RE: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Jesper G. Høy <[e-mail]>]

I second Bert's view on DNSSEC, and it is for much the same reasons that we
do not have DNSSEC in Simple DNS Plus either.

There may be other good reasons to push DNSSEC, but it really is overkill
for the Kaminsky bug IMHO.

The core problem with the Kaminsky bug, and other cache poisoning scenarios,
is the short 16 bit transaction ID.
So why not simply expand this ID to a secure length?
And not just ~16 bits (random ports) or 2+ bits (x020) - but really secure
length like 128 bits.

This seems a lot easier than getting DNSSEC in place, signing the root,
getting EVERYBODY to sign their zones, repeat for rollover, etc., etc.

Some will probably argue that this doesn't help against on-the-wire-attacks.
But if the bad buy is one-the-wire, then he can replace any data at will
anyway. DNSSEC is no help here.
Of course we already have SSL to solve that problem.

So why not keep DNS simple?

Am I oversimplifying matters?

Sincerely,
Jesper


> -----Original Message-----
> From: [e-mail] [mailto:owner-
> [e-mail]] On Behalf Of bert hubert
> Sent: Wednesday, July 23, 2008 8:32 PM
> To: David Conrad
> Cc: Ben Laurie; DNSEXT WG
> Subject: Re: How do we get the whole world to upgrade to DNSSEC capable
> resolvers?
> 
> On Wed, Jul 23, 2008 at 10:25:23AM -0700, David Conrad wrote:
> > Actually, I suspect not, since I would guess this event has increased
> > the number of dnscache sites out there.  And PowerDNS (also
> unaffected
> > by the vulnerability as I understand it) doesn't support DNSSEC
> > either, right?
> 
> Correct - my reasoning can be found on
> http://ds9a.nl/dnssec/index.html#id2467146
> 
> Some older stuff: http://ds9a.nl/secure-dns.html
> 
> DNS is part of the long chain from a named service to a physical
> server:
> 
> 1) ARP to find the hardware serving the router/nameserver IP
> 2) DNS to find the server IP
> 3) BGP to find the link to the destination AS
> 4) (TCP/)IP to the actual server
> 5) Content
> 
> Everybody who really cares about information security handles it in the
> application that deals with the content, and is close to the user. All
> the
> steps underneath have traditionally been plaintext, and have only been
> hardened enough to be secure enough that casual tampering is ruled out.
> 
> Because we use real crypto for our important content anyhow, crypto
> that
> does authentication, this is not a problem.
> 
> 1) ARPSEC has been proposed, but never went anywhere. Switches
> implement
> port security measures.
> 2) DNS has been hardened using random source ports
> 3) BGP has suffered the MD5 scare, and has now been hardened using TTL-
> checks to keep out
> strangers
> 4) TCP/IP has been hardened by making sure everybody uses unpredictable
> sequence numbers.
> 
> You can see where this is going.
> 
> DNSSEC would be the most complex protocol ever deployed on such a scale
> on
> the internet [1], with far reaching administrative and computational
> consequences for everybody, yet it would sit all the way down there in
> the
> stack.
> 
> I wouldn't put any faith in secure DNS alone.
> 
> So - DNS needs only to be strong enough to not be easily subverted in
> the
> process of transporting plaintext unauthenticated data. This puts an
> upper
> bound on the overhead (financial, technical and administrative) that we
> should commit to DNS security.
> 
> And I firmly believe some simple measures will bring DNS to the
> required
> level of robustness against tampering, and that these simple measures
> will
> fit in the the 'overhead budget' mentioned above. [2]
> 
> I also firmly believe DNSSEC will impose an order of magnitude more
> hassle
> than the world is willing to bear.
> 
> 	Bert
> 
> [1] The telephony world beats us hands down though. Think H.323 or SS7.
> [2] EDNS PING extra entropy, with gradual fallback to TCP to be
> introduced
> to give everybody the opportunity to deploy. Fallback to TCP in case of
> a
> single question-response {id,source-port} mismatch might even be
> enough!
> 
> --
> http://www.PowerDNS.com      Open source, database driven DNS Software
> http://netherlabs.nl              Open and Closed source services
> 
> --
> to unsubscribe send a message to [e-mail] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>



--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>