Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Russian TLD .RU fails DNSSEC validation

dnsviz.net

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Russian TLD .RU fails DNSSEC validation

#12

Post by TomK32 »

dgrin91 wrote: post #4

I'm not familiar with DNSSEC. What sis the impact of this? Do web pages fail to load or is it just some security warning? Also was this just someone failing to update a cert in time or is this some sort of hack?

Either someone failing to update the cert or the person who did it until has been sent to the meatgrinder. I really do wonder what effect war will have on the Russian IT industry. From what I read most IT professionals are protected from mobilisation, but on the other hand they might have a more open view of the world then Putin's regime.

Re: Russian TLD .RU fails DNSSEC validation

#13

Post by bewaretheirs »

woodruffw wrote: post #10

As a side question: am I correct in reading this to imply that the two "leaf" keys here are both RSA 1024 keys? RSA 1024 has been considered within nation-state capabilities for well over a decade, and NIST has explicitly discouraged them for DNSSEC for close to a decade[1]. I can understand not using larger RSA key sizes for framing reasons, but what is stopping the DNSSEC ecosystem from using ECC? [1]: https://nvlp…

ECDSA is available in DNSSEC, and there is a slow migration to ECC in progress; see https://stats.dnssec-tools.org/#/?dnssec_param_tab=0

The .EDU, .NET, and .COM zones were recently migrated from RSA to ECDSA (DNSSEC algorithm 13); see, for instance: https://lists.dns-oarc.net/pipermail/dns-operations/2023-Dec...

Anyone newly enabling DNSSEC on their zone should probably use ECDSA.

Re: Russian TLD .RU fails DNSSEC validation

#14

Post by Fnoord »

tryauuum wrote: post #11
krunck wrote: post #2

I saw this start at 10:14:29 CST.

DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"

IIRC the protocol is also a nightmare for potential reflection DDoS attacks.

Also, the security chain is top-down, from owner of the TLD to the domain to the resolver to the client. With DNS over TLS and DNSCurve, you have it the other way around.

Re: Russian TLD .RU fails DNSSEC validation

#15

Post by zokier »

woodruffw wrote: post #10

As a side question: am I correct in reading this to imply that the two "leaf" keys here are both RSA 1024 keys? RSA 1024 has been considered within nation-state capabilities for well over a decade, and NIST has explicitly discouraged them for DNSSEC for close to a decade[1]. I can understand not using larger RSA key sizes for framing reasons, but what is stopping the DNSSEC ecosystem from using ECC? [1]: https://nvlp…

inertia

https://datatracker.ietf.org/doc/html/rfc6605

https://datatracker.ietf.org/doc/html/rfc8080

Re: Russian TLD .RU fails DNSSEC validation

#16

Post by tptacek »

woodruffw wrote: post #10

As a side question: am I correct in reading this to imply that the two "leaf" keys here are both RSA 1024 keys? RSA 1024 has been considered within nation-state capabilities for well over a decade, and NIST has explicitly discouraged them for DNSSEC for close to a decade[1]. I can understand not using larger RSA key sizes for framing reasons, but what is stopping the DNSSEC ecosystem from using ECC? [1]: https://nvlp…

Until relatively recently, ECC DNS had (if I'm remembering Geoff Huston right) a 5% failure rate for resolvers. Towards the end, that may have mostly been a misconfiguration artifact (DNSSEC is extremely easy to misconfigure; see again Huston) but either way the perception has been that RSA is more compatible.

Also: why would you bother changing at this point? DNSSEC isn't getting traction (see, once again, Geoff Huston).

The 1024-bit key thing is unforgivable in 2024, but also endemic to DNSSEC.

Re: Russian TLD .RU fails DNSSEC validation

#19

Post by naniwaduni »

tryauuum wrote: post #11
krunck wrote: post #2

I saw this start at 10:14:29 CST.

DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"

DNSSEC does absolutely nothing for privacy. It seeks to achieve strictly authentication and incidentally integrity.
Post reply on HN