But when will it be supported in Route53?
ahmen
First-ever DNSSEC root key rollover
21–30 of 75 posts
Re: First-ever DNSSEC root key rollover
#22[deleted]
Re: First-ever DNSSEC root key rollover
#23This was supposed to have happened a year ago (I think almost to the day?), but was aborted roughly a week before because nobody was confident the system would survive. Apparently it did this time! An unfortunate attribute of DNSSEC: nothing depends on it, to the extent that you could almost certainly post the root private keys on Pastebin and not cause a single mainstream site a problem. At the same time, if you scr…
You make some interesting points, but it's worth adding a little extra context. For example, you mention a period of "almost 3 decades" for DNSSEC, but the first RFC for it was published barely two decades ago in 1997: https://tools.ietf.org/html/rfc2065
As a comparison, the RFC for IPv6 was first published two years earlier, in 1995: https://tools.ietf.org/html/rfc1883 and you could say that "nothing depends on" this too, in that no big commercial sites are served IPv6 only.
The fact that no sites would be taken down if the root private keys were published isn't too surprising either. What would happen if the Let's Encrypt (IdenTrust) private keys were published? Perhaps browsers would do the principled thing and brick ~50% of secure websites: https://w3techs.com/technologies/history_overview/ssl_certif... but I suspect that some pragmatic solution would be found. (In such a situation, though, it would be nice if sites could use TLSA as a defence in depth).
I think that the biggest differences, in terms of adoption rate, are that there isn't a limited supply of non-DNSSEC domain names (unlike the pressure to upgrade from IPv4 to IPv6), and sites don't get a Google search ranking boost (or a shiny padlock in the browser UI) by implementing DNSSEC. Remember that until quite recently even HTTPS was the exception rather than the norm for popular websites.
Re: First-ever DNSSEC root key rollover
#24This was supposed to have happened a year ago (I think almost to the day?), but was aborted roughly a week before because nobody was confident the system would survive. Apparently it did this time! An unfortunate attribute of DNSSEC: nothing depends on it, to the extent that you could almost certainly post the root private keys on Pastebin and not cause a single mainstream site a problem. At the same time, if you scr…
You make some interesting points, but it's worth adding a little extra context. For example, you mention a period of "almost 3 decades" for DNSSEC, but the first RFC for it was published barely two decades ago in 1997: https://tools.ietf.org/html/rfc2065 As a comparison, the RFC for IPv6 was first published two years earlier, in 1995: https://tools.ietf.org/html/rfc1883 and you could say that "nothing depends on" thi…
DNSSEC precedes its first RFC by several years; before that RFC, it was a DoD-funded project run by Trusted Information Systems. It's different today in a variety of ways, but the fundamental design decisions --- offline signers, authenticated denial --- date back to TIS and the USG.
If LetsEncrypt broke, there would be absolute chaos across the Internet.
Re: First-ever DNSSEC root key rollover
#25This was supposed to have happened a year ago (I think almost to the day?), but was aborted roughly a week before because nobody was confident the system would survive. Apparently it did this time! An unfortunate attribute of DNSSEC: nothing depends on it, to the extent that you could almost certainly post the root private keys on Pastebin and not cause a single mainstream site a problem. At the same time, if you scr…
Big five tech giants aren't playing, and I don't know any bank domains, but it's not hard to find names:
cloudflare.com verisign.com comcast.net *.gov
Every time dnssec shows up there's a tptacek comment crapping on the medium. are you using google alerts or something? what were your consulting fees for this service?
Re: First-ever DNSSEC root key rollover
#26This was supposed to have happened a year ago (I think almost to the day?), but was aborted roughly a week before because nobody was confident the system would survive. Apparently it did this time! An unfortunate attribute of DNSSEC: nothing depends on it, to the extent that you could almost certainly post the root private keys on Pastebin and not cause a single mainstream site a problem. At the same time, if you scr…
Big five tech giants aren't playing, and I don't know any bank domains, but it's not hard to find names: cloudflare.com verisign.com comcast.net *.gov Every time dnssec shows up there's a tptacek comment crapping on the medium. are you using google alerts or something? what were your consulting fees for this service?
Cloudflare and Verisign are no surprise; Cloudflare has a DNSSEC product, and Verisign is effectively one of the sponsors of the protocol. For what it's worth: Akamai does DNSSEC, too.
Comcast is indeed DNSSEC-signed (how you know Comcast does DNSSEC is, as I said, they sort of infamously broke an HBO product launch with it). But, for instance: Verizon and AT&T are not!
Re: First-ever DNSSEC root key rollover
#27This was supposed to have happened a year ago (I think almost to the day?), but was aborted roughly a week before because nobody was confident the system would survive. Apparently it did this time! An unfortunate attribute of DNSSEC: nothing depends on it, to the extent that you could almost certainly post the root private keys on Pastebin and not cause a single mainstream site a problem. At the same time, if you scr…
But mitre.org uses it!
Actually nearly all the sites I could find that used it were in some way government related. I even tried a half-dozen universities, since they often adopt obscure internet standards, and uiowa.edu was the only one I found that implemented it.
Re: First-ever DNSSEC root key rollover
#28Earlier quoted context omitted.
Big five tech giants aren't playing, and I don't know any bank domains, but it's not hard to find names: cloudflare.com verisign.com comcast.net *.gov Every time dnssec shows up there's a tptacek comment crapping on the medium. are you using google alerts or something? what were your consulting fees for this service?
Cloudflare and Verisign are no surprise; Cloudflare has a DNSSEC product, and Verisign is effectively one of the sponsors of the protocol. For what it's worth: Akamai does DNSSEC, too. Comcast is indeed DNSSEC-signed (how you know Comcast does DNSSEC is, as I said, they sort of infamously broke an HBO product launch with it). But, for instance: Verizon and AT&T are not!
Also first national bank I tried to look up, (actually don't know if that's what you mean by national bank)
federalreserve.gov is using dnssec.
Re: First-ever DNSSEC root key rollover
#29I have a DNSSEC signed zone, do I need to do anything? Like generate a new key using this new root key?
No, because nobody really depends on DNSSEC, so nothing will break: - https://ianix.com/pub/dnssec-outages.html - https://twitter.com/tqbf/status/772103926258671618
> because nobody really depends on DNSSEC
That's not true. A lot of people use DNSSEC validating public resolvers like 1.1.1.1 and 8.8.8.8, especially on Android devices. I use DNSSEC on my personal domain, and when my zone-resigning cronjob fails, I notice pretty quickly, because the page really does fail to load in my browser.
Re: First-ever DNSSEC root key rollover
#30Earlier quoted context omitted.
You make some interesting points, but it's worth adding a little extra context. For example, you mention a period of "almost 3 decades" for DNSSEC, but the first RFC for it was published barely two decades ago in 1997: https://tools.ietf.org/html/rfc2065 As a comparison, the RFC for IPv6 was first published two years earlier, in 1995: https://tools.ietf.org/html/rfc1883 and you could say that "nothing depends on" thi…
DNSSEC precedes its first RFC by several years; before that RFC, it was a DoD-funded project run by Trusted Information Systems. It's different today in a variety of ways, but the fundamental design decisions --- offline signers, authenticated denial --- date back to TIS and the USG. If LetsEncrypt broke, there would be absolute chaos across the Internet.
Maybe, but LetsEncrypt breaking would be fixed much faster than any other CA as it’s the only one where every user is automated.
Contrast that with the legacy model and the emailed zip files of cert chains alone would flood the intertubes.