Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[bert hubert <[e-mail]>]

On Wed, Jul 23, 2008 at 10:25:23AM -0700, David Conrad wrote:
> Actually, I suspect not, since I would guess this event has increased  
> the number of dnscache sites out there.  And PowerDNS (also unaffected  
> by the vulnerability as I understand it) doesn't support DNSSEC  
> either, right?

Correct - my reasoning can be found on
http://ds9a.nl/dnssec/index.html#id2467146

Some older stuff: http://ds9a.nl/secure-dns.html

DNS is part of the long chain from a named service to a physical server:

1) ARP to find the hardware serving the router/nameserver IP
2) DNS to find the server IP
3) BGP to find the link to the destination AS
4) (TCP/)IP to the actual server
5) Content

Everybody who really cares about information security handles it in the
application that deals with the content, and is close to the user. All the
steps underneath have traditionally been plaintext, and have only been
hardened enough to be secure enough that casual tampering is ruled out.

Because we use real crypto for our important content anyhow, crypto that
does authentication, this is not a problem.

1) ARPSEC has been proposed, but never went anywhere. Switches implement
port security measures.
2) DNS has been hardened using random source ports
3) BGP has suffered the MD5 scare, and has now been hardened using TTL-checks to keep out
strangers
4) TCP/IP has been hardened by making sure everybody uses unpredictable sequence numbers.

You can see where this is going.

DNSSEC would be the most complex protocol ever deployed on such a scale on
the internet [1], with far reaching administrative and computational
consequences for everybody, yet it would sit all the way down there in the
stack.

I wouldn't put any faith in secure DNS alone.

So - DNS needs only to be strong enough to not be easily subverted in the
process of transporting plaintext unauthenticated data. This puts an upper
bound on the overhead (financial, technical and administrative) that we
should commit to DNS security.

And I firmly believe some simple measures will bring DNS to the required
level of robustness against tampering, and that these simple measures will
fit in the the 'overhead budget' mentioned above. [2]

I also firmly believe DNSSEC will impose an order of magnitude more hassle
than the world is willing to bear.

	Bert

[1] The telephony world beats us hands down though. Think H.323 or SS7.
[2] EDNS PING extra entropy, with gradual fallback to TCP to be introduced
to give everybody the opportunity to deploy. Fallback to TCP in case of a
single question-response {id,source-port} mismatch might even be enough!

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>