5 ms·

> DANE is even worse than plain-old DNSSEC. For those of you who don't know what it is: DANE allows the DNS to vouch for your certificates. In other words: whoe

by danyork 12y ago

> DANE is even worse than plain-old DNSSEC. For those of you who don't know what it is: DANE allows the DNS to vouch for your certificates. In other words: whoever controls the DNS roots effectively controls your certificates. Please explain to me HOW the person who controls the DNS roots controls my certicate? I take my TLS certificate (either a CA-signed cert or a self-signed cert) and I load either a fingerprint of the cert or the complete cert into a TLSA record in my DNS zone. I then sign that with my DNSSEC key (create an RRSIG record) and publish it in the zone. It's all under my control. (NOTE: For those not familiar with the DANE protocol please see RFC 6698 or resources here: https://www.internetsociety.org/deploy360/resources/dane/ https://www.internetsociety.org/deploy360/resources/dane/ )

MichaelGG 12y ago
The DNS root can alter your records to be whatever they want. Sure, they can already change your MX now and get a CA to sign a new cert by intercepting the email. But a replacement protocol should have much better design goals.
- tptacek 12y ago
  Yes. Just change the word "should" to "MUST".
- danyork 12y ago
  How can the DNS root alter my records? Say my domain is "example.com" and I serve the zone out of my own authoritative DNS server running on my own host. I create a "www" record that I serve out pointing to my site's IP address. Leaving DNSSEC out for a moment, how can the DNS root alter my records? All the DNS root does is provide pointers to the .com authoritative name servers. The .com name servers provide pointers to my example.com name server. My example.com name server serves out the zone data.
  - MichaelGG 12y ago
    I mean the TLD root. Aka the .com registrar.
    - danyork 12y ago
      Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to a controlled web server that wasn't mine. And those false NS records could be modified by the registry (unlikely in the case of .COM but could conceivably be for a ccTLD) or more likely the registrar (after a compromise there).
  - tptacek 12y ago
    I think you're playing a semantic game with the word "alter". The roots can't "alter" your records. They can prevent other people from seeing those records, though, and replace them with an entirely different set of records.
    - danyork 12y ago
      I was not playing a game. I was honestly trying to understand because it didn't make any sense to me. I don't see the actual root of DNS being able to do much at all. If the root tried to give altered NS records for one of the TLDs I believe that would be noticed by many out there. The TLD registries could give altered NS records pointing to a controlled authoritative name server for a domain, and then THAT controlled name server could provide an entirely different set of records. (And they could all be DNSSEC-signed.) But to me this is kind of DNS security 101 - you have to trust your parent zones and you have to trust your registrar. If you think that a TLD registry or registrar could do this kind of change... don't use them.

by danyork 12y ago

MichaelGG 12y ago

The DNS root can alter your records to be whatever they want. Sure, they can already change your MX now and get a CA to sign a new cert by intercepting the email. But a replacement protocol should have much better design goals.

tptacek 12y ago
Yes. Just change the word "should" to "MUST".
danyork 12y ago
How can the DNS root alter my records? Say my domain is "example.com" and I serve the zone out of my own authoritative DNS server running on my own host. I create a "www" record that I serve out pointing to my site's IP address. Leaving DNSSEC out for a moment, how can the DNS root alter my records? All the DNS root does is provide pointers to the .com authoritative name servers. The .com name servers provide pointers to my example.com name server. My example.com name server serves out the zone data.
- MichaelGG 12y ago
  I mean the TLD root. Aka the .com registrar.
  - danyork 12y ago
    Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to a controlled web server that wasn't mine. And those false NS records could be modified by the registry (unlikely in the case of .COM but could conceivably be for a ccTLD) or more likely the registrar (after a compromise there).
- tptacek 12y ago
  I think you're playing a semantic game with the word "alter". The roots can't "alter" your records. They can prevent other people from seeing those records, though, and replace them with an entirely different set of records.
  - danyork 12y ago
    I was not playing a game. I was honestly trying to understand because it didn't make any sense to me. I don't see the actual root of DNS being able to do much at all. If the root tried to give altered NS records for one of the TLDs I believe that would be noticed by many out there. The TLD registries could give altered NS records pointing to a controlled authoritative name server for a domain, and then THAT controlled name server could provide an entirely different set of records. (And they could all be DNSSEC-signed.) But to me this is kind of DNS security 101 - you have to trust your parent zones and you have to trust your registrar. If you think that a TLD registry or registrar could do this kind of change... don't use them.