Subject: Re: Secure DNS is just weakly secure

From: Paul Vixie <[email-masked]>
Date: Tue, 14 Mar 2006 04:01:10 +0000

# ...
# Instead, if you use secure DNS, you no longer believe ISP
# infrastructure secure but still believe registries secure.
# 
# If some registry between you and your peer betrays you, your
# record can be forged by, say, redirection to wrong NS addresses
# with forged certificates and forged signatures.

there is no kind of cryptographic digital security for which it is
untrue that if someone gets your private key material including any
passcode you might be using, they can masquerade as you.  dnssec is
no more secure in that sense than kerberos or pgp or ssh.

# There are numerous ways to hide the forgery from casual
# inspection by you.
# 
# That is, secure DNS is just weakly secure.
# 
# Fortunately, weak security is just enough for most purposes
# that we can live with secure DNS.
# 
# But, why do you bother?

here, you have asked the question that leads me to bother answering.

why do i lead the struggle to universally deploy BCP38, even though
many DDoS attacks will still be possible even if this goal is reached,
and many current attacks don't utilize spoofed source addresses?

why do i push for bright-line reputation systems whereby a TCP/SMTP
source address is either known to sometimes emit spam or known never
to do so, even though there's as much spam sent now as before i began?

why do i request (and spend) a lot of money adding security features
to DNS even though we'll all have to accept and use some untrusted data
for the rest of our careers since deployment will never be universal?

why, in short, do i try to improve systems where the human element is
and will always remain the weak link in the chain?

because if nobody works to improve the situation, it WILL NOT improve.

# PS
# 
# In general, PKI (public key cryptography with third party CAs)
# is just weakly secure.

any system with human elements will have all the weaknesses of humanity.

but some humans are stronger than others, and we have to give those
humans opportunities to excel, and we have to try to work beneficially
with those who want to work beneficially with us.

i do not envy you the darkness of your world, where these things are not
important, or are not tried, or are never successfully accomplished.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 14 Mar 2006 15:23:29 +0900

Paul Vixie wrote:

> passcode you might be using, they can masquerade as you.

So? Your point has nothing to do with my point.

> because if nobody works to improve the situation, it WILL NOT improve.

Misdirected works to improve the situnation WILL NOT improve it.

							Masataka Ohta

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 14 Mar 2006 09:11:25 +0100

Working with X.509 PKI, I sometimes get similar input:
If some CA is bad they can trick you.

This is of course correct.  And it will probably even happen.
But does this mean that PKI is broken?

No, because it will cost the CA to err.  I guess the same is
valid for a DNS registrar.

Since cryptographic keys bind issuers pretty hard to their acts,
I don't think this crime is very tempting, since most criminals abstain
from activities where you get fully exposed and have to run or hide.

Naturally CAs and registrars that cover a wider sector should be
accredited in the same way as notaries and lawyers.

The most likely problem is that some entity provides fraudulent
information tricking the CA or registrar to issue something it
should not.  Although bad, this is not a high-volume fraud
that threatens the Internet, it is only about a single entity.

Anders Rundgren

----- Original Message ----- 
From: "Masataka Ohta" <[email-masked]>
To: "Paul Vixie" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, March 14, 2006 07:23
Subject: Re: Secure DNS is just weakly secure

Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 14 Mar 2006 17:23:06 +0900

Anders Rundgren wrote:

> No,

So, the conclusions in my original mail are:

	Fortunately, weak security is just enough for most purposes
	that we can live with plain DNS.

	Fortunately, weak security is just enough for most purposes
	that we can live with secure DNS.

and the quesiton is:

	But, why do you bother?

> because it will cost the CA to err.  I guess the same is

and an ISP.

						Masataka Ohta

---

From: "Brett Carr" <[email-masked]>
Date: Tue, 14 Mar 2006 10:05:17 +0100

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Masataka Ohta
> Sent: Tuesday, March 14, 2006 7:23 AM
> To: Paul Vixie
> Cc: [email-masked]
> > # If some registry between you and your peer betrays you, your # 
> > record can be forged by, say, redirection to wrong NS 
> addresses # with 
> > forged certificates and forged signatures.
> > 

Well I'm sure the people who worked on designing dnssec and those of us
currently deploying it do not believe they are misdirected. Of course the
IETF is an open communtity so you are perfectly free to come up with a
solution that is better than we currently have.

Brett..

---

From: Tony Finch <[email-masked]>
Date: Tue, 14 Mar 2006 11:11:08 +0000

> But, why do you bother?

DNSSEC reduces the number of possible attacks. In particular, it protects
you from attacks from random third party hackers.

If you are wanting to talk to my domain dotat.at, then in order to do so
you are implicitly trusting all the infrastructure behind that domain,
including NIC.AT, chiark, me, etc. This is unavoidable if you want to talk
to me.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
LYME REGIS TO LANDS END INCLUDING THE ISLES OF SCILLY: SOUTH OR SOUTHWEST 4 OR
5, BECOMING VARIABLE THEN EAST 4 OVERNIGHT. OCCASIONAL SHOWERS IN THE WEST.
MODERATE OR GOOD, BUT WITH FOG PATCHES CLOSE TO SHORE OVERNIGHT. SLIGHT OR
MODERATE, BUT ROUGH AT FIRST IN THE WEST.

---

From: Thierry Moreau <[email-masked]>
Date: Tue, 14 Mar 2006 09:14:09 -0500

> you from attacks from random third party hackers.

Indeed. This is called end-to-end security. Cryptographically merely 
shifts "control". With the DNSSEC use of digital signatures, 
cryptography shifts control from the set of DNS distributed components 
(e.g. caching nameservers where efficient control means are 
unavailable), to just a few, i.e. the registries from the queried DNS 
name up to the root (or island of security).

This leaves registry operators as the human link. Obvisouly, the 
end-user systems remain as a target of trojan horse attacks and the like.

DNSSEC does provide an intrinsicly valuable information control 
mechanism, assuming the zone walking and trust anchor key management 
issues are resolved. Whether application use of DNSSEC is justified on a 
cost-benefit analysis remains an open question.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: bert hubert <[email-masked]>
Date: Tue, 14 Mar 2006 14:58:45 +0100

> cost-benefit analysis remains an open question.

This makes me think of a pet project of mine, 'ARPSEC'.

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

---

From: Paul Vixie <[email-masked]>
Date: Tue, 14 Mar 2006 14:43:25 +0000

# > # If some registry between you and your peer betrays you, your
# > # record can be forged by, say, redirection to wrong NS addresses
# > # with forged certificates and forged signatures.
# > 
# > there is no kind of cryptographic digital security for which it is
# > untrue that if someone gets your private key material including any
# > passcode you might be using, they can masquerade as you.
# 
# So? Your point has nothing to do with my point.

i thought that you might think that.

# > because if nobody works to improve the situation, it WILL NOT improve.
# 
# Misdirected works to improve the situnation WILL NOT improve it.

"misdirected" is the assertion under discussion here.  there are threats to
dns authenticity for which DNSSEC-bis is good protection.  there will always
be other or new threats not answered by a particular technology.  as with
spam and ddos, there will never be a final and ultimate solution to all
problems related to DNS insecurity -- merely a long chain of point-solutions.

---

From: Edward Lewis <[email-masked]>
Date: Tue, 14 Mar 2006 09:52:51 -0500

At 11:18 +0900 3/14/06, Masataka Ohta wrote:

>that we can live with secure DNS.

Q:

Why would you want to *over* secure something?

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Nothin' more exciting than going to the printer to watch the toner drain...

---

From: Ben Laurie <[email-masked]>
Date: Tue, 14 Mar 2006 16:18:19 +0000

Masataka Ohta wrote:
> If some registry between you and your peer betrays you, your
> record can be forged by, say, redirection to wrong NS addresses
> with forged certificates and forged signatures.

There is no requirement in DNSSEC to trust the registry. If you would
prefer to trust your peer, then you should add his key as a trusted key
to your resolver.

This is the same as PKI - if you don't trust the CA, then do your own
key validation.

BTW, I would say that "forged" is not the word to use in the scenario
you describe, since they are correctly constructed and genuine
certificates/signatures. A better description would be "incorrect
certificates with correct signatures".

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 15 Mar 2006 18:35:41 +0900

>> you from attacks from random third party hackers.

First, random third party hackers would rather prefer attacks on
security holes of complex implementations of complex protocols.

Secondly, ISPs and DNS cache services you might use may be third
parties but not random third parties.

> Indeed. This is called end-to-end security. Cryptographically
> merely shifts "control".

Secure DNS removes "control" of ISPs, which are as reliable as
registries, but still leaves "control" of registries.

> With the DNSSEC use of digital signatures, 

Not at all. Chaching nameservers can be secure.

As I have pointed out more than ten years ago, cache contamination of
caching nameservers can be avoided by having tagged cache for glues
with the information for which zone the glue is provided.

Though, for efficiency, glues should be cached, the cached information
should be used only as glues for the same referal.

For example, if the zone "hpcl.titech.ac.jp" has the following referral
and glue:

	hpcl.titech.ac.jp NS cypress.neustar.com
	cypress.neustar.com A 131.112.32.132

the glue A may be cached for referral reply to queries at or below
"hpcl.titech.ac.jp" but should not be used to reply queries to
"ietf.org" ("cypress.neustar.com" is a NS for "ietf.org") or any
other purposed.

This is the way how proper "control" is maintained with plain DNS.

> This leaves registry operators as the human link.

And the registry operators are as reliable as ISP operators.

So, why do you bother?

						Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 15 Mar 2006 18:44:25 +0900

> prefer to trust your peer, then you should add his key as a trusted key

Indeed, there is no requirement in security to use DNSSEC.

If I can receive key from my peer privately in trusted way,
which is your requirement, I rather use shared key.

> This is the same as PKI - if you don't trust the CA, then do your own

Yes, I do, but, it means PKI hardly is an infrastructure.

							Masataka Ohta

---

From: Jim Reid <[email-masked]>
Date: Wed, 15 Mar 2006 10:13:48 +0000

> security holes of complex implementations of complex protocols.

AHA! So that explains why X.509 certificates, crypto hash algorithms  
and PGP are forever being compromised by random third party attackers  
while unsecured Windows desktops are ignored.

Your point about complexity being the enemy of security is well made.  
However vanilla flavour DNS is a complex protocol that's hard to  
implement, let alone interoperate with the installed base. It's  
already far beyond the point where security people would be comfortable.

> parties but not random third parties.

So what? If they can't be trusted, I take my secure DNS resolution  
business elsewhere. Economic Darwinism takes its course. Problem solved.

> with the information for which zone the glue is provided.

That might minimise the impact of one attack vector. However there  
are plenty of other ways of poisoning a cache. As you should know.  
These attacks are not ameliorated by tagging glue. Besides, a fix for  
cache poisoning doesn't solve the DNS security problem. It's not even  
close.

---

From: Jeroen Massar <[email-masked]>
Date: Wed, 15 Mar 2006 11:23:00 +0100

> > Tony Finch wrote:
[..]
> This is the way how proper "control" is maintained with plain DNS.

And thus I simply inject a caching DNS server with the above DNS
response, even though it didn't ask for it and tada your cache is
poisend.

Thus why bother? It avoids many many many attacks.

> And the registry operators are as reliable as ISP operators.

And there are only few registry operators compared to many ISP's.
Making only a few registry places vulnerable to any attack instead of
many unknown attack vectors over the many ISP's.

(No I am not stating that registries are secure, far from)

> So, why do you bother?

No bothering is happening, just apt-get update and get over it ;)

Long live DNSSEC!

Greets,
 Jeroen

---

From: Ben Laurie <[email-masked]>
Date: Wed, 15 Mar 2006 10:59:28 +0000

> which is your requirement, I rather use shared key.

Then:

a) You could masquerade as your peer, which doesn't sound good to me -
or your peer needs a key for each of his peers, which doesn't sound good
either.

b) You'd need to use a different standard.

> Yes, I do, but, it means PKI hardly is an infrastructure.

You will get no argument from me on that point.

Cheers,

Ben.

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 15 Mar 2006 12:08:22 +0100

Dear colleagues,

 From this thread I do not see any consensus to request that DNSSEC  
work items are to be removed from our charter.

Shall we close this discussion and get back to work.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Masataka Ohta <[email-masked]>
Date: Wed, 15 Mar 2006 22:32:58 +0900

> work items are to be removed from our charter.

Who requested such a stupid request?

At least, Paul Vixie demostrated that there are a lot of people
including powerful implememters, who don't understand secure DNS
dose not improve security.

So, we should continue discussion until DNSSEC work items are
removed from our charter.

> Shall we close this discussion and get back to work.

Indeed, we are readly to work to shutdown works on secure DNS.

							Masataka Ohta

---

From: Sean Leach <[email-masked]>
Date: Wed, 15 Mar 2006 05:55:56 -0800

> Indeed, we are readly to work to shutdown works on secure DNS.

Then stop working on it.  Those of us that would LIKE to continue  
working on it will.  Olaf - I would say this thread has outlived it's  
usefulness.

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 17 Mar 2006 08:34:34 +0900

> work items are to be removed from our charter.

Though it is unfair to declare consensus or lack of it in only
one or two days of discussion, so far, I can see the consensus that
secure DNS is just weakly secure, though some says CAs are less weak
than ISPs.

If there is no counter argument, I can close the thread.

Of course, the consensus (including that some says CAs are less weak
than ISPs) should be documented in appropriate WG IDs.

Then, let IESG decide whether the IDs should be published as standard
track or just informational.

Let people decide whether they should deploy secure DNS.

							Masataka Ohta

PS

I haven't requested that DNSSEC work items are to be removed from
our charter, yet.

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 17 Mar 2006 09:35:55 +0100

Dear Ohta san,

> one or two days of discussion

Yes, I was going to fast, but I tried to focus on work that needs to  
get done.

> than ISPs) should be documented in appropriate WG IDs.

Now you are going to fast :-) . I'd suggest you document your idea as  
personal submission. Ask if the appropriate WG, will support them as  
part of their charter, as working group document and then see if  
there will be consensus.

> I haven't requested that DNSSEC work items are to be removed from

We're trying to remove them by getting things done :-)

--Olaf

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 17 Mar 2006 22:01:05 +0900

> Yes, I was going to fast, but I tried to focus on work that needs to  

You have misbehaved.

Unlike time-limited presentation during IETF meetings, there is no
reason to stop mailing list discussion, unless the discussion is
against list policy. The list policy is:

	Messages should be on topics appropriate to the dnsext
	wg, which are various discussion of the DNS protocols
 
> personal submission.

I have already posted it as a mail, because it is a comment to other
IDs. And there are discussions, which should be reflected to IDs.

If you think all the exchanges of ideas must be done by IDs and not
by mails, I suggest you first write an ID saying so.

> We're trying to remove them by getting things done :-)

For more than 10 years, yes.

							Masataka Ohta