Russian TLD .RU fails DNSSEC validation • Hacker News Board

Re: Russian TLD .RU fails DNSSEC validation

#21

Post by woodruffw » Tue, Jan 30, 2024, 6:32 PM UTC

tptacek wrote: post #16

woodruffw wrote: post #10

As a side question: am I correct in reading this to imply that the two "leaf" keys here are both RSA 1024 keys? RSA 1024 has been considered within nation-state capabilities for well over a decade, and NIST has explicitly discouraged them for DNSSEC for close to a decade[1]. I can understand not using larger RSA key sizes for framing reasons, but what is stopping the DNSSEC ecosystem from using ECC? [1]: https://nvlp…

Until relatively recently, ECC DNS had (if I'm remembering Geoff Huston right) a 5% failure rate for resolvers. Towards the end, that may have mostly been a misconfiguration artifact (DNSSEC is extremely easy to misconfigure; see again Huston) but either way the perception has been that RSA is more compatible. Also: why would you bother changing at this point? DNSSEC isn't getting traction (see, once again, Geoff Hus…

Yep, I'm not a defender of DNSSEC, just not especially familiar with it. The RSA 1024 thing was surprising as an outsider!

Re: Russian TLD .RU fails DNSSEC validation

#22

Post by tptacek » Tue, Jan 30, 2024, 7:56 PM UTC

woodruffw wrote: post #21

tptacek wrote: post #16

Earlier quoted context omitted.

Until relatively recently, ECC DNS had (if I'm remembering Geoff Huston right) a 5% failure rate for resolvers. Towards the end, that may have mostly been a misconfiguration artifact (DNSSEC is extremely easy to misconfigure; see again Huston) but either way the perception has been that RSA is more compatible. Also: why would you bother changing at this point? DNSSEC isn't getting traction (see, once again, Geoff Hus…

Yep, I'm not a defender of DNSSEC, just not especially familiar with it. The RSA 1024 thing was surprising as an outsider!

Oh, yeah, no, I know you're not, I'm just relating ECC and RSA strength facts about DNSSEC. I think the observations I'm making are pretty straightforward?

Re: Russian TLD .RU fails DNSSEC validation

#23

Post by tryauuum » Tue, Jan 30, 2024, 9:00 PM UTC

naniwaduni wrote: post #19

tryauuum wrote: post #11

Earlier quoted context omitted.

DNSSEC is such a nightmare. All this "how do we make this old protocol secure and private without changing it much"

DNSSEC does absolutely nothing for privacy. It seeks to achieve strictly authentication and incidentally integrity.

when I said privacy I was had NSEC3 in mind. To be honest I have no idea how does it work / why is it a thing but it looks like it obfuscates (deleted?) subdomains to make it harder to enumerate them. This is why you see stuff like

    15bg9l6359f5ch23e34ddua6n1rihl9h.example.org

in zone file

Re: Russian TLD .RU fails DNSSEC validation

#24

Post by tptacek » Tue, Jan 30, 2024, 9:21 PM UTC

tryauuum wrote: post #23

naniwaduni wrote: post #19

Earlier quoted context omitted.

DNSSEC does absolutely nothing for privacy. It seeks to achieve strictly authentication and incidentally integrity.

when I said privacy I was had NSEC3 in mind. To be honest I have no idea how does it work / why is it a thing but it looks like it obfuscates (deleted?) subdomains to make it harder to enumerate them. This is why you see stuff like 15bg9l6359f5ch23e34ddua6n1rihl9h.example.org in zone file

Right. That doesn't really work: you can crack them like a 1990s password file, which is why there's whitelies (online-signer chaff records) to defeat that attack. Either way: it's not really what people think about when they think "privacy". It's generally the position of the architects of DNSSEC that domain names simply aren't private at all. Meanwhile: actual DNS privacy, of what domains you're visiting with your browser, is provided by DoH, not DNSSEC.