Slashdot Mirror
DHS Wants Master Key for DNS
An anonymous reader writes "At an ICANN meeting in Lisbon, the US Department of Homeland Security made it clear that it has requested the master key for the DNS root zone. The key will play an important role in the new DNSSec security extension, because it will make spoofing IP-addresses impossible. By forcing the IANA to hand out a copy of the master key, the US government will be the only institution that is able to spoof IP addresses and be able to break into computers connected to the Internet without much effort. There's a further complication, of course, because even 'if the IANA retains the key ... the US government still reserves the right to oversee ICANN/IANA. If the keys are then handed over to ICANN/IANA, there would be even less of an incentive [for the U.S.] to give up this role as a monitor. As a result, the DHS's demands will probably only heat up the debate about US dominance of the control of Internet resources.'"
This should ( rightly so ) piss off external entities ( ie: foriegn nations ) enough to have them setup alternative roots. And I, for one, will be using those as apposed to the "secure" ones.
Granted, I won't be fully trusting the information from either set, so it's not as if my system security is dependant on it.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
"and be able to break into computers connected to the Internet without much effort"
Didnt know that spoofing an IP what all it took to break into a computer.....
http://www.intellipool.se/ - Intellipool Network Monitor
The truly powerful signing key is for Windows Update. If you have that key, you can take over every Microsoft computer in the world . Change the operating system. Install anything, including a new key. Reboot the machine.
Who has that key? Do we know?
Whoever has both the DNS root key and the Windows Update signing key rules the Internet. Or at least all the Microsoft client systems. They can redirect Windows Update requests to themselves, then download their own update and have it accepted.
Unfortunately, this isn't a joke.
I hope you can understand that no-one else in the world shares even your minimal believe in the US government?
I think this is horrible news, if only because it provides more potential sources for unauthorized personnel to access the key. DHS has no real use for the key, which has as its only purpose the prevention of man-in-the-middle attacks against legitimate websites. DHS has the power to subpoena the owners of those sites for communications details, and terrorists' communications will use other forms of secure handshaking to verify legitimacy if they don't already. The only reason DHS would need these keys is if they wanted the ability to immediately tap into communications w/ legitimate sites, without delaying for a court order or other oversight. Giving them this power would only allow them to fly further out of control.
I gather that information doesn't matter to the OP either. Personally, if some country were to control such information, I'd rather it were someone with a long history of strict neutrality like Switzerland.
However it shouldn't belong to anyone, but be free! Having the keys in the hands of any government is dangerous!
Will they have a choice? Would they do any better?
The problem with all this saber-rattling about "control of the Internet" is that there's just too much economic power involved to arbitrarily change anything. Yes, one can complain about U.S. management of DNS (although the system does work rather well), one can complain about what the U.S. might do with DNS (although we haven't done anything yet) but sometimes, change for the sake of change is dangerous. The impact on world economies if DNS were to suffer any significant or long-lasting disruption would be severe. If any major changes or transfer of control of the Domain Name System ever get made, they'd best be made in the light of technological reality and not the immediate political need to stand up to the U.S. Remember what happened with Verisign and SiteFinder? That was just a taste of what might happen to the network if people start squabbling over the roots and waving their dicks around.
Be careful what you wish for.
The higher the technology, the sharper that two-edged sword.
I hope you can understand that no-one else in the world shares even your minimal belief in the US government?
I fixed your spelling but that's minor. I'm a US citizen, but what in the world ever gave you the idea that we the US people actually believe those jerks inside the beltway? I don't trust any of them. I just hope we can survive as a country till Noon Jan 20, 2009. Regardless of who wins the not too well concealed game of musical chairs, we at least will be rid of one 'born again Christian' and can begin to try to heal the pain and suffering of the legacy he leaves behind. They all say 'Trust me' but they want the keys to the lockbox none-the-less. The modern day version of Jim & Tami Bakker, praise the lord, but send me the money.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Q: How do you keep a moron in suspense?
What are you talking about? How can giving a secret key to a third-party 'secure DNS'. If I am the only one who has a key to my house and I make an additional copy and give it to a third-party, my house is now less secure. Why are you and the article spinning this as a some greater level of security. Your correction about IP vs DNS spoofing is correct.
Right now, Verisign (or any of the widely-trusted X.509/SSL certificate authorities) can generate fake certificates for arbitrary sites, and your ISP can poison the DNS (from your perspective).
Incompetent government employees (or corrupt or foreign governments) are not the only adversaries we need to deal with. DNSSEC, like the current HTTPS trust system, reduces the number of potential attackers, but it doesn't eliminate them all. We know this, and we deal with it by only vesting a limited amount of trust in these systems.
The discussion should not be about whether or not the US DHS specifically should be given access to the keys; The discussion should be about the importance of minimizing the number of points where the system can be attacked: Only those entities who strictly need the keys in order to administer the DNSSEC system should be given access. The DHS doesn't need DNSSEC keys in order to make DNSSEC work, so the DHS should not get the keys. It's as simple as that.
http://outcampaign.org/
If, as a foreign power, your security could be defeated by IP spoofing then, honestly, your security issues are not going to be solved by managing your own root. In fact, if your so inept, then you probably should leave DNS security in the hands of the Russian or Chinese governments because because, frankly, that DNS root of yours is going to be hacked by script kiddies and spammers in no time flat and trash your whole infrastructure impacting your economy. Honestly, having the Chinese or Russian governments spy on you is probably preferable, and their going to do it anyway, root or no root.
... is that better now? All the parent was saying is that any nation whose security is dependent upon a computing resource that is owned and operated by an inimical foreign power is asking for trouble. Whether you consider the United States to be such a foreign power is a separate topic for discussion, and one in which I'm not particularly interested in pursuing.
... we don't own or control the network hardware in your country ... you do.) There are plenty of other things about United States foreign (and domestic!) policies that you could legitimately bitch about (I do, all the time) but our handling of DNS just isn't one of them at this point.
... quite a stretch. Now, if Bush & Co. were to threaten to use our military against any country tried to set up its own Domain Name System or equivalent, you might have a point. You might. But you don't.
There
In any event, I didn't perceive his remarks as being particularly U.S.-centric, although it's popular hereabouts to redirect any commentary about Internet infrastructure into criticisms of U.S. policies. Odd that, of all the various services and protocols that traverse the Internet, we get heat for one that has always been run rather well. We are the ones that have, like it or not, run the roots with more even-handedness than most countries around the world would have. Hell, we even let a bunch of hardline Communist states on board, although none of them seem particularly grateful.
Maybe that bothers you, that you don't really have any valid criticisms of our policies towards "Internet governance". Maybe you'd like to invent some reason to "wrest control of the Internet away from the United States" (whatever that means
China's attitude towards the Internet is one that is, unfortunately, becoming more popular with governments of various stripes. They day will come the people of this planet will wish someone were still managing the global DNS infrastructure with something resembling the United States' largely hands-off approach. Don't count on that though.
God, it sounds like the exact same ideas that the USSR had running puppet governments in the other Soviet States.
I don't know what to do with this one. Comparing 13 or so server banks around the world with a nation that annexed multiple countries by main strength and created a true Empire
The higher the technology, the sharper that two-edged sword.
If it happens to be that way i urge you to eat your words. The internet has many years ago stopped beeing a US military project and has turned around beeing a world-wide communication network, much like the telephone. How would you feel if a remote country could just plug you out?
The whole idea of ICANN as I see it, is to assure that the net works, FOR EVERYONE. And yes, IMO ICANN has made some mistakes, but they pale in comparison to the mistakes that would be made if our government had access to the master keys, and could use the internet as just another weapon, for whatever purpose they might have in mind this week/month/year. That scenario scares me shitless.
The internet has been IMO, the greatest tool ever in terms of understanding our fellow humans. The near instant communications, not between governments who may have an agenda, but between people (who may in fact also have an agenda) has allowed those of us who are willing to learn, to learn what makes the other guy tick. Sadly, we seem to be all too infested with those who not only have an agenda, but are only willing to learn how to use it to their advantage and to hell with everybody else. These are the same individuals/groups/governments that refuse to learn from history, and are therefore doomed to repeat every mistake made over written history, just to see if they can make it work this time around. This is the same bunch who, when it blows up in their faces, always has a ready scapegoat, usually called the other guy...
Besides, we already have the "plug you out" in the form of the RBL, which has been used to unplug an errant domain or country, several times. The point is that this has for the most part, been applied sparingly, and only after repeated warnings to the offending region or country.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The way of the world is to praise dead saints and prosecute live ones.
-- Nathaniel Howe
You know what?
This is one of many cases that show that the US government is really messed up.
They want the keys to something the whole world depends on, and the ability to disrupt it, but deny that to anyone else.
The same goes for the militarization of space: they want to be able to do it, and deny anyone else from doing the same.
The same goes for weapons of mass destruction: they want to keep it, and allow current allies to keep it, yet selectively deny certain current enemies (real or perceived) from having the same.
This double standard, coupled with unilateral actions against the advice and objections of the most of the world, is what makes the current US government so scary.
Indeed this feels like the saying: Gods may do what cattle can't.
Americans can do better than that. You guys used to admired, and yes, envied, but in a good way. The rest of the world looked up to you.
Now this admiration has turned to resentment, and resignation. The rest of the world cannot vote in US presidential elections, yet we are affected by that decision without having a say at all. Sort of like when you rebelled against a king that taxed you without representation.
It is beyond most of the world why you reelected the same administration again, despite of all its short comings, and their continued heavy handed meddling.
The Democrat taking over congress is a good sign.
Please continue to fix this. You indeed can, and you deserve better. The rest of the world deserves better too.
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
"Neutral" doesn't mean "treats everyone fairly"; it means "doesn't treat anyone *more* unfairly than everyone else".
In other words, it's perfectly possible to be neutral *and* an asshole. I'm not saying Switzerland is either (I haven't read up on this), but generally speaking, there is no contradiction between your claims and those of the GP.
butter the donkey