Comment by danyork | Hacker News Reader

Comment by danyork | Hacker News Reader

Thomas - I'm still looking for the walk-through of how you see the attacks by a government against DNSSEC. I don't see them!

And to your repeated refrain both in your post and here on HN that "DNSSEC has virtually no real-world deployment", I would again refer you to various DNSSEC statistics sites that do indeed show a good amount of deployment happening in different parts of the world.

Here's a list of those sites: http://www.internetsociety.org/deploy360/dnssec/statistics/

I know you wish it were NOT happening, but the reality is that DNSSEC deployment is going on... and many of us see it as a way to provide another solid layer of security on the Internet.

Yes, it's always great to be exploring other alternatives, too. My personal interest is in "securing the DNS"... and right now DNSSEC is to me the best tool we have going today. If we can develop other tools over time that are even better, that will be outstanding. Meanwhile, I want to see what we have today get better deployed.

I keep seeing a claim that something like 10% of DNS requests are signed with DNSSEC, but that's an awfully hard number to square with the top sites on the Internet, virtually none of whom are DNSSEC-signed. Reconcile for us, please?

"signed with DNSSEC" is an ambiguous statement. You need to take into account that, while nameservers may enable DNSSEC, resolvers may:

(a) validate (include the AD bit) but strip the RRSIGs (i.e. regular DNSSEC resolver)

(b) omit the AD bit but include the RRSIGs (i.e. you have to validate yourself)

(c) omit the AD bit and omit the RRSIGs (i.e. regular non-DNSSEC resolver)

(d) validate (i.e. include the AD bit) and include the RRSIGs (i.e. alleluia!)

My own study [0] (using the Atlas network [1]) found 30% of resolvers doing (a), and 65% doing (b), including some overlap. There are people way more qualified than me doing this kind of stuff, namely APNIC's Geoff Huston, see [2] for instance.

[0] https://www.os3.nl/_media/2013-2014/courses/rp2/p14_report.p...

[1] https://atlas.ripe.net

[2] http://www.potaroo.net/presentations/2014-06-03-dns-measurem...

Hmm... I'm not sure where you are seeing that claim that 10% of DNS requests are signed with DNSSEC. I've certainly promoted the statistic that 10-12% of DNS requests are performing DNSSEC validation - and that is based on Geoff Huston's DNSSEC validation metrics out of APNIC - see: http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g... (although the measurement seems broken for the past few days)

> I'm still looking for the walk-through of how you see the attacks by a government against DNSSEC. I don't see them!

Assume we are attacking example.tld

For the US government: 1a) Use the root zone keys -- that are essentially already under their control -- to sign fake zone keys for fake .tld nameservers. 2a) Continue with 2b) below.

For the government under whose jurisdiction the .tld zone is operated: 1b) Get the zone keys for .tld using legal measures (e.g. the local equivalent of national security letters). 2b) Use the .tld zone key to sign fake example.tld zone keys for fake example.tld nameservers. 3) Serve signed records for example.tld records (via man-in-the-middle attacks).

This in practice a redelegation of the zone.

If you redelegate a zone to a new owner, that owner owns the domain for every intent and purpose, including generating signed TLS keys from pretty much any CA.

There are legitimate ways to delegate a zone, including selling it to someone else. It's not really an attack, and it's definitively not something you can protect against.

Except for the fact that there really are no owners of any zone in DNS and DNSSEC, beside the owner of the root zone. Every other zone is just a temporary delegation that lives as long as the delegation record is cached. If you go that far down, then sure, this does not constitute an attack, because the protocol does not claim to protect your "ownership" in any sense (except for the ownership of the root zone).

People do have mental models of domain ownership, though, which is founded in the contractual agreements they have with their registry. To them it feels like an attack when for a select group of people their domain lookups result in different records than for everybody else. And it makes it worse that selective (or tailored) man-in-the-middle attacks don't leave any traces behind.

> It's not really an attack, and it's definitively not something you can protect against.

Sure you can. See how namecoin cryptographically reserves domains for a certain owner. It is just a pretty big step away from the current practice of how the DNS is run.

> Except for the fact that there really are no owners of any zone in DNS

That's only true using your very own definition of ownership.

A zone has an owner in a strict juridical sense of the word. You can read in detail what this means in the relevant agreements for registrars.

> attacks by a government against DNSSEC

When people talk about government attacks against DNSSEC, I assume that means co-opting the TLD operator and feeding alternate, signed, validated-to-the-DNS-root copies of a particular domain to some target. Is that not the mode of attack being described?

Reply on news.ycombinator.com