Re: [Trans] DNSSEC also needs CT

[Daniel Kahn Gillmor <[e-mail]>]

On 05/10/2014 06:31 PM, Paul Wouters wrote:
> On Sat, 10 May 2014, Warren Kumari wrote:
>> The main incentive (that I can see) to DoS the logs would be for the
>> lolz[0], and so (IMO) the protection does not need to be very strong

Do not underestimate the appeal of the lulz for some people.

> Or just say that anyone who puts in more than X amount of DNSSEC CT
> entries underneath themselves must run a public CT node themselves. So
> if nohats.ca want to get more then X entries, or one of their
> subzones/customers wants more than X entries, either they or their
> subzone/customer will have to run a fully functional CT node. And if
> the node goes down, their new entries will be refused.

This sounds expensive to verify, and still a bit unclear to me.  do you
mean that nohats.ca would need to run its own log for its own zone?  At
the moment, we're not expecting the authorities to run their own logs --
this seems like a change in semantics and control.  clients would also
need to know to switch over to another log in that case -- how would
that be done?  What kind of limits would this architecture place on
undetectable misissuance?

Or do you mean they would  would need to contribute to the CT
architecture in some other way?

Tthis question is related to the (currently idle) DBOUND discussion [0]
and (currently) the public suffix list [1].  If we can draw a line
between public registries (which need to be held publicly accountable)
and private zones (which in many cases may prefer to avoid full zone
enumerability that comes with CT) then we can just ensure that CT-style
audit logs apply only to the public registries.

Public registries themselves have some interest in limiting pollution,
and usually a revenue stream that scales with the size of the registry.
These are properties that we might be able to align with a logging
infrastructure.

So the idea is that for DNSSEC: the root zones and the TLDs (or
TLD-equivalents) would get CT-like logging, but children of those zones
(as you cross into a private administrative zone) would *not* get
CT-like logging.

I'd be curious to hear what other folks think about this balance, and
what it would take to draw that line cleanly.

	--dkg

[0] https://www.ietf.org/mailman/listinfo/dbound
[1] https://publicsuffix.org/