4 ms·

> I'm sorry, but I'm going to have to point out that your comment doesn't respond to mine in any way. Hmmm... you said " you need to have a ready response to t

by danyork 12y ago

> I'm sorry, but I'm going to have to point out that your comment doesn't respond to mine in any way. Hmmm... you said " you need to have a ready response to the extremely obvious observation that the Internet seems to function pretty OK without DNS security " I gave you one example. Here are some more: - There are now over 800 XMPP servers with DNSSEC-signed SRV records that can be used to ensure they are talking to the correct servers. https://xmpp.net/reports.php#dnssecsrv https://xmpp.net/reports.php#dnssecsrv - On a related note, there are over 300 XMPP servers using DANE to provide a higher level of trust to TLS certs: https://xmpp.net/reports.php#dnssecdane https://xmpp.net/reports.php#dnssecdane - There are now over 1,000 email servers using TLSA records (DANE) to provide a higher level of security to the TLS connections between email servers. (Viktor Dukhovni of exim) These are very real cases where adding DNSSEC is, to me, increasing the security of DNS. Because I'm around examples like these, I see value in securing the DNS. So to me, "doing nothing" is not an option.

tptacek 12y ago
Wait. The one place you suggest DNSSEC is adding security value is small servers for an unencrypted insecure messaging service: that is to say, the one place where NSA's almost total ability to manipulate the DNS would (a) most likely go completely undetected and (b) transparently cough up chat transcripts from private message sessions. And one of the ways you suggest it could help is to allow clients to override TLS certificates and instead trust the government-controlled DNS. That is an amazing concession.
- schoen 12y ago
  Cert scanning projects and Certificate Transparency (edit: and pinning) may reverse this calculus or may already have reversed it, but of course the TLS certificates are commonly being issued on the strength of what unauthenticated DNS records said at the time of issuance. Adversaries that could tamper with a CA's view of a zone (or a route) at some point could cause cert misissuance, whether or not they could modify the underlying zone contents. The DNS is the underlying evidentiary basis for a substantial number of DV cert issuance events.
  - tptacek 12y ago
    The second paragraph of "Against DNSSEC" addresses this.
- danyork 12y ago
  Not conceding anything... just pointing out some of the use cases today that are interesting. Another one is most of the email service providers in Germany, where DNSSEC / DANE are being seen as ways to have a more secure email environment. The list can go on... > And one of the ways you suggest it could help is to allow clients to override TLS certificates and instead trust the government-controlled DNS. :-) Where did I say override, Thomas? You can, if you wish, use a different trust anchor than the current (broken) CA system, but the beauty of DANE is that it gives you a way to add another layer of trust to existing systems. So you can use a CA-issued TLS cert and put a fingerprint in a TLSA record as an added check during a SMTP transaction. You could also check certs with CT... and if it were HTTP you could do pinning as well. As many layers as you want!

by danyork 12y ago

tptacek 12y ago

Wait. The one place you suggest DNSSEC is adding security value is small servers for an unencrypted insecure messaging service: that is to say, the one place where NSA's almost total ability to manipulate the DNS would (a) most likely go completely undetected and (b) transparently cough up chat transcripts from private message sessions. And one of the ways you suggest it could help is to allow clients to override TLS certificates and instead trust the government-controlled DNS. That is an amazing concession.

schoen 12y ago
Cert scanning projects and Certificate Transparency (edit: and pinning) may reverse this calculus or may already have reversed it, but of course the TLS certificates are commonly being issued on the strength of what unauthenticated DNS records said at the time of issuance. Adversaries that could tamper with a CA's view of a zone (or a route) at some point could cause cert misissuance, whether or not they could modify the underlying zone contents. The DNS is the underlying evidentiary basis for a substantial number of DV cert issuance events.
- tptacek 12y ago
  The second paragraph of "Against DNSSEC" addresses this.
danyork 12y ago
Not conceding anything... just pointing out some of the use cases today that are interesting. Another one is most of the email service providers in Germany, where DNSSEC / DANE are being seen as ways to have a more secure email environment. The list can go on... > And one of the ways you suggest it could help is to allow clients to override TLS certificates and instead trust the government-controlled DNS. :-) Where did I say override, Thomas? You can, if you wish, use a different trust anchor than the current (broken) CA system, but the beauty of DANE is that it gives you a way to add another layer of trust to existing systems. So you can use a CA-issued TLS cert and put a fingerprint in a TLSA record as an added check during a SMTP transaction. You could also check certs with CT... and if it were HTTP you could do pinning as well. As many layers as you want!