Hacker News Reader

Comment by cowtools | Hacker News Reader

I was under the impression that DNSSEC is vulnerable to downgrade attacks. Is this still the case?

DNSSEC has support for denial of existence (NSEC/NSEC3) proofs, which means resolvers may require the resolver to provide them. This means you can't just MITM a DS record away. However practically most people dont use locally DNSSEC verifying resolvers, instead relying on upstream resolvers to do the job for them, which can be easily manipulated by your ISP.

Aside from that they bloat the size of responses a lot. However if you can sign DNSSEC on the go, you can use Cloudflare's black lies approach and have small enough DNS responses. [1]

1. https://blog.cloudflare.com/black-lies/

To put this in a bit of context, a regular NSEC3 is 1kb of data. Black lies are 350b. The average website is 1600kb. Cloudflare's black lies seems more to target the computational work on cloudflare's part, since a unique lookup at cloudflare require both an expensive database search and a computational expensive signing of the answer.

Cloudflare also outlines the following reason in the linked blog post:

> "The reason this matters so much is that the maximum size of an unsigned UDP packet is typically 512 octets. DNSSEC requires support for at least 1220 octets long messages over UDP, but above that limit, the client may need to upgrade to DNS over TCP. A good practice is to keep enough headroom in order to keep response sizes below fragmentation threshold during zone signing key rollover periods."

Reply on news.ycombinator.com