1. DNS/DNSSEC/good-bad

• http://xs.powerdns.com/presentation-hitb/ http://xs.powerdns.com/presentation-hitb/dnssec-good-very-bad.pdf

DNSSEC protects against

• ”Spoofing attacks”
  • Large amounts of spoofed packets with 'improved answers' try to get accepted as the real thing
• Unreliable secondaries/slaves
  • Your slave/secondary might fiddle with your data
• Unreliable governments and service providers
  • Might inject advertisements or redirect your vital facebook updates

第二の点、セカンダリサーバが信用できない時に改善できる可能性はありそう。

---

DNSSEC: How compelling?

• The threats on the previous page are not immediate

• Post RFC5452 spoofing attacks are very hard,
• you can pick your secondaries with care, and
• governments don't need DNS to get your packets.

2. 他の理由

脅迫的な理由は省略(客が求めるから、など）

 great excuse to clean up your DNS!

こうくるか。　順序が逆じゃないか。

  DNS設定がきちんとしていないとDNSSECは使えません。

DNSSECに対応するだけでなく、DNSをきちんと設定できない業者は生き残れないというのは正しそう。

• そうなって欲しいものです。 -- ToshinoriMaeno 2011-06-11 03:33:24

3. slide page 24

On the delegation issue

• Each name in DNSSEC has exactly ONE signature(set)
  • So if ns1.fox-it.com is part of the .com zone, AND part of the fox-it.com zone, it will only be signed in the fox-it.com zone

And not in com!

• So how do we perform a secure delegation?
  • WE DON'T!

So if your zone is not signed, but .com is, you don't benefit at all

4. slide 25

If your zone IS signed, verification only really happens at the very end

•  The delegating answer from COM is not verified

5. slide 26

DNSSEC technique: denial of service

• Since delegating answers, for example from .com, are not themselves DNSSEC secured,
  • they can be modified at will For example, to point at 127.0.0.1
• Since DNSSEC verification only happens at the end
  • Or in this case, not at all

This means that DNSSEC does nothing to protect the interim resolution steps

6. slide 31

Current DNSSEC deployments are secure up to the ISPs resolver

• ”Last mile” is unsecured!

7. slide 32

End-to-End DNSSEC

• Wow! So why are people pushing providers to ”do” DNSSEC?
  • No idea
• Solution right now is for everyone to run a validating resolver (would kill the internet)

Better solutions mean that the ISP resolver ships all the signing proof to the stub resolver in the client PC (nice)

• Stub resolvers are limited though..
• browsers themselves might do the validation though!

8. xxx

Downgrade attacks area big worry, it is very tricky to encode if a domain has DNSSEC enabled

Unsure how to deal with 'degrading' a broken protocol

9. Summary

そこにある。使える。でも、不良も多い。問題も多い。 ...