IETF Logo Mail Archive

Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards

Nicholas Weaver <nweaver@icsi.berkeley.edu> Sat, 14 March 2015 19:44 UTC

Return-Path: <nweaver@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C2291A020D for <dnsop@ietfa.amsl.com>; Sat, 14 Mar 2015 12:44:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7-Dbx55ztZpI for <dnsop@ietfa.amsl.com>; Sat, 14 Mar 2015 12:44:54 -0700 (PDT)
Received: from mail-pd0-x236.google.com (mail-pd0-x236.google.com [IPv6:2607:f8b0:400e:c02::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DE781A0204 for <dnsop@ietf.org>; Sat, 14 Mar 2015 12:44:54 -0700 (PDT)
Received: by pdbcz9 with SMTP id cz9so17600166pdb.3 for <dnsop@ietf.org>; Sat, 14 Mar 2015 12:44:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:subject:mime-version:content-type:from:in-reply-to:date:cc :message-id:references:to; bh=KccKC9LO1zRqXjxfYeo3RdycJxvu9A8ZawG2eiIYDnc=; b=ywtQdTB7VGRglhFfMJST2YGNVbawu4XAkPehxMsLYzhbnoxYG/yaZm+JoTRpuzpDjs e6+xPnwEgxdCc4fSs+DBoVQesg0C7I3G+Vx+aj0Ecyzan77L6F2vBI+dK4481pu/r5gi JTBzMEmKu/6k95CxSWKd3Fw5NL6NCSTcNjqNwujoE6FtzoWULFlzCZFsLHS1/caIwNnP spaCEC2kEO8xfOPIKyA50F/CNdlH4VPbSn95UwHYZxRI53osLf4ceDpE9ZJ0kfRIzPbU R54onerRByTA6erca9SCtFxyc4O46PJWGGlUpC3Xplkx3AtC3SwwLCLOeg1enBXLLnpr 70iA==
X-Received: by 10.66.159.138 with SMTP id xc10mr117744666pab.141.1426362294199; Sat, 14 Mar 2015 12:44:54 -0700 (PDT)
Received: from ?IPv6:2601:9:2b80:12f1:15fc:6523:bb2d:5bc7? ([2601:9:2b80:12f1:15fc:6523:bb2d:5bc7]) by mx.google.com with ESMTPSA id d4sm9512701pdm.50.2015.03.14.12.44.51 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 14 Mar 2015 12:44:52 -0700 (PDT)
Sender: Nicholas Weaver <nweaver@gmail.com>
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
Content-Type: multipart/signed; boundary="Apple-Mail=_4433D9B8-2831-4115-9656-7DBFA72C7C18"; protocol="application/pgp-signature"; micalg="pgp-sha512"
X-Pgp-Agent: GPGMail 2.5b5
From: Nicholas Weaver <nweaver@icsi.berkeley.edu>
In-Reply-To: <5503A412.20602@redbarn.org>
Date: Sat, 14 Mar 2015 12:44:50 -0700
Message-Id: <64FF8B96-F823-41AD-80FD-0006A278F03F@icsi.berkeley.edu>
References: <20150312125913.20188.qmail@cr.yp.to> <3D558422-D5DA-4434-BDED-E752BA353358@flame.org> <m27fulry37.wl%randy@psg.com> <55030A28.8050707@necom830.hpcl.titech.ac.jp> <5503101F.9060205@redbarn.org> <968C470DAC25FB419E0159952F28F0C06DF659F0@MEM0200CP3XF04.ds.irsnet.gov> <00B5D36F-5DFA-46EE-B61B-F5307738A910@icsi.berkeley.edu> <5503A412.20602@redbarn.org>
To: Paul Vixie <paul@redbarn.org>
X-Mailer: Apple Mail (2.2070.6)
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/A5ijS3ZuP80kroXZKA20PwSfnl0>
Cc: "dnsop@ietf.org" <dnsop@ietf.org>, Nicholas Weaver <nweaver@icsi.berkeley.edu>
Subject: Re: [DNSOP] [dns-operations] dnsop-any-notimp violates the DNS standards
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 14 Mar 2015 19:44:56 -0000

> On Mar 13, 2015, at 7:59 PM, Paul Vixie <paul@redbarn.org> wrote:

> >	Nicholas Weaver	Saturday, March 14, 2015 5:07 AM
>> 
>>> ...
>>> 
>>> Overall, unless you are validating on the end host rather than the recursive resolver, DNSSEC does a lot of harm from misconfiguration-DOS, but almost no good.
>> 
> several of us jumped for joy in 2008 when kaminsky showed rdns poisoning to be a trivial exercise, because it finally provided justification for what was at that time 12 years of apparently-wasted effort on DNSSEC.

But it didn't justify DNSSEC, even at the time.

Between actually adding in a bit more entropy in the request through 0x20 and port randomization, and more importantly cleaning up the glue policy for recursive resolvers (which Unbound did), you close the door on off-path attackers: both making races harder AND eliminating the "race until win" property.

In fact, several have viewed the glue policy cleanup which gets to the root cause of the Kaminski problem as detrimental specifically because of the desire to force DNSSEC adoption.

> so we'll keep pushing the crap system we have, uphill all the way, noone loving it, and almost everyone in fact hating it. we've now spent more calendar- and person-years on DNSSEC than was spent on the entire IPv4 protocol suite (including DNS itself) as of 1996 when the DNSSEC effort began. ugly, ugly, ugly.

At which point is it sunk cost fallacy?

"DNS is insecure, live with it" may be the best answer.  Why keep throwing good effort after bad?


It certainly is a hell of a lot better than the DOS attack that is recursive resolver validation which provides almost no meaningful security gain.

If I was Comcast, after the HBO DNSSEC mess-up, on top of previous mess-ups where Comcast inevitably gets the blame, I'd be really really tempted to turn OFF DNSSEC validation.  It has failed.

--
Nicholas Weaver                  it is a tale, told by an idiot,
nweaver@icsi.berkeley.edu                full of sound and fury,
510-666-2903                                 .signifying nothing
PGP: http://www1.icsi.berkeley.edu/~nweaver/data/nweaver_pub.asc

v2.23.0 | Report a Bug | By Email