Slashdot Mirror
Educause Announces Plans To Sign .edu TLD With DNSSEC
jhutkd writes "Educause (who run the .edu gTLD) announced today that they will deploy DNSSEC and sign the .edu zone by the end of March 2010.
This will enable all educational institutions to benefit from deploying DNSSEC via the secure delegation hierarchy starting with IANA's ITAR (a temporary surrogate for the root zone signing), going through .edu, down to schools, and potentially leading all the way down to individual departments. Unlike larger gTLDs like .org, the churn of adding new and deleting old zones in .edu is much lower (due to the fact that there are tight controls on who may register for a delegation). Thus, many of the hassles of adding new DS records and maintenance procedures might be more manageable and help speed DNSSEC's rollout in this branch of the DNS hierarchy."
The itnernets is a freeway. .edu lane on the freeway will soon be secured with DNSSEC.
Each top level domain is a lane on that freeway.
The
DNSSEC is basically a signature on all the freeway signs.
school.edu - 5 miles
becomes
school.edu - 5 miles
-Signed by school.edu
This way those punks at pornschool.com can't put up their own fake freeway signs that say "school.edu - next exit" in an attempt to make you get off when you don't want to.
This way those punks at pornschool.com can't put up their own fake freeway signs that say "school.edu - next exit" in an attempt to make you get off when you don't want to.
Best...Double-Entendre...Ever...
Okay. Educause Motors Corp. makes a model called the EduCar that they will sell only to educational institutions, like college campuses or school districts. Earlier models didn't have locks or keys, but instead used a system whereby you had to show to your educational institution paperwork to the onboard camera before you could open the door. Once inside, you have push-button start. The new EduCar will feature secure keys and locks, but you still need to show your educational paperwork to get one.
Other models, which require no educational paperwork, are available from a wide variety of manufacturers such as GoDaddy Motors, Network Solutions Motors, Register Motors, etc., will continue to sell their ComCars, OrgCars, NetCars, etc. without keys or locks.
My blog
One thing that I'm not clear on at all but would like to understand is, is there any chance that DNSSEC will let us get rid of SSL certificate authorities?
Maybe that's a dumb question, but what I have in mind is this: if we can provide authenticated/signed pairing of DNS information to IP addresses, could we also put a SSL certificate into the mix and therefore know that the SSL cert is valid for that domain name? Wouldn't that at least give us SSL certs that verified the site was owned by the person who owned the domain, even if it didn't do any kind of "Extended validation" stuff?
It would be like if your car's PCV valve required a permissive signal from the EGR valve via CAN-BUS linkage to MPI and DOHC. The ECR module would then TBI the MPG and various other RWHPs. Failing that the EFI unit ATF AC unit BTDC more of the CCs than CUINs. As long as your crank was CCW and you had COPI you would be good to go. Unless the CTVS was broken. In which case both your FWD and 4WD was unusable. You'd need to measure MAP and calibrate the VSS or you'll go WOT, and with NOS then you will likely exceed the allowable RPMs.
DOHV. OD. LED taillights. HO engine. blah blah blah.
"Sacrifice for the good of The State" - The State
Uhh... .org has already signed. .se (Sweden) has been signed for years.
If you want to get a list of all signed domains, check out:
http://secspider.cs.ucla.edu/
Look up any TLDs you want there.
Are you aware that DNS has the ability to publish more than simply an IP address? Like say.. a key?
If DNSSEC supplies a secure channel to a trusted authority (which it sounds like it does), then I see no reason why it can't replace the certificate authorities. Likely the biggest impediment to this is simply the time required for DNSSEC to be supported down to the individual machine level.
AccountKiller
Yeah, I wasn't under the impression that getting rid of CAs was the purpose of DNSSEC, but it seemed like one possible side effect. Just to spell out my thoughts a bit more, when you say that DNSSEC guarantees that the DNS lookup returns the correct IP, I'm under the impression that "correct" is defined as "whatever the domain owner says is correct", i.e. it enables you to verify that whatever is in the DNS record is actually what the domain holder put in his DNS record.
Now I'm not claiming to understand the intricacies of how DNSSEC works, but it seems to me that once you have a signature that is able to verify that information comes from a given domain owner, you probably have the infrastructure in place for passing other information comes from the domain holder, too. So even if DNSSEC can't do this right now, you've possibly laid the groundwork for someone to stick a public key into the DNS record for a given server. If you can verify that the public key given for a particular server is authentic, then that public key can be used to prevent a man-in-the-middle attack.
I mean, ultimately what CAs are doing in most cases is verifying that a small bit of data, i.e. the public key for SSL encryption, is actually being provided by the domain that it's claiming to come from. If you can do this through your domain registrar and DNS servers, then CAs become unnecessary except for any extended validation of identity that you want to do.
But this would be very important in my mind, because it might allow SSL to become essentially free in cases where extended validation isn't necessary.
But along with signing your DNS records, you can sign a text record containing a hash of your webservers SSL cert, that way anyone who can verify your DNS records can also check that the SSL cert they are being provided with belongs to the owner of the DNS entries. (You know these are correct and have not been MITMed because they are signed by the previous level of DNS, up to the root zone which you have to acquire in some secure way.
Come as you are, do what you must, be who you will.