DNSSEC is one of very few topics where voices I respect on security seem completely opposed (WebPKI depends on DNS vs. DNS security does not matter). Is there any literature that demonstrates deep understanding of both arguments? Why are they (DNSSEC + WebPKI) never considered complimentary?

▲

ekr____ 7 hours ago | parent | next [-]

You'll have to judge for yourself whether this demonstrates deep understanding of both arguments, but I did try to be evenhanded in these posts:

https://educatedguesswork.org/posts/dns-security-dnssec/ https://educatedguesswork.org/posts/dns-security-dane/

From my perspective, the challenge with DNSSEC is that it just doesn't have a very good cost/benefit ratio. Once the WebPKI exists, "critical path" use of DNSSEC only offers modest value. Now, obviously, this article is about requiring CAs to check DNSSEC, which is out of the critical path and of some value, but it's not clear to me it's of enough value to get people to actually roll out DNSSEC.

▲

winstonwinston 6 hours ago | parent | prev | next [-]

> Why are they (DNSSEC + WebPKI) never considered complimentary?

WebPKI works without DNSSEC, whereas DANE (a more secure WebPKI replacement) depends on a robust DNSSEC deployment.

	▲	indolering 2 hours ago \| parent [-]
		It can be used alongside WebPKI. And as someone who is worried about other protocols, it sure would be nice if I could setup DNSSEC for my domain and have clients pick up on that automatically.

▲

ivanr 5 hours ago | parent | prev | next [-]

I'll share a couple of thoughts, but do read EKR's blog first:

- Web PKI is inherently insecure and can't be fixed on its own. The root problem is that the CAs we "trust" can issue certificates without technical controls. The best we can do is ask them to be nice and force them provide a degree of (certificate) transparency to enable monitoring. This is still being worked on. Further, certificates are issued without strong owner authentication, which can be subverted (and is subverted). [3]

- The (very, very) big advantage of Web PKI is that it operates online and supports handshake negotiation. As a result, iteration can happen quickly if people are motivated. A few large players can get together and effect a big change (e.g., X25519MLKEM768). DNSSEC was designed for offline operation and lacks negotiation, which means that everyone has to agree before changes can happen. Example: Kipp Hickman created SSL and Web PKI in 3 months, by himself [1]. DNSSEC took years and years.

- DNSSEC could have been fixed, but Web PKI was "good enough" and the remaining problem wasn't sufficiently critical.

- A few big corporations control this space, and they chose Web PKI.

- A humongous amount of resources has been spent on iterating and improving Web PKI in the last 30 years. So many people configuring certificates, breaking stuff, certificates expiring... we've wasted so much of our collective lives. There is a parallel universe in which encryption keys sit in DNS and, in it, no one has to care about certificate rotation.

- DNSSEC can't ever work end-to-end because of DNS ossification. End-user software (e.g., browsers) can't reliably obtain any new DNS resource records, be it DANE or SVCB/HTTPS.

- The one remaining realistic use for DNSSEC is to bootstrap Web PKI and, possibly, secure server-to-server communication. This is happening, now that CAs are required to validate DNSSEC. This one changes finally makes it possible to configure strong cryptographic validation before certificate issuance. [2]

[1] https://www.feistyduck.com/newsletter/issue_131_the_legend_o...

[2] https://www.feistyduck.com/newsletter/issue_126_internet_pki...

[3] https://redsift.com/guides/a-guide-to-high-assurance-certifi...

▲

TZubiri 4 hours ago | parent | prev | next [-]

To add a dissenting voice.

I've worked with small businesses and even small technical teams as a DNS consultant specifically.

DNS has only been a source of issues and confusion and not at all related to any requirements, just a form of checkbox implementation.

I do understand it's one of those technologies that are developed due to legitimate requirements, but it flows downstream and people just adopt it without really understanding the simpler solutions or what exactly it's meant to do.

That said if I had ever gotten a bigger client like a TLD registrar or a downstream registrar, then sure I would have had to work with it, but I've only ever had to learn how to uninstall it actually.

▲

gzread an hour ago | parent [-]

Can you explain better the most common problems you run into? I wonder if they can be solved.

	▲	vbezhenar 13 minutes ago \| parent [-]
		My two most common problems: 1. Need to change IP as soon as possible, but DNS record has huge TTL (e.g. 24h). 2. Client ISP DNS does not resolve my domain and it's absolutely not clear how to proceed from here. I don't have connections in huge ISPs, writing stuff to ISP support is as effective as throwing stones in the lake. Funnily enough, for both cases, /etc/hosts or its Windows equivalent comes to the rescue.

▲

indolering 7 hours ago | parent | prev [-]

Bad arguments and FUD when it was being rolled out. Sysadmins also don't want to touch working infra code, you can see that with AWS lagging on IPv6.

▲

tptacek 7 hours ago | parent [-]

Who's the most reputable cryptographer you can think of who publicly supports DNSSEC? We'd like to interview them on SCW.

▲

indolering 6 hours ago | parent [-]

You are going to complain that the key sizes are too small despite the guidelines being updated a long time ago. Then you will argue adoption of larger keys sizes is to low. Then you will argue that we should just not sign domain name authority delegation records at all (i.e. DNSSEC) and that we should abandon shoring up authenticated DNS because there is no adoption.

You have any cryptographers that are satisfied with unauthenticated name server checks?

▲

tptacek 6 hours ago | parent [-]

Yes? Lots of them? But also: you didn't answer my question.

▲

indolering 5 hours ago | parent [-]

Okay, but after this I have to go back to work.

You got a point: 1k isn't great and of course mainstream cryptographers will advocate for higher. That doesn't change that it's still acceptable within the existing security model nor that better alternatives are available. The cryptographic strength of DNSSEC isn't a limiting factor that fatally dooms the whole project. We have to upgrade the crypto used in large-scale infrastructure all the time!

And yes, uptake of better crypto is poor but I find chicken-and-egg arguments disingenuous when coming from someone who zealously advocates to make it worse. Furthermore, your alternative is no signing of DNS records. Find me a cryptographer who thinks no PKI is a better alternative. I know DJB griped about DNSSEC when proposing DNSCurve, which protects the privacy of the payload but not the intergrity of the payload.

▲

3eb7988a1663 an hour ago | parent | next [-]

Is this a bot gone rogue? Parent asked for a person, and you are shadow-boxing with unasked questions.

	▲	gzread an hour ago \| parent [-]
		The question was "can you find me some reputable cryptographers that support your position?" which is just ad hominem and should be ignored as such, except it does indicate that the person asking it doesn't have any better argument than ad hominem.

▲

tptacek 5 hours ago | parent | prev [-]

Sorry, but I asked who's the most reputable cryptographer you can think of who publicly supports DNSSEC? I asked because we'd like to interview them on SCW.

▲

indolering 2 hours ago | parent [-]

More rhetorical dunking instead of engaging with the substantive technical issues. I'm done.

	▲	tptacek 2 hours ago \| parent [-]
		That is a weird answer to a very simple question but I'll take that as "I can't think of any". Someone else can answer instead.