Subject: Secure DNS actually is not so secure.

From: Masataka Ohta <[email-masked]>
Date: Fri, 25 Jun 2004 00:41:53 +0900

Dear all;

I think all the secure DNS documents should make it explicite
that secure DNS actually is not so secure.

That is, if a zone shared by a client and a server (e.g.
the root zone) is compromized, secure DNS is also compromized.

You might think that CAs are much more secure than ISPs.
But it is not.

Thus, it is equally likely that some ISP between a server
and a client is compromized ant some CA between a server
and a client is compromized.

It should be noted that, if secure DNS is relied upon for
monetary transactions that its certificate has
authority to perform $1,000 transaction without consulting
someone managing upper limit of credential of the certificate,
the attacker can use the certificate 1,000 times a second from
1,000 different locations for 1,000 seconds to 1,000,000 or
1,000,000,000, which means there is $1,000,000,000,000 of
economical benefit/damage, which is large enough to seduce
employees of the largest CAs or, worse, terrorists.

That is, it is mandately that certificates need confirmation
everytime it is used, which negete the merit of public keys
over shared keys.

So, why do we bother to have secure DNS?

						Masataka Ohta

						Masataka Ohta 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 24 Jun 2004 12:10:49 -0400

Ohta-san:

> I think all the secure DNS documents should make it
> explicite that secure DNS actually is not so secure.

I don't think that any reasonable person sees "security"
as a binary or black-and-white item any more.  Any
security enhancement potentially still has flaws, and
there is no realistic method for perfect security.
That does not mean that security enhancements in general
are not worthwhile (although some individual ones may
be more trouble than they are worth, for some people,
in some situations).

Is there a specific piece of text you would like to
see added to a specific document or documents?  Please
make a concrete suggestion and I'm sure that the WG will
consider it.

> the root zone) is compromized, secure DNS is also compromized.

I'm not sure I understand your terminology for "compromise".
A server or set of servers could be compromised which
would allow an attacker to modify the zone and/or to
utilize/steal any private keys stored on that server.
Is that what you mean by a compromise of the zone?

If so, then in a case where the DNSSECbis zone-signing and
key-signing keys are both stored "offline" (on a well-secured
system with no direct inbound access from external systems or
from the authoritative name servers for the zone), then
"compromise of the zone" would seem to me to be a much harder
problem.  An attacker might compromise the authoritative
servers, but any changes to the zone would be unsigned--
unless the offline signers were also compromised (or the
ZSKs were stored online and were compromised).  The recovery
from this, for a well-run 

In any case, *right now* a DNS zone that has one or more
servers compromised is in trouble.  DNSSEC _does_ provide
both a reduced probability that an attacker could usefully
change the zone data, and a better ability for a zone
administrator to discover that the zone data has been
changed.  However, DNSSEC is (in my opinion) really much
more designed to address the security of data in transit
on-the-wire or in storage on a caching server rather than
data in storage on the authoritative server.

> You might think that CAs are much more secure than ISPs.

Again I'm not sure I understand your terminology.  Could
you give me an example of the CAs and ISPs of which you
speak?  I'm aware of several major ISPs that have had
real internal security problems but no well-known CA that's
had anything close to the same level of problems.

> employees of the largest CAs or, worse, terrorists.

I personally have no expectation that the security provided
by DNSSEC will ever be relied upon as the sole authenticating
factor for any financial transaction.  Anyone who so relies
does so (in my opinion) at their own peril.

Of course, right now today there are folks who have done (or
believe they have done) a risk assessment that allows them
to use only an e-mail with no signature as a commitment for
a contractual change.  For those folks, DNSSEC can't make
things any worse (not that I can see, anyway).

> everytime it is used, which negete the merit of public keys

Comparing the problems of securely distributing and managing
shared keys with the same issues for public keys, given
large enterprises with which I have some familiarity, tells
me that you are wrong.  Could you please be more specific?

> So, why do we bother to have secure DNS?

There are an entire set of reasons for the DNS Security
Extensions which have been well documented in this mailing
list's archives, but which you have not mentioned above.
Not quite sure why you believe that the above arguments
are useful.  For my part, I believe that DNSSECbis will
be very useful to a large number of users to reduce risk
from a specific set of attacks--attacks that I can mount
today using readily available tools.  *That* is why we're
bothering to work on DNSSEC.

Very Respectfully,
Rip Loomis // SAIC (but of course, speaking only for myself)

---

From: Greg Hudson <[email-masked]>
Date: Thu, 24 Jun 2004 12:50:53 -0400

> that secure DNS actually is not so secure.
[...]
> So, why do we bother to have secure DNS?

What's the point of bringing this up ten years into the process, just
before a last call?  It's not like we haven't known about this aspect of
the security model all along.  djb levelled the criticism years ago
(http://cr.yp.to/djbdns/forgery.html) and suggested "nyms", which punt
to the security of the channel through which you get the domain name;
that hasn't caught on either.

> and a client is compromized.

DNS-spoofing does not require a compromised ISP.