Slashdot Mirror

← Back to Stories (view on slashdot.org)

Working Around Slow US Gov. On DNS Security

Posted by kdawson on from the kicking-the-dragging-feet dept.

alphadogg writes "Last fall, the US government sought comments from industry about how better to secure the Internet by deploying DNSSEC on the root zone. But it hasn't taken action since then. Internet policy experts anticipate further delays because the Obama Administration hasn't appointed a Secretary of Commerce yet, the position that oversees Internet addressing issues. Meanwhile, the Internet engineering community is forging ahead with a stopgap to allow DNSSEC deployment without the DNS root zone being signed. Known as a Trust Anchor Repository, the alternative was announced by ICANN last week and has been in testing since October."

91 comments

  1. DNSSEC overrated by TheLink · · Score: 3, Insightful

    DNSSEC is overrated.

    It's not about security, it's just another way to collect toll on the information superhighway.

    I'm sure the CAs are rubbing their hands in glee.

    They're not only going to collect money for SSL certs for www.yourdomain.com. Now they get to collect money to sign the "yourdomain.com" DNS entry as well.

    And Verisign gets to triple dip if not more.

    --
    1. Re:DNSSEC overrated by KiloByte · · Score: 3, Interesting

      To the contrary, DNSSEC could possibly kill the goldmine that is the SSL cert racket. That is, unless having your DNS entry signed somehow becomes a "value added" service you need to pay for extra.

      I'm a layman here, but glancing at how DNSSEC works, I see no obvious way selectively signing some but not the rest of entries could work. This means, DNSSEC would provide a more secure way to give the public key to a viewer.

      Instead of proving that the server's owner paid a sum to the CA, it would prove that the server's owner has control over the DNS entry.

      If the above is correct, that's a good explanation why we don't have DNSSEC yet -- it would have a potential to kill the CA's income.
      But if there is a way to selectively skip signing certain DNS entries, all your fears would be true.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    2. Re:DNSSEC overrated by Pecisk · · Score: 1

      It is safe to say "DNSSEC suks" in Slashdot and get "Insightful" mod, because, hey, there are many tinydns admins out there :)

      If more serious, DNSSEC has valid criticisms, but this post just reeks flaming.

      --
      user@ubuntubox:~$ stfu This server is going down for shutdown NOW!
    3. Re:DNSSEC overrated by cakefragment · · Score: 3, Informative

      Signed zone data is not reliant on x509 certificates; algorithms defined in RFC 4034 are RSA/MD5, Diffie-Hellman, DSA/SHA-1, Elliptic Curve, RSA/SHA-1, and room for ~245 future algorithms. There is no identity information stored in the keys used for DNSSEC, so you should be able to generate the keys yourself.

    4. Re:DNSSEC overrated by dkf · · Score: 1

      To the contrary, DNSSEC could possibly kill the goldmine that is the SSL cert racket. That is, unless having your DNS entry signed somehow becomes a "value added" service you need to pay for extra.

      SSL also protects against other threats, such as route poisoning and eavesdropping, neither of which are DNS-related threats. To say that DNSSEC replaces all that is just plain wrong.

      If you think that the commercial CAs are running a racket, you don't need to take part. Really. FWIW, I use SSL with a custom CA just fine across some of the servers I look after; we can just distribute the CA certificate manually just fine too, since it is a limited problem space. For your own stuff, that's actually ideal since you've got better control over the trust domain. (If you control the trust root the rest of the SSL system is very good since a lot of people have tried to make it robust.) You only need the CAs when you are communicating with people who don't already know you, and they probably trust the CA more than some random person on the 'net. Mostly that's a good decision for them, given that a fair number of "random persons" are blackhats.

      What I want to know about DNSSEC (and haven't yet found by googling) is whether it is possible to constrain the amount that the root declarations actually have to be trusted. Can they only be limited to stating who the authorities for particular TLDs are? Can we have different CAs signing each of the layers public keys? If that's all that we're trusting them to do, it is probably possible to accept them doing that. (Or at least it beats the current situation.)

      --
      "Little does he know, but there is no 'I' in 'Idiot'!"
    5. Re:DNSSEC overrated by globeviewer · · Score: 1

      Re Verisign. If the US government is sincere about listening to the public, the overwhelming majority of comments were fine with just having ICANN "sign the root" leaving Verisign (0 votes) out of the equation. Listening to the global Internet community would be a big step by the new Administration toward rebuilding America's reputation overseas.

    6. Re:DNSSEC overrated by KiloByte · · Score: 1

      SSL also protects against other threats, such as route poisoning and eavesdropping, neither of which are DNS-related threats.

      No one is talking about replacing SSL. It's about replacing the way you receive the server's public key.

      Currently, the key is provided by the very server you're connecting to, with the only assurance the key is kosher being a signature of a CA on the key. The CAs will happily sign any key if they are paid. In theory, they are supposed to verify the name attached to the key, but that theory has nothing to do with practice.

      If you think that the commercial CAs are running a racket, you don't need to take part.

      Ok, then try using a self-signed certificate. That would be strictly better than plain http... Too bad, suddenly everyone starts getting big scary warnings from web browsers / mail clients / etc.

      FWIW, I use SSL with a custom CA just fine across some of the servers I look after; we can just distribute the CA certificate manually just fine

      After doing this with the company's mail server, I would say this is really an option only for machines you use yourself. Even older programmers needed some handholding for installing the cert. I don't even imagine doing this for accountants or other non-technical folks.

      You only need the CAs when you are communicating with people who don't already know you

      Or, say, your mail or SVN server. You do need to distribute the certs somehow.

      What I want to know about DNSSEC (and haven't yet found by googling) is whether it is possible to constrain the amount that the root declarations actually have to be trusted. Can they only be limited to stating who the authorities for particular TLDs are?

      That's how DNSSEC works. The root cert is used only to validate the keys for .com, .gov, .pl, .uk ... Then, the key for .org will sign slashdot.org, without the root cert having anything to say.

      --
      The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
    7. Re:DNSSEC overrated by Timothy+Brownawell · · Score: 1

      f you think that the commercial CAs are running a racket, you don't need to take part. Really. [...] You only need the CAs when you are communicating with people who don't already know you

      So you do have to take part, because the browser makers have decided that self-signed SSL is deserving of error messages due to being somehow less secure than plain http. Therefore making it a "racket" instead of just a "scam".

    8. Re:DNSSEC overrated by darkpixel2k · · Score: 1

      So you do have to take part, because the browser makers have decided that self-signed SSL is deserving of error messages due to being somehow less secure than plain http. Therefore making it a "racket" instead of just a "scam".

      No, browser makers have decided that certificates not added to their 'trusted' certificate list are deseerving of error messages due to it being the way encrypted communications are supposed to work.

      --
      There's no place like ::1 (I've completed my transition to IPv6)
    9. Re:DNSSEC overrated by darkpixel2k · · Score: 1

      Re Verisign. If the US government is sincere about listening to the public, the overwhelming majority of comments were fine with just having ICANN "sign the root" leaving Verisign (0 votes) out of the equation. Listening to the global Internet community would be a big step by the new Administration toward rebuilding America's reputation overseas.

      As I understand it, the overseas opinion is that Americas 'reputation overseas' was destroyed when that 'crook' Bush 'invaded' Iraq.

      So you're telling me those same nutjobs are suddenly going to forgive America because some low-level dork in a new administration signs the DNS root?

      Note to self: Left-wing nut jobs are even crazier than I thought.

      --
      There's no place like ::1 (I've completed my transition to IPv6)
    10. Re:DNSSEC overrated by profplump · · Score: 1

      No, *encrypted* doesn't mean *authenticated*. The fact that the browsers fail to make this distinction is no excuse for treating encrypted but unauthenticated connections as inferior to connections with neither encryption nor authentication. Having an encrypted, unauthenticated connection is strictly more secure than not using SSL at all -- even in a worst-case scenario when you're subject to a MitM attack, your traffic is still only readable by the attacker, rather than by everyone along the transit path.

      There are two problems here. First, browsers should treat non-encrypted traffic as the special state -- putting up special indicators when the connection is not secure, rather than the status quo of treating SSL-wrapped communications as a special state. I understand why we didn't start with SSL as the default 15 years ago, but we could fix that now. Among other things, this would fix the SSL-strip attacks that have recently been publicized.

      Second, they need to stop treating security as a binary state -- security is not an on/off proposition, nor do all activities require the same level of security, and treating it as such is ultimately detrimental. Yes, users are stupid, but lying to them about the security of their connections is not useful in making them smarter, and it's very limiting to any user that *could* be taught how to evaluate the security of their connection.

    11. Re:DNSSEC overrated by cjb658 · · Score: 1

      f you think that the commercial CAs are running a racket, you don't need to take part. Really. [...] You only need the CAs when you are communicating with people who don't already know you

      So you do have to take part, because the browser makers have decided that self-signed SSL is deserving of error messages due to being somehow less secure than plain http. Therefore making it a "racket" instead of just a "scam".

      It's not a scam. It would just be plain stupid to accept an SSL certificate that was signed by anyone. Just because a site says "Hi, I'm eBay!" doesn't mean that it is. CAs sign the certificate as "proof" that it is really eBay.

    12. Re:DNSSEC overrated by TheLink · · Score: 1

      "That's how DNSSEC works. The root cert is used only to validate the keys for .com, .gov, .pl, .uk ... Then, the key for .org will sign slashdot.org, without the root cert having anything to say."

      OK let's assume the root cert doesn't have anything to say.

      But you should go to the next obvious step/question: How much will the entities holding the .com and .org keys charge for signing cnn.com, slashdot.org and so on?

      Free? Really?

      As I've said, DNSSEC is not about security it's about creating a way to collect money for little/no added value.

      Why do I say no added value?

      1) If you are using https/ssh/ipsec/openvpn properly, and someone spoofs your dns so you attempt to connect to the wrong server, you will get a warning/error. So what is DNSSEC's added value here?

      2) If you don't use SSL or other encryption and someone gets in between you and your server, it really doesn't matter that DNSSEC is giving you the right IP address for your DNS requests.

      3) If you don't care that much about security, but you just want to make it harder for remote attackers to spoof DNS responses (while not being "in the middle"), DNSSEC might work but you are better off using dnscurve which has lower overhead and arguably less vulnerable to DoS attacks from those attackers.

      So someone tell me, what real value does DNSSEC add? For the case of 3) it is an inferior technology.

      --
    13. Re:DNSSEC overrated by John+Hasler · · Score: 1

      > As I understand it, the overseas opinion is that Americas 'reputation overseas' was
      > destroyed when that 'crook' Bush 'invaded' Iraq.

      No. said "reputation" was "destroyed" when Bush was classified as "right wing" (not that they weren't justified in being cautious during the eight years that the White House was occupied by the stupidest man to ever serve as President).

      > So you're telling me those same nutjobs are suddenly going to forgive America because
      > some low-level dork in a new administration signs the DNS root?

      No. They have "forgiven America" because it has elected a president that they classify as "left wing". It doesn't matter what he actually does: note the absence of any outcry over his failure to do anything about torture of prisoners and denial of habeus corpus.

      > Note to self: Left-wing nut jobs are even crazier than I thought.

      "Left wing nuts" are exactly as crazy as "right wing nuts": totally insane.

      --
      Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
    14. Re:DNSSEC overrated by Timothy+Brownawell · · Score: 1

      It's not a scam. It would just be plain stupid to accept an SSL certificate that was signed by anyone. Just because a site says "Hi, I'm eBay!" doesn't mean that it is. CAs sign the certificate as "proof" that it is really eBay.

      No. It would be stupid to give all the special UI cues for a secure site, with an unverified certificate. SSL with an unverified certificate is approximately as secure as plain http with no encryption, and should be treated the same. (And "signed by any random CA, maybe even a different one than last time" should not be the same as "verified", but that's a different stupidity...)

    15. Re:DNSSEC overrated by Timothy+Brownawell · · Score: 1

      But you should go to the next obvious step/question: How much will the entities holding the .com and .org keys charge for signing cnn.com, slashdot.org and so on?

      Presumably, exactly the same amount they currently charge for those domain names. Isn't the idea to make it the standard, so that whenever you buy a domain name you also get whatever signatures/keys/etc you need to be able to make dnssec work on your domains?

      1) If you are using https/ssh/ipsec/openvpn properly, and someone spoofs your dns so you attempt to connect to the wrong server, you will get a warning/error. So what is DNSSEC's added value here?

      Or you'll just get an unencrypted page and no error, and only notice if you're actually paying attention.

      So someone tell me, what real value does DNSSEC add?

      It prevents spoofed DNS responses, even if there is a mitm. This means that you can use DNS for public key distribution (so there's no reason to ever be forced to pay for a "normal" SSL certificate; only the EV ones where they check your real-world identity provide any added value) and probably all sorts of other cool things.

    16. Re:DNSSEC overrated by Anonymous Coward · · Score: 0

      Way, way off topic, but I can't help myself. While I'd agree that Obama Administration should do more about torture and loss of civil rights, a 'failure to do anything' yet is not an accurate statement. He has ordered the closure of Guantanamo and the end of harsh interrogation and secret prisons (and I think did this in the first week of his Presidency). I'll not hold my breath waiting for punishment of the people that reduced the Constitutional protection and safety of U.S. Citizens during the last 8 years (many of whom are still in congress, Repub's and Dem's), but some things have been done to move that line backwards.

    17. Re:DNSSEC overrated by Anonymous Coward · · Score: 0

      NO you dont get it, with the CERT header, you can have SSL without having the cert be signed by some rip of signing company like that bastard Mark Shuttlecock.

    18. Re:DNSSEC overrated by Simetrical · · Score: 1

      I understand why we didn't start with SSL as the default 15 years ago, but we could fix that now.

      Computational costs for SSL are apparently not trivial, from what I've been told. Moreover, any kind of encryption completely kills caching proxies, which are essential to performance for a lot of large sites. Wikipedia uses Squids that can serve 3000 req/s per server easily on cache hits. The reason they can do this is because once the cache entry is located, it's simply a matter of instructing the OS to copy a string of bytes from a memory address to a network port and close the connection. There's no way you could achieve that level of performance if you had to negotiate SSL keys and encrypt the response.

      One solution to the caching problem would be to permit authentication only, with no encryption (like DNSSEC itself, in fact). Then the authenticated response could be served just as efficiently as the unauthenticated response, except that it's somewhat longer. But there's no way to do this at present: SSL permits either both authentication and encryption, or neither.

      --
      MediaWiki developer, Total War Center sysadmin
    19. Re:DNSSEC overrated by Simetrical · · Score: 1

      the White House was occupied by the stupidest man to ever serve as President

      Do you have any concrete evidence to back up this assertion? I'm pretty sure a lot of past presidents have been characterized as idiots by their political opponents. On the other hand, while you might not have to be a genius to get a BA from Yale and an MBA from Harvard, I'd imagine it would be fairly hard if you're genuinely stupid.

      --
      MediaWiki developer, Total War Center sysadmin
    20. Re:DNSSEC overrated by darkpixel2k · · Score: 1

      "Left wing nuts" are exactly as crazy as "right wing nuts": totally insane.

      Yes I am. ;)

      --
      There's no place like ::1 (I've completed my transition to IPv6)
  2. And a good thing too. by Anonymous Coward · · Score: 3, Insightful

    Apart from the certificate trust scam ("trust us, for you give us money"), too many non-us governments (and non-us non-governmental people, natural or otherwise), won't accept a us govt held root. And why should they?

    Yes, arguably a fragmented root it not as good as it should be, but a root held by a single entity, especially one as "trustworthy" as the one with the power to push this through, might, in the long or not so long term, easily cause a plethora of split DNS universes. Which is lots worse.

    It really is too bad that the most vocal people with the technical knowledge to understand the impact choose to ignore the politics involved. Yes, smart move people, that will make the issues go away real good.

    1. Re:And a good thing too. by Anonymous Coward · · Score: 0

      I think a fragmented root is ideal, as long as its clear who you are trusting i would rather have the EU sign off on some, US on others, Russia/china on theirs, there is no need to get everything signed by the US (in fact politically AND technically it is a much worse solution).

    2. Re:And a good thing too. by Timothy+Brownawell · · Score: 1

      I think a fragmented root is ideal, as long as its clear who you are trusting i would rather have the EU sign off on some, US on others, Russia/china on theirs, there is no need to get everything signed by the US (in fact politically AND technically it is a much worse solution).

      Is there some reason they can't just put multiple signatures on the records, so the US, Russia, China, etc, could all sign the entire root if they wanted to?

  3. Use DNSCurve by dermoth666 · · Score: 5, Interesting

    DNSSEC rely on having a central "trusted" authority to sign all the dns keys. Not even speaking about the inherent security issues with this model, that means that everyone will depend on a single authority for name resolutions (sure Network Solutions loves this)

    DNSCurve is a much better solution in that it offers a trust system without the need of a central authority. The key is embedded in the DNS name server (NS) hostnames which are always returned by the upper level name server.

    See http://dnscurve.org/index.html

    1. Re:Use DNSCurve by wayne · · Score: 1

      DNSCurve is interesting technology, but it has many problems, not the least of which is that it is mostly hype right now. It does not really replace DNSSEC in functionality, but rather, it is closer to TSIG. That is, instead of securing the actual DNS records, it secures the communication between name servers and resolvers. With DNSSEC, you can get your DNS records for a totally untrustworthy server, and yet be able to prove if they are valid or not, but there isn't any form of encryption so there isn't any privacy. DNSCurve encrypts the transactions, but you can often figure out what is there anyway by watching which name servers you are contacting and monitoring other things to figure out what you were looking up. I like DNSCurve, I hope it goes some where, but I also hope that DNSSEC takes off soon.

      --
      SPF support for most open source mail servers can be found at libspf2.
    2. Re:Use DNSCurve by jonaskoelker · · Score: 1

      DNSSEC rely on having a central "trusted" authority to sign all the dns keys. [...] that means that everyone will depend on a single authority for name resolutions

      Uhm... No?

      The root key signs the ".org" key, the .org key signs the "slashdot.org" key, etc. Unless the owner of the root key and the .org key is one and the same, you don't have the root controlling whether slashdot can get signed, and you don't have .org controlling whether .com can get signed (and what can get signed under .com).

      DNSCurve is a much better solution in that it offers a trust system without the need of a central authority. The key is embedded in the DNS name server (NS) hostnames which are always returned by the upper level name server.

      Uhmm... so in DNSCurve you don't need to trust the root? Also, DNSCurve offers integrity of the communication, not integrity of the data. That means if I'm the MITM between you and your DNS resolver, assuming you don't connect to the resolver in a secure manner, I can still spoof all the DNS data I want to. That's not possible when the data is signed (or at least it appears to be equivalent to the problem of breaking the cryptography).

      At least, this is how I understand it. I welcome any corrections :)

    3. Re:Use DNSCurve by dermoth666 · · Score: 2, Interesting

      Trust is the same for DNSSEc, it's just that instead of using the root servers as a trust chain, you use a 3rd party that every domain owners had to pay for.

      I hardly doubt many institutions will actually pay for signing their zones. o me it's more DNSSEC which is a hype and I'm under the impression many people pushing for it just don't know the implications (they just want to secure DNS).

      DNSCurve is much easier to implement than DNSSEC and and also advantages in term of cryptography speed and increase of traffic.

    4. Re:Use DNSCurve by dermoth666 · · Score: 1

      DNSSEC rely on having a central "trusted" authority to sign all the dns keys. [...] that means that everyone will depend on a single authority for name resolutions

      Uhm... No?

      The root key signs the ".org" key, the .org key signs the "slashdot.org" key, etc. Unless the owner of the root key and the .org key is one and the same, you don't have the root controlling whether slashdot can get signed, and you don't have .org controlling whether .com can get signed (and what can get signed under .com).

      Go back to the specs. Every keys has to be signed by Network Solutions, and you must update your signatures every 3 month. If you have >100 domains to manage you sure can understand the pain :)

      DNSCurve is a much better solution in that it offers a trust system without the need of a central authority. The key is embedded in the DNS name server (NS) hostnames which are always returned by the upper level name server.

      Uhmm... so in DNSCurve you don't need to trust the root? Also, DNSCurve offers integrity of the communication, not integrity of the data. That means if I'm the MITM between you and your DNS resolver, assuming you don't connect to the resolver in a secure manner, I can still spoof all the DNS data I want to. That's not possible when the data is signed (or at least it appears to be equivalent to the problem of breaking the cryptography).

      At least, this is how I understand it. I welcome any corrections :)

      DNSCurve is a trust chain. You have to trust the root and every server in-between to guarantee integrity. Once implemented from the root to the final authoritative server the trust is complete. It doesn't require any modification to registrar interfaces to managing it though, as all you need is to change your NS hostname (which embeds the DNSCurve key).

    5. Re:Use DNSCurve by wayne · · Score: 1

      Trust is the same for DNSSEc, it's just that instead of using the root servers as a trust chain, you use a 3rd party that every domain owners had to pay for.

      DNSCurve does not require you to pay any third parties, it is like DNSSEC where you publish your own information. Both technologies are (or in the case of DNSCurve, will be) free.

      DNSCurve is much easier to implement than DNSSEC and and also advantages in term of cryptography speed and increase of traffic.

      DNSSEC has many years of actual deployment, not as wide spread as it needs to be, but it has been out there and tested.

      Can you point me to a single implementation of DNSCurve? Can you even point me to a specification of what exactly it is? I've looked, and the best that I can tell, there aren't any. More over, it doesn't appear that DJB's website has been updated since he proposed DNSCurve last year.

      --
      SPF support for most open source mail servers can be found at libspf2.
    6. Re:Use DNSCurve by dermoth666 · · Score: 1

      DNSSEC has many years of actual deployment, not as wide spread as it needs to be, but it has been out there and tested.

      Can you point me to a single implementation of DNSCurve? Can you even point me to a specification of what exactly it is? I've looked, and the best that I can tell, there aren't any. More over, it doesn't appear that DJB's website has been updated since he proposed DNSCurve last year.

      From the namedroppers mailing list (IETF) there have been report of independently built client and server implementing DNSCurve. I alto trust Daniel J. Bernstein to update tinydns & dnscache as required if it gets adopted. Note that Microsft and Apple, who both have a good share of DNS servers out there, do not have a DNSSEC implementation yet.

      The implementation is also much simpler than DNSSEC.

    7. Re:Use DNSCurve by dermoth666 · · Score: 1

      Every keys has to be signed by Network Solutions, and you must update your signatures every 3 month.

      Well, actually it seems that I relied on confusing information - the truth is that the domain owner has to sign it, it just happens that Network Solutions will be the one signing all .com's and probably a bunch of other ones.

    8. Re:Use DNSCurve by MikeBabcock · · Score: 1

      According to their site, it would be possible to just put a DNSCurve cache in front of your authoritative DNS server and not need to change the latter at all.

      --
      - Michael T. Babcock (Yes, I blog)
    9. Re:Use DNSCurve by TheLink · · Score: 1

      So "only" the people with .com domains will have to depend on the .com authority to sign their domains?
      And "only" the people with .org domains will have to depend on the .org authority?

      Is that really such a big improvement in practice compared to one root authority?

      How much do you think they will charge to sign .com domains?

      If the technology is really independent from all that "trusted authority signing" stuff, then it will necessarily also be vulnerable to MITM (and spoofing) attacks, unless the client has got the key via other means. Because the attacker can then supply his alternatives and the client can't tell.

      Say you really care about security and so use https/ipsec, if someone spoofs DNS responses to you and you connect to the wrong IP, you will get an error or a warning. You don't need DNSSEC to protect you in that case.

      If you don't care that much about security, you might as well use dnscurve since it has lower overheads.

      --
    10. Re:Use DNSCurve by Anonymous Coward · · Score: 0
      From http://dnscurve.org/dnssec.html:

      DNSCurve and DNSSEC have complementary security goals. If both were widely deployed then each one would provide some security that the other does not provide.

    11. Re:Use DNSCurve by Anonymous Coward · · Score: 0

      DNSSEC rely on having a central "trusted" authority to sign all the dns keys. Not even speaking about the inherent security issues with this model, that means that everyone will depend on a single authority for name resolutions (sure Network Solutions loves this)

      Not quite. The "root key" will sign the root zone, and all the delegations for the TLDs (.com, .org, .ca, .uk, .gov, etc.)

      The TLDs will then sign anything below them. So the .com key will sign the delegation to google.com, and the .org key will sign the delegation to slashdot.org.

      It will be then be up to each organization to sign their own records, and possibly delegate any sub-domains.

      Basically it's one large set up of PGP key-sign and webs of trust.

      While DNSCurve sounds interesting (like a lot of Bernstein's stuff), besides his software, what uses it?

    12. Re:Use DNSCurve by dermoth666 · · Score: 1

      Not quite. The "root key" will sign the root zone, and all the delegations for the TLDs (.com, .org, .ca, .uk, .gov, etc.)

      The TLDs will then sign anything below them. So the .com key will sign the delegation to google.com, and the .org key will sign the delegation to slashdot.org.

      It will be then be up to each organization to sign their own records, and possibly delegate any sub-domains.

      Basically it's one large set up of PGP key-sign and webs of trust.

      True. I've been a bit mislead... There's still a whole lot of domains that will be signed by network solutions though.

      While DNSCurve sounds interesting (like a lot of Bernstein's stuff), besides his software, what uses it?

      Actually his software does not even implement this yet (I guess he's looking to see if it gets traction from the rest of the world first). Besides, I read on an IETF list about people who independently wrote a client and server implementations. It is simpler to implement than DNSSEC in many aspects too.

  4. Working around government? by Runaway1956 · · Score: 0

    If we had waited on Washington D.C. to produce the automobile, we would STILL be looking at the Edsel as a premium automobile. It isn't the business of government to push new technology. Crazy world we live in.

    --
    "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    1. Re:Working around government? by characterZer0 · · Score: 2, Insightful

      I think Washington would still be protecting the horse breeders and the stable hand union.

      --
      Go green: turn off your refrigerator.
    2. Re:Working around government? by AlHunt · · Score: 1

      I'd argue that one function of government is to fund and/or conduct research that wouldn't be economically viable in a for-profit organization. The space programs contributions to technology have already been well cataloged on slashdot and elsewhere.

      --
      1 in 4 Maine children in struggle with hunger.
    3. Re:Working around government? by commodore64_love · · Score: 1

      Yes and those NASA-based advances only cost us 1 trillion dollars! What a bargain. Oh wait. No. Had those advances been developed privately, like velcro, they'd only cost 1/100th as much. The Market with its competitive natural selection and cost-cutting mechanism ("invisible hand") is naturally more efficient than politicians.

      As for cars:

      Well we saw what the government can produce. East Germany's government produced the 2-cycle Trabant, which you can smell coming a mile away, and that still used 50s technology in 1990, with massively-long waiting lists (years). Meanwhile the free market in West Germany produced more cars than I can name, with continual constant improvement, and no need to wait to get one.

      East versus West Germany is a perfect example of government-provided service versus market-provided service. The former is far inferior to the latter, and the former only offers ONE choice whereas the latter offers many choices, thereby putting the power in the hands of the people, not the politicians.

      --
      "I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
    4. Re:Working around government? by HungryHobo · · Score: 1

      On the other hand- US healthcare VS UK NHS
      Somehow the US private healthcare is vastly more costly per person per year and worse at actually treating people who are sick.

      Yes for the majority of things private enterprise is better at providing it (as in the case of tfa) but it isn't always the case.

      Not perfect but if it's something people can want and then save up to afford it then private enterprise works great.

      I want Xbox,I don't have the money,I work hard, I save up, I buy it.

      On the other hand if part of that chain falls out...

      I get sick, I don't have the money, I need healthcare, I work hard... wait I'm sick and can't work... I die.

      I want education for my kids,I don't have the money, I work hard but I'm not educated so my labour is worth little, hence I can't save up much, my kids get a crappy education, end up in the exact same position.

    5. Re:Working around government? by HungryHobo · · Score: 1

      Honestly I think that it would have made more sense to leave space alone until tech reached a point where private enterprise could get there profitably but there was that whole international pissing contest.

      On the upside it gave a generation an interest in science.

      And there are sometimes things which while not profitable are still worth doing like certain kinds of research.

    6. Re:Working around government? by Anonymous Coward · · Score: 0

      but, did you get the xbox? If so, can I have it when you're dead?

    7. Re:Working around government? by Anonymous Coward · · Score: 0

      http://en.wikipedia.org/wiki/Internet#History

    8. Re:Working around government? by profplump · · Score: 1

      It's only worse at treating people that a sick AND poor. Rich sick people seem to have no complaints. Heck, the US seems to *import* rich sick people, which suggests the system is actually pretty good at caring for sick people, at least if they can afford it.

  5. More on this, at 11 by dmneoblade · · Score: 5, Insightful

    In other news, the Internet is seeing the government as damage and routing around it.

    --
    Warning, knife is sharp. Please keep out of children.
    1. Re:More on this, at 11 by Anonymous Coward · · Score: 0

      And to think just yesterday, this was modded funny.

      Someone go back in time and add a "+1, prophetic" mod.

  6. Good.... by Manip · · Score: 1

    Maybe the US Gov. is wise to slow the deployment of DNSSEC. The current design of DNSSEC basically lays out your entire catalogue of DNA entries for anyone to lookup.

    Now nobody wants security though obscurity but at the same time nobody wants to give the bad guys a long list of potential targets or a network diagram.

    While several solutions to this issue have been suggested most of them flat out fly in the face of how DNSSEC is designed to work.

    1. Re:Good.... by cakefragment · · Score: 1

      http://tools.ietf.org/html/rfc5155

    2. Re:Good.... by profplump · · Score: 1

      I want security through obscurity.

      I don't want to rely on obscurity exclusively, but it's certainly a valuable security tool I wouldn't want to give up unnecessarily.

    3. Re:Good.... by Fnord666 · · Score: 1

      basically lays out your entire catalogue of DNA entries for anyone to lookup.

      Now that was certainly an interesting typo.

      --
      'The tyrant will always find pretext for his tyranny.' - Aesop's Fables
  7. I got a idea! by Anonymous Coward · · Score: 0

    Ask them to team up with DJB, that would be a winning team... or?

    1. Re:I got a idea! by Anonymous Coward · · Score: 0

      Only if they can get DJB's head out of his own ass.

  8. I disagree by Anonymous Coward · · Score: 0

    I think that the intranet shoulod be FREE. That is why everyone uses it because it is not like the things that are expensive like some overpriced whore who doesn't speak fRENCH. If anyone would care to accept my MARRIAGE PROPOSAL please contact me via the Wporld Wide Web, I am here poften.

  9. internet minister? by Anonymous Coward · · Score: 0

    what abt internet minister ?? i heared that obama appointed a separate minister for internet???

  10. DNSSEC is a good subsitute for paid-for CERTs by wayne · · Score: 4, Informative

    To the contrary, DNSSEC could possibly kill the goldmine that is the SSL cert racket. That is, unless having your DNS entry signed somehow becomes a "value added" service you need to pay for extra. I'm a layman here, but glancing at how DNSSEC works, I see no obvious way selectively signing some but not the rest of entries could work. This means, DNSSEC would provide a more secure way to give the public key to a viewer.

    You may be a layman, but you appear to have far more clue about this stuff than most. Yes, once DNSSEC is deployed, anyone with a domain name can publish CERT records and have about the same security as a paid-for CERT. Granted the cert authorities right now require you to give your name and address and such, which publishing CERT records in the DNS won't require so they aren't exactly the same, but close enough considering how little checking the cert authorities do on such information

    --
    SPF support for most open source mail servers can be found at libspf2.
    1. Re:DNSSEC is a good subsitute for paid-for CERTs by commodore64_love · · Score: 0, Offtopic

      Acronyms confuse me.

      >>>it's just another way to collect toll on the information superhighway. I'm sure the CAs are rubbing their hands in glee.

      Say what? CAs?

      >>>DNSSEC could possibly kill the goldmine that is the SSL cert racket

      DNSSEC? SSL?

      >>>once DNSSEC is deployed, anyone with a domain name can publish CERT records

      CERT? IRL? AFK? LOL? What? I understood the word "toll" and it struck fear into my heart, but the rest of what ye are saying is incomprehensible to my tiny little brain. Please use real English not L33T-speak. Thank ye.

      L8r

      --
      "I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
    2. Re:DNSSEC is a good subsitute for paid-for CERTs by sakdoctor · · Score: 1

      Get with the program, these are not obscure acronyms by a long shot.

      CA = Certification authority
      SSL = Secure socket layer
      DNSSEC = Domain Name System Security Extensions
      Cert = Certificate. The leaf nodes of the "chain of trust"

    3. Re:DNSSEC is a good subsitute for paid-for CERTs by Anonymous Coward · · Score: 0

      SSL is the "secure socket layer", a protocol for authenticating and encrypting network connections. The encryption prevents passive eavesdropping. Authentication prevents so-called man-in-the-middle attacks, where an attacker presents himself as the other party to both communication endpoints. This allows him to decrypt the information and by relaying it to the other party, he remains undetected. SSL uses certificates to identify the true communication endpoints. The public key is part of the certificate, the private key is kept secret by the certificate owner. When the connection is established, only the owner of the certificate can prove that he has the matching private key. A man in the middle can not present himself as the certificate owner, so he can't attack the connection. The problem with all public key authentication schemes is that the man in the middle can replace the certificate with his own certificate. To prevent that, certificates are "signed." Your computer only trusts certificates signed by one of a number of "certificate authorities", which promise to check the identity of people to whom they issue certificates. DNSSEC is itself a hierarchical trust scheme, so you can be sure that the DNS records you received were indeed published by the domain owner. This theoretically enables the domain owner to publish his SSL certificate as a DNS record, sidestepping the whole SSL certificate authority hierarchy and the associated fees.

    4. Re:DNSSEC is a good subsitute for paid-for CERTs by TheLink · · Score: 1

      "This theoretically enables the domain owner to publish his SSL certificate as a DNS record, sidestepping the whole SSL certificate authority hierarchy and the associated fees"

      In that case if someone does an MITM (or other) attack, how do you know the published SSL cert in a DNS record is really the genuine cert?

      After all during the attack, the attacker could publish his own SSL cert as a DNS record. The attacker can pretend to be the dns server as well as the webserver or other server the victim is going to connect to.

      If you already know what cert you are expecting and thus won't be fooled by the attacker's cert, there is little/zero need for DNSSEC. Since even if the attacker gives you a false DNS reply, your client software will notice that the cert is different.

      --
    5. Re:DNSSEC is a good subsitute for paid-for CERTs by Anonymous Coward · · Score: 1, Informative

      DNSSEC does not encrypt DNS responses, but it authenticates them. That's the whole point.

      If your browser connects to slashdot.org, the root server will reply with records which are signed with the private root key. The public key for the org domain is one of those records. Your computer verifies the records with the public root key, which is stored in the resolver configuration. The org server will respond with records which are signed with the private org key. The public key for the slashdot.org domain is one of those records. Your computer verifies the records with the public org key which it got from the root server. The slashdot.org server will respond with records which are signed with the private slashdot.org key. The SSL key could be one of those records, and your computer can verify the authenticity with the slashdot.org public key which it got from the org server.

      An attacker can not sign records with the appropriate keys.

    6. Re:DNSSEC is a good subsitute for paid-for CERTs by Simetrical · · Score: 1

      "This theoretically enables the domain owner to publish his SSL certificate as a DNS record, sidestepping the whole SSL certificate authority hierarchy and the associated fees"

      In that case if someone does an MITM (or other) attack, how do you know the published SSL cert in a DNS record is really the genuine cert?

      Same way you know that a cert is genuine in SSL: a chain of trust. The browser will come hardcoded with a handful of root certs. Any certificate that's not signed (directly or indirectly) by a root certificate will be ignored. Only a very limited number of parties, perhaps domain name registrars, would be able to sign functional certificates. Therefore you can't forge a DNSSEC certificate unless you can compromise one of these small number of keyholders, which is likely to be difficult, and which can be mitigated by expiration/revocation if it does happen.

      --
      MediaWiki developer, Total War Center sysadmin
    7. Re:DNSSEC is a good subsitute for paid-for CERTs by TheLink · · Score: 1

      OK if that's the case how does this sidestep fees (see what I'm replying to)?

      Are you so sure it's all going to be done for free?

      Isn't this more likely to happen:

      . (root) signs .org and .com etc and charges them $$$$$$$/year .com charges $$/year per domain to sign cnn.com, ebay.com, google.com .org charges $$/year per domain to sign slashdot.org, kernel.org etc

      The DNSCurve isn't as amenable to "toll/fee extraction" as DNSSEC is.

      See: http://www.dnssec-deployment.org/documents/03-03-Mohan_GTLD_PLANS.ppt

      "Current thought process is to not charge a fee"

      That proves my point that with the DNSSEC design "collecting a fee" to sign _subordinate_ certs is pretty obvious option, just in 2005 they think it's better not to charge.

      If "." starts charging .org $$$$$$$ to sign .org, .org might have to start charging $$ per domain just to recoup the costs. Not going to happen? Maybe not, but it's not "far out".

      In contrast, with dnscurve, the design is different, so "collecting a fee" to sign and create a shared secret key for _mutual_ communications is not an option that sticks out as much.

      --
    8. Re:DNSSEC is a good subsitute for paid-for CERTs by Simetrical · · Score: 1

      OK if that's the case how does this sidestep fees (see what I'm replying to)?

      Are you so sure it's all going to be done for free?

      Isn't this more likely to happen:

      . (root) signs .org and .com etc and charges them $$$$$$$/year .com charges $$/year per domain to sign cnn.com, ebay.com, google.com .org charges $$/year per domain to sign slashdot.org, kernel.org etc

      All possible in principle, but whether it happens in practice depends on who does the signing. The scenario you describe could perfectly well happen right now with DNS. The root registrar (ICANN) could charge an exorbitant sum of money to be the .com registrar, maybe selling it to the highest bidder with no strings attached; and then the .com registrar (VeriSign or whoever) could charge $1000/year for all .com domain names. But this hasn't, in fact, happened. If the root certifier for DNSSEC is ICANN, which seems as likely as anything (if there will be a root certifier at all), there's no reason they'll be any more exploitative for certificates than for DNS generally.

      DNS and IP assignments have always been the only really centralized parts of the Internet. Despite that, they've always worked pretty well. Prices are reasonable and probably not too far above cost. You have stuff like VeriSign's Site Finder, but ICANN et al. shut that down pretty quickly, and would likely shut down anything else that's clearly corporate abuse on the part of a root (non-national) registrar. It's a success story for corporate contracting.

      --
      MediaWiki developer, Total War Center sysadmin
    9. Re:DNSSEC is a good subsitute for paid-for CERTs by Anonymous Coward · · Score: 0

      The inclusion of SSL keys in DNS records is beyond the control of the registry, because the DNS records at that level are signed with the private key of the domain owner. The only conceivable option is to deny DNSSEC for the whole domain unless the domain registrant pays through the nose for the privilege of using DNSSEC on his domain. That would run counter to the whole idea of using DNSSEC to secure the primary function of DNS. As there is no additional identification overhead involved, such surcharges would also be quite incomprehensible.

    10. Re:DNSSEC is a good subsitute for paid-for CERTs by bhamlin · · Score: 0

      during the attack, the attacker could publish his own SSL cert as a DNS record. The attacker can pretend to be the dns server as well as the webserver or other server the victim is going to connect to.

      This isn't much different from the case of a MITM with normal SSL. With someone in the middle, most bets are off.

  11. Follow-up at 11:05 by jonaskoelker · · Score: 1

    In other news, the Internet is seeing the government as damage and routing around it.

    Funny, I thought it was always the government seeing the Internet as damage and trying desperately to route around it ;-)

  12. Small quibble by theskipper · · Score: 1

    "...because the Obama Administration hasn't appointed a Secretary of Commerce yet..."

    That reads like the administration has been lax in getting the position filled. Hopefully the third time's a charm:
    http://voices.washingtonpost.com/thefix/2009/02/locke_to_commerce.html?hpid=topnews

  13. Why hasn't Obama picked a Sec. of Commerce yet? by Anonymous Coward · · Score: 0

    What the heck is he waiting for? He's been in office for over a month! Oh wait... Yeah... Oops!

    1. Re:Why hasn't Obama picked a Sec. of Commerce yet? by Shatrat · · Score: 1

      They're having trouble finding someone who pays their taxes.

      --
      09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
  14. Government is always slow. by jellomizer · · Score: 1

    And it supposed to be so by design, It makes sure that we jump back and forth and fly on every whim that everyone has.

    That said the downside it is creates a Failure based culture where it is not what you do right that promotes you but what you do wrong that will get you fired, or prevented from promotion. So for many initiatives no one is willing to put there neck out and push the project. So the DNSSEC is on a list of things to do thats fine, you make sure you have other things on your list and wait until your boss tell you it is a priority... Your Boss will do the same thing until his boss does so etc...
    So when the s***t hits the fan everyone will point to the next level up and say it is not my fault. Until it hits the top then the top points at either a Contractor (who they don't fire because they know they didn't do anything wrong they just needed someone to blame) or an Aid which they do fire to show that he is a responsible leader.
    To compound the problem most government workers are Unionized and Unions do not like pay based of performance so the people who want to do a good job and do the right thing have no incentive to do so. Unless they are stupid enough to want to run for public office.

    --
    If something is so important that you feel the need to post it on the internet... It probably isn't that important.
  15. DNS Converter Box Coupons by Culture20 · · Score: 0

    The US Government is trying to figure out a way to issue coupons for DNS Converter Boxes, but they can't find manufacturers. Project delayed until June 12th, 2012.

  16. .gov is signed. by supradave · · Score: 1

    dig +dnssec @a.gov.zoneedit.com. gov.

    1. Re:.gov is signed. by djcapelis · · Score: 1

      The TLDs can be signed all they want but if the root isn't signed it doesn't matter without technology like the article discusses.

      The root is the invisible dot at the end, not the TLD. It's *above* gov in the hierarchy.

      --
      I touch computers in naughty places
    2. Re:.gov is signed. by supradave · · Score: 1

      The trust anchors work. I don't see what the problem is. I use a trust anchor on my DNSSEC deployment because the root isn't signed.

      There will be pressure to get the roots signed as more and more TLDs are signed. .gov, .org, plus the plethora of CCTLDs.

    3. Re:.gov is signed. by djcapelis · · Score: 1

      Right, I was just saying that there is a need for this type of technology because without it and with just standard DNSSEC the root needs to be signed.

      --
      I touch computers in naughty places
  17. DNS for LOLCATS by rs79 · · Score: 2, Funny

    "Acronyms confuse me."

    Then you can has cheeseburgers.

    SSL with no, or a bogus cert = "I has encryption. But I might be not be is cat. Might be is dog!"

    DNSSEC = "I is cat. You know I is cat"

    --
    Need Mercedes parts ?
    1. Re:DNS for LOLCATS by MikeBabcock · · Score: 1

      DNSSEC = "I am called cat, and nobody is pretending to be me, but I may be a dog"

      Proper SSL cert = "I am called cat, I am cat, I can prove I'm cat"

      --
      - Michael T. Babcock (Yes, I blog)
    2. Re:DNS for LOLCATS by Anonymous Coward · · Score: 0

      Spellchecker v5.0
      It should be, "You can has chee[z]burger."
      Click her for further info.

    3. Re:DNS for LOLCATS by aj50 · · Score: 1

      To be fair, with the verification done for cheap certs, that's all most SSL Certs assure you of anyway.

      Just because I have an SSL Cert doesn't mean I am a reputable entity or that I don't lie. (Unless you were referring to EV Certs in which case you have more of a point.)

      --
      I wish to remain anomalous
    4. Re:DNS for LOLCATS by MikeBabcock · · Score: 1

      Well I said "proper" for a reason, and I should've clarified but didn't. I meant a properly validated cert that actually means something beyond "yeah, your communications with this site are encrypted and probably won't be hijacked."

      Personally, I only truly respect secure websites that require client certificates as well.

      --
      - Michael T. Babcock (Yes, I blog)
  18. Alternatives by Epsillon · · Score: 1

    Known as a Trust Anchor Repository, the alternative was announced by ICANN last week and has been in testing since October.

    Ah, so the other alternative, look-aside validation, currently run by the ISC and something I've been using for ages isn't a solution? OK, I'll stop using it right now...

    Clues. Isle nine. I'd get one, were I you. ICANN ain't the only game in town.

    --
    Resistance is futile. Reactance buggers it up.
  19. ISC DLV repository updates by nnet · · Score: 1

    The ISC DLV repository doesn't update the dlv.isc.org zone very often, about once a day at present (so I'm told), this further adds to slowing implementation of DNSSEC and registration of dnskeys to this repository.

  20. I welcome our Washingtonian overloards by oasisbob · · Score: 1

    As a resident of the evergreen state, I'm stoked to see another one our intelligent, liberal, tech-friendly public servants appointed to a federal position:

    (from the WP article in parent)

    Locke would be the third resident of the Evergreen State named to the Obama administration, following deputy HUD secretary-nominee Ron Sims and Seattle City Police Chief Gil Kerlikowske who reportedly has been tapped to serve as "drug czar."

    Locke is thoughtful, and having him in charge of the US's interest in IANA sounds like a good idea.

    Kerlikowske has the potential to take some interesting decisions regarding marijuana prosecution as well.

  21. Why does this depend on the Secretary of Commerce? by mysticalreaper · · Score: 1

    The main thing that I'm not understanding is why the US Secretary of Commerce is responsible for specific technology decisions on the DNS.

    Surely the political appointee to that post will not be qualified in any capacity to dictate the specifics about DNSSEC deployment.

    Additionally, does the US Government still exert so much direct control over the DNS? I thought they divested their control to ICANN, so they could at least appear to not be thugs running the internet for their own benefit. However the ICANN employee specifically states:

    '"The ideal scenario is that the root zone is signed," said Kim Davies, manager of root zone services for ICANN."Currently, we have a situation where the root isn't signed, which is largely a political discussion. And in the immediate future, it is not likely that we'll have a signed zone. So we're looking at what's the next best thing."'

    Signing the root is a political discussion, needing the secretary of commerce' approval?

    Can anyone enlighten me?