hoofbeats of zebras, was DNSSEC to be strangled at birth.

[Victor Duchovni]

On Fri, Apr 06, 2007 at 05:13:00PM -0000, John Levine wrote:

> >You assume the new .net key (and what's signed with it) would be
> >supplied to all users of the DNS, rather than used for a targeted
> >attack on one user (or a small number of users).  Why assume the
> >potential adversary will restrict himself to the dumbest possible way
> >to use the new tools you're about to hand him?
> 
> I dunno about you, but if some part of the Federal government wanted
> to mess with a particular target, it's much more likely they would
> arrange for some large NSPs do some adjusted BGP.  Or even more likely
> some guys in suits would show up at Verisign and say, "We're from
> [redacted] and we would appreciate it if you arranged for requests for
> [redacted].net from network [redacted]/15 to resolve to [redacted] for
> the next couple of weeks."
> 
> Personally, I like Paul's theory about the DHS dork with a press
> release.  He doesn't understand zones or delegation or the root
> servers or routing or anything else, but the signing key will let them
> Take Control of this Vital Resource in case of National Emergency.
> You know, like they did in New Orleans.

Exactly, no need to assume a deep conspiracy when mere incompetence
explains this quite well. I expect that this story will be long forgotten
by the time the root zone is signed, and that the keys will not be given
over to DHS or any other agency that is not ICANN/IANA or whoever is
actually responsible for the root zone at that point in time.

Note also that a small, but non-negligible number of sites obtain the
root zone via FTP, and run nameservers authoritative for ".". The zone
is small enough to make this a good idea, may even a poorly publicized
best-practice. Name server operators who serve their own root zone
should notice any changes. The "attack" is most practical against SOHO
DHCP users known to get all their DNS from upstream providers. I don't
believe this is useful enough to warrant the bad press. Time will tell
of course, but my instinct is that this is story is only interesting to
the extent that it makes the feared scenario less likely, so though I
don't find it a credible threat, the publicity may help to avert any
silliness from coming to pass.

-- 

 /"\ ASCII RIBBON                  NOTICE: If received in error,
 \ / CAMPAIGN     Victor Duchovni  please destroy and notify
  X AGAINST       IT Security,     sender. Sender does not waive
 / \ HTML MAIL    Morgan Stanley   confidentiality or privilege,
                                   and use is prohibited.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com