Fortunately, I was spared from witnessing any swamping in this DNSSEC, and all credit goes to onenz for instigating positive transformation.
DNSSEC KSK rollover breaks DNS resolution for .nz domains
21–30 of 181 posts
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#22Earlier quoted context omitted.
Isn't DNSSEC basically obsoleted by DoH?
They serve different purposes. DoH protects DNS information while in flight. DNSSEC cryptographicly signs DNS records so they can be validated as being created by the owner of the domain. With only DoH you can be assured of privacy in flight and that the response hasn't been changed in flight; however, you don't know that the records on the server you connected to have not been manipulated.
The motivating use case for "cryptographically signing DNS records so they can be validated as being created by the owner of the domain" was the protection of those records in flight, which is something DoH does.
A reminder that DNSSEC's "cryptographic security" coalesces to the single AD=true bit in the DNS header by the time DNS responses hit your browser; DNSSEC is a server-to-server protocol. So in almost all cases, save those in which nerds have run full recursers on their desktops, the server trust situation with DNSSEC is largely the same as that of DoH.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#23If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights.
Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug.
Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues with accidents is a real problem. No one however would sell cars without locks.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#24Earlier quoted context omitted.
> DoH has massively better deployment stats than DNSSEC, so this is plausible Is this actually true where it matters? (i.e. the root servers and authoritative servers for TLDs)?
Where what matters? On-path DNS attacks occur everywhere across the Internet, and are probably more common on the lookup side and at the edges. Certainly, the use of DoH to protect authority transactions isn't common, yet!
The most devastating and primary attack I am worried about is someone obtaining a TLS certificate for my domain via services like Let's Encrypt.
Thus, I really care about LE getting the right IP, I don't care about random users' DNS getting hijacked because their browser will reject the missing/invalid certificate.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#25If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues…
Seems simple: we should abandon these particular car door locks, but not necessarily the concept of car door locks altogether.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#26Earlier quoted context omitted.
Where what matters? On-path DNS attacks occur everywhere across the Internet, and are probably more common on the lookup side and at the edges. Certainly, the use of DoH to protect authority transactions isn't common, yet!
The most devastating and primary attack I am worried about is someone obtaining a TLS certificate for my domain via services like Let's Encrypt. Thus, I really care about LE getting the right IP, I don't care about random users' DNS getting hijacked because their browser will reject the missing/invalid certificate.
LetEncrypt does validate DNSSEC signatures (when they exist), but CA's aren't even required to do that. LetsEncrypt also does multi-perspective lookups, so a single hijacked DNS transaction or poisoned cache is insufficient to trick it. Hopefully, at some point in the not-too-distant future, LE's multi-perspective lookup will generate data we can look at about the frequency of DNS attacks on certificate issuance. I expect it to be quite rare, because it's an elaborate attack with a weak payoff.
The right way to think about this CA issue is this:
* The largest, best-funded, savviest security teams in tech are, like the rest of tech, not signing their domains; the major TLDs are overwhelmingly not signed (there is low single digit uptake in .COM for instance, and what's there is overwhelmingly not big companies but rather random domains signed by registrars that auto-sign). Nobody who's actually targeted for CA misissuance attacks uses DNSSEC to mitigate that threat.
* The WebPKI already has a system in place to guard against misissuance that, unlike DNSSEC, actually does work: Certificate Transparency. So if you're actually concerned about CAs not issuing bogus certs for you, match your revealed preferences to your stated ones and set up CT monitoring.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#27Earlier quoted context omitted.
Isn't DNSSEC basically obsoleted by DoH?
In a sense, yes, but not so much so that DoH is a dispositive argument for deprecating it. The difference is that DoH protects transactions and DNSSEC protects the authenticity of records. It's perfectly possible for a DoH server to feed you bogus cached records; you have to trust the DoH server you're talking to, where you wouldn't have to do that if all the records on the chain of lookups you're doing are signed wi…
I think the best argument for DoH being the killing blow to DNSSEC is that not only does DoH overlap a lot with the security features DNSSEC is trying to be the solution for, but DoH also gives you arguably more important security features that DNSSEC does not and cannot reasonably provide.
This is particularly true if your security model also includes things like TLS to secure your communications with whatever domain you just resolved. In that scenario, the features DoH provides that DNSSEC does not (e.g. lookup confidentiality) are still quite useful, while the 5% of DNSSEC use-cases that DoH doesn't cover are essentially redundant if not better provided elsewhere in your protocol stack.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#28If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues…
> or is the solution to fix the problem of the car doors staying locked when submerged into water?
The natural progression is for hijackers to then carry buckets of water or spray cans and target the sensors that detect a water scenario.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#29If a safety upgrade to driving a car made people crash their cars more, you'd call that a bug. For DNS it's a feature called DNSSEC.
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues…
Locked doors can help prevent the door from flying open in an accident, too.
Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains
#30Earlier quoted context omitted.
Some car automatically lock their doors during driving in order to prevent hijackings, especially at red lights. Same cars has issues with drivers being locked inside if the car goes into the water. That is a bug. Is the solution to abandon locks on cars, or is the solution to fix the problem of the car doors staying locked when submerged into water? The security system by now is fairly advanced and addressing issues…
Seems simple: we should abandon these particular car door locks, but not necessarily the concept of car door locks altogether.
If we follow this analogy further, why should we keep the concept of car doors if particular car locks can be made with bugs in them? Doesn't the possibility of bugs in locks means that there will always be a risk, even if we abandon specific locks that has demonstrated to have a bug in them?