the internet in 2014 would be a grave and unforced error. Do better.
  • danyork 12y ago
    Thomas, DNSSEC has nothing to do with last-mile security, nor does it have anything to do with confidentiality. You know that. Neither of those is the problem DNSSEC solves. > 2014 advocacy for DNSSEC seems to me like distilled sunk-cost fallacy. 2014 advocacy for DNSSEC is merely a continuation of advocacy that has been going on for years now. The root zone of DNS was only signed 4 years ago. It's taken those 4 years to get almost all the gTLDs signed and 2/3rds of the ccTLDs signed. It's taken those years to get the DNSSEC-related tools to the point where the configuration and deployment is as simple as it is now. It's taken those 4 years to get the pieces in place where it can work well... and there's still more work to do. > The manifold weaknesses of DNSSEC are completely unnecessary. The protocol has no meaningful deployment. I've quoted many deployment statistics in other parts of this thread. You dismiss them. That is your right. But to say it has "no meaningful deployment" is to dismiss the great amount of work that has happened all over the world by developers and network operators who DO see DNSSEC as something useful. To go back to one I've quoted here - there are 18 million Comcast customers in the USA that have all of their DNS queries validated by DNSSEC. To me that is a meaningful deployment. > Inflicting it on the internet in 2014 would be a grave and unforced error. Do better. We are doing better. In the view of myself and many others, DNSSEC makes the Internet more secure. We're implementing it. We're deploying it. If you've got a better idea bring it to the IETF and lets have the debate in the standards mailing lists.
    • tptacek 12y ago
      I agree that DNSSEC has nothing to do with last-mile DNS security! Where we differ is that you don't seem to care that it doesn't, whereas I am completely bewildered by the idea that anybody could advocate investing tens of millions of dollars into a forklift upgrade of DNS infrastructure that would solidify government control of Internet privacy without doing anything to solve the most urgent problem with the DNS --- if there is an urgent problem with the DNS at all, which is debatable. The root zone of DNS was signed 4 years ago, but the DNSSEC protocol has been under development since the early nineties, back when the forum for discussing it was dns-security@tis.com. That's approximately how long I've been following DNS security. The record names changed during the typecode roll in 2003, but if you blur your eyes, DNSKEY, RRSIG, and NSEC are just KEY, SIG, and NXT, and the core DNSSEC protocol --- authenticated denial, offline signing, no confidentiality --- is the same as the one TIS worked on under US federal government contract back in 1994. I'm not simply "dismissing" the statistics you're providing. I'm challenging them. One US provider runs a DNSSEC-compatible resolver system. So what? Google DNS enabled DNSSEC years ago. You're talking about decisions that perhaps tens of people at those companies made and executed. So a cabal of hobbyists enabled DNSSEC at Comcast. What percentage of DNS queries at Comcast return DNSSEC-authenticated names? I don't know, but I'll put money on my guess: an infinitesimal fraction, because DNSSEC isn't deployed across the Internet. DNSSEC makes the Internet less secure. It's a government contract that morphed into a standards committee boondoggle --- don't take my word for that, just read any of the mid-2000s Vixie mails to namedroppers begging the group to just please standardize something --- that has been beset for two decades by grievous technical flaws, ranging from the delegation signer debacle through the Unix-password-file-cracking NSEC3 scheme. It hands control over a critical piece of security infrastructure to world governments. It does all this without solving the most important DNS security flaws. Meanwhile, those of us who work in security can't help but notice that despite the lack of any DNS security over and above randomized source ports and query IDs, the Internet is not falling apart... because it's been designed and built over the last 15 years not to rely on the DNS for security. It's taken two decades to get to this point because signing individual DNS records and treating zones as the fount of all truth on the Internet is the wrong design. There is too much data in the DNS to boil the ocean and sign every record individually, and even if you could, if the last 10 years have taught us anything at all, it's that Internet trust doesn't work like a tree with a single root. Global hierarchical PKI is dead. Let it rest in peace.