3 ms·

> I would argue that the re-direct DNSSEC argument is nearly vanishingly small. But it can't be claimed to be zero. Fair enough.. but if you're talking to a MI

> I would argue that the re-direct DNSSEC argument is nearly vanishingly small. But it can't be claimed to be zero. Fair enough.. but if you're talking to a MITM anyway, would you agree that it's game over?

fragmede 12y ago
If the MITM is unable to forge a signature that passes validation, and the browser/whatever complains that the signature is invalid, then the game is not over.
- jamiesonbecker 12y ago
  No signature needed. Just hand out whatever you like for the entire zone. There are several exceptions to the above example. First, if "example.com" does not support DNSSEC, there will be no RRSIG record in the answer and there will not be a DS record for "example.com" in the "com" zone. If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records. Or, it could be a broken security-oblivious name server along the way that stripped the DO flag bit from the query or the RRSIG record from the answer. Or, it could be a configuration error. http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Trust_anchors_and_authentication_chains http://en.wikipedia.org/wiki/Domain_Name_System_Security_Ext...
  - fragmede 12y ago
    If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records. That's the second sentence in your quote which seems to say you can't hand out whatever you like for the entire zone, given that .com and .net and .edu have all been signed since 2011.
    - jamiesonbecker 12y ago
      Right.. check the rest of the thread above (what good is a signature that no one checks ;) )
      - danyork 12y ago
        I agree that signatures are of no value unless validation is done... but please do note that current measurements are showing about 13% of all DNS queries globally are in fact being validated: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating. In the USA, about 23% of all DNS queries are being DNSSEC-validated: http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 So the argument that "no one is checking" is no longer true.
        jamiesonbecker 12y ago
        That's excellent data - didn't realize those stats. Thanks for providing them.

fragmede 12y ago

If the MITM is unable to forge a signature that passes validation, and the browser/whatever complains that the signature is invalid, then the game is not over.

jamiesonbecker 12y ago
No signature needed. Just hand out whatever you like for the entire zone. There are several exceptions to the above example. First, if "example.com" does not support DNSSEC, there will be no RRSIG record in the answer and there will not be a DS record for "example.com" in the "com" zone. If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records. Or, it could be a broken security-oblivious name server along the way that stripped the DO flag bit from the query or the RRSIG record from the answer. Or, it could be a configuration error. http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions#Trust_anchors_and_authentication_chains http://en.wikipedia.org/wiki/Domain_Name_System_Security_Ext...
- fragmede 12y ago
  If there is a DS record for "example.com", but no RRSIG record in the reply, something is wrong and maybe a man in the middle attack is going on, stripping the DNSSEC information and modifying the A records. That's the second sentence in your quote which seems to say you can't hand out whatever you like for the entire zone, given that .com and .net and .edu have all been signed since 2011.
  - jamiesonbecker 12y ago
    Right.. check the rest of the thread above (what good is a signature that no one checks ;) )
    - danyork 12y ago
      I agree that signatures are of no value unless validation is done... but please do note that current measurements are showing about 13% of all DNS queries globally are in fact being validated: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0 http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... If you scroll down that page you'll see higher statistics, such as 70% of all queries being DNSSEC-validated in Sweden, because almost all the ISPs there are now validating. In the USA, about 23% of all DNS queries are being DNSSEC-validated: http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 http://stats.labs.apnic.net/dnssec/US?o=cXAw7x1g0r1 So the argument that "no one is checking" is no longer true.
      - jamiesonbecker 12y ago
        That's excellent data - didn't realize those stats. Thanks for providing them.