Re: DNSSEC Deployment

[John Kristoff <jtk () CYMRU COM>]

On Mon, 17 May 2010 11:53:35 -0700
Michael Sinatra <michael () RANCID BERKELEY EDU> wrote:

> I am interested in the source of your skepticism, and this being a
> security list, it's probably a good venue to discuss it.  What's on
> your mind?

Chime in?  Don't mind if I do.  :-)

I think it was in the summer before the Kaminsky disclosure that I
asked more than one of the authors and contributors to the
specifications about DNSSEC's inevitable adoption by the masses.  They
all said it wasn't going to happen.  Then in January or so Kaminsky
revealed to a select group the exploit he discovered.  By the time it
went public there was a decent sized chorus of people who were calling
for DNSSEC as the only real solution to this problem, including
Kaminsky.  So the death of DNSSEC was at least postponed and has been
seeing significant deployment in the upper hierarchies of the name
space.  If that activity even happened at all, it wouldn't have
happened as rapidly without Kaminsky.  I think its reasonable to be
skeptical based on that alone.  After all, we didn't see a wave of
exploits and there are still lots of vulnerable servers out there.

There are still a handful of clueful people who remain skeptical about
all the recent DNSSEC activity.  I'm one of them.  I'm not saying don't
do it, I'm just doubting the overall utility, effort and motivations of
some people, based on my experience.

For example, I've asked repeatedly for operators to show some convincing
evidence of the Kaminsky attack being used in the wild, including
Kaminsky himself.  So far I've seen none.  I don't doubt it has
happened, I just haven't seen it.  I'd love to see it.  I've got a tool
that does it, but I've never seen it or a knock-off used in the wild.
Maybe as long as the DNS changer infections and malware works, who
needs to poison caches?

That said, there may be some utility with DNSSEC beyond the Kaminsky
cache poison and if so great.  I'd love to hear how its helped for
real problems if you can share some.  I'd love to be able to
demonstrate to folks how DNSSEC has helped those that use it.  We
should be updating our Secure BIND Template soon.  I'm assuming we
should add the necessary DNSSEC bits there for it?  Feel free to send
your comments about that or other secure BIND items off line if you have
them.

John