4 ms·

The NSA can take any one of their trusted root keys, which I don't think it would be healthy to doubt they are in possession of, and sign a certificate today.

by xorcist 12y ago

The NSA can take any one of their trusted root keys, which I don't think it would be healthy to doubt they are in possession of, and sign a certificate today. With DNSSEC, they'd have to subvert the entire DNS infrastructure, signed from the top all the way down to the particular domain they want to falsify. But it is somehow this infrastructure you wish to label "NSA controlled"?

tptacek 12y ago
What difference does it make whether the program they run to carry out this attack is 100 lines long or 400 lines long? DNSSEC gives NSA and GCHQ this level of control by design. It is a PKI, based on delegations from a root, where the top of the tree is literally controlled by the US and UK governments.
- xorcist 12y ago
  The difference is not in the complexity of the code, but the magnitude of the attack. You would need to subvert every DNS request from a certain client, for the duration of the TTL of all signature points. (Exactly how much harder it is depends on the circumstances, but a travelling target would be even harder than a well known stationary one, even if you control large parts of Internet infrastructure and is willing to use it.) But that's not the point. The only point is that between it and the SSL CA infrastructure, the latter is the one NSA has more control over and a much easier time generating certificates for, so the labelling the former "NSA controlled" is slightly disingenious.
  - tptacek 12y ago
    You don't like the CA system. I don't either. I go farther, and say "it's a very bad idea to replace the CA system with another hierarchical PKI the top of which is controlled be NSA and GCHQ". I'm not sure I understand your rebuttal to that point.
    - xorcist 12y ago
      Because it is not "controlled" by the NSA in any meaningful way (with emphasis on meaningful). Any such argument would be valid for pretty any global PKI system, if the argument is that they control important parts of the Internet infrastructure. The SSL CA system is even more controlled by the NSA as DNSSEC is. DNSSEC is much harder to circumvent than the SSL CA system, no matter how you look at it. So I do not mean to refute that the NSA controls the Internet, the CA system, and DNSSEC (even if I don't believe that's an accurate description). It is simply not a meaningful discussion to have. Even if the NSA can break the Internet, there are other use cases and it still carries great value for everyone.
      - tptacek 12y ago
        It's not controlled by NSA? The largest nodes in the tree are literally controlled by them. The corporations that control the root are domiciled in the US. Google's remedy for misuse of any of those zones is to stop being GOOGLE.COM. This is a silly discussion.
        danyork 12y ago
        > It's not controlled by NSA? The largest nodes in the tree are literally controlled by them. Perhaps I should thank you, Thomas, for continuing to beat this drum... because it shows extremely clearly how we need to educate more people and be MUCH more clear about exactly how the keys at the root of DNSSEC are maintained. If people fully understand the process, and how it was designed to NOT allow attackers in this way, we could spend our time on much more productive discussions. (Granted, documents such as https://www.iana.org/dnssec/icann-dps.txt https://www.iana.org/dnssec/icann-dps.txt do NOT make for friendly reading.) Thank you for pointing out the work that needs to be done.
        tptacek 12y ago
        The idea that process and policy addresses this problem is wishful! By design and by law, the most popular and important TLDs are controlled by governments, and, particularly, the US and UK governments. The most popular generic TLD after COM/NET/ORG is IO, which is controlled by the world's most unhinged signals intelligence agency. You are advocating for a PKI that is literally shrink-wrapped around government-controlled namespaces. For a security protocol on the global Internet, that's an utterly unforced error. It boggles my mind that anyone had ever considered it, and I am thankful that it is a dead letter now.

by xorcist 12y ago

tptacek 12y ago

What difference does it make whether the program they run to carry out this attack is 100 lines long or 400 lines long? DNSSEC gives NSA and GCHQ this level of control by design. It is a PKI, based on delegations from a root, where the top of the tree is literally controlled by the US and UK governments.

xorcist 12y ago
The difference is not in the complexity of the code, but the magnitude of the attack. You would need to subvert every DNS request from a certain client, for the duration of the TTL of all signature points. (Exactly how much harder it is depends on the circumstances, but a travelling target would be even harder than a well known stationary one, even if you control large parts of Internet infrastructure and is willing to use it.) But that's not the point. The only point is that between it and the SSL CA infrastructure, the latter is the one NSA has more control over and a much easier time generating certificates for, so the labelling the former "NSA controlled" is slightly disingenious.
- tptacek 12y ago
  You don't like the CA system. I don't either. I go farther, and say "it's a very bad idea to replace the CA system with another hierarchical PKI the top of which is controlled be NSA and GCHQ". I'm not sure I understand your rebuttal to that point.
  - xorcist 12y ago
    Because it is not "controlled" by the NSA in any meaningful way (with emphasis on meaningful). Any such argument would be valid for pretty any global PKI system, if the argument is that they control important parts of the Internet infrastructure. The SSL CA system is even more controlled by the NSA as DNSSEC is. DNSSEC is much harder to circumvent than the SSL CA system, no matter how you look at it. So I do not mean to refute that the NSA controls the Internet, the CA system, and DNSSEC (even if I don't believe that's an accurate description). It is simply not a meaningful discussion to have. Even if the NSA can break the Internet, there are other use cases and it still carries great value for everyone.
    - tptacek 12y ago
      It's not controlled by NSA? The largest nodes in the tree are literally controlled by them. The corporations that control the root are domiciled in the US. Google's remedy for misuse of any of those zones is to stop being GOOGLE.COM. This is a silly discussion.
      - danyork 12y ago
        > It's not controlled by NSA? The largest nodes in the tree are literally controlled by them. Perhaps I should thank you, Thomas, for continuing to beat this drum... because it shows extremely clearly how we need to educate more people and be MUCH more clear about exactly how the keys at the root of DNSSEC are maintained. If people fully understand the process, and how it was designed to NOT allow attackers in this way, we could spend our time on much more productive discussions. (Granted, documents such as https://www.iana.org/dnssec/icann-dps.txt https://www.iana.org/dnssec/icann-dps.txt do NOT make for friendly reading.) Thank you for pointing out the work that needs to be done.
        tptacek 12y ago
        The idea that process and policy addresses this problem is wishful! By design and by law, the most popular and important TLDs are controlled by governments, and, particularly, the US and UK governments. The most popular generic TLD after COM/NET/ORG is IO, which is controlled by the world's most unhinged signals intelligence agency. You are advocating for a PKI that is literally shrink-wrapped around government-controlled namespaces. For a security protocol on the global Internet, that's an utterly unforced error. It boggles my mind that anyone had ever considered it, and I am thankful that it is a dead letter now.