Fedora 21 To Have DNSSEC Validation Enabled By Default

http://www.internetsociety.org/deploy360/blog/2014/05/fedora-21-to-have-dnssec-validation-enabled-by-default/

by danyork • 12 years ago

44 43 12 years ago

tptacek7• 12 years ago

DNSSEC. Take everything you don't like about the CA system. Sign it over to the government, because everyone knows they'll never manipulate the DNS to accomplish a policy goal. Then bake it, along with 1990s-era RSA cryptography, into the core of the Internet.

Thanks, Fedora.

jg03• 12 years ago

Most modern crypto is all but banned by Fedora's (really Redhat's) packaging policies. They only recently agreed to enable ECDSA in OpenSSL, and even then, only with NIST curves. There's a lot of other very shady overrides and limitations they impose on crytpo packages too, and any questions about them are invariably met with a chorus of "we are not at liberty to comment" from some lawyer type. NSA clearly have them by the balls.

jamespo• 12 years ago

More details please

melville_X• 12 years ago

The NSA uses Fedora as their standard laptop distro. There will definitely be influence on Fedora from that direction.

axaxs2• 12 years ago

I'm not sure I follow your comment. How do you see DNSSEC as signing anything over to the government? The point of DNSSEC was/is solely to prevent cache poisoning by "chaining" answers from root to auth with signatures. It only proves the answer provided is correct by DNS means. It does not attempt to guarantee authenticity of a destination. Also, DNSSEC supports multiple algorithms, including ECDSA, though RSA is the most widely used at the moment. Is it perfect? Of course not. But it's out there now, and it works for what it was designed for.

tptacek7• 12 years ago

The roots of the DNS tree are controlled by world governments. The roots of the DNSSEC PKI are the roots of the DNS tree. And, no, the point of DNSSEC isn't solely to prevent cache poisoning; in fact, the motivating use case for DNSSEC in 2014 is DANE, which replaces the CA hierarchy with DNSSEC.

andreaso• 12 years ago

Well, despite its imperfections, how does DNSSEC worsen security compared to regular DNS? Besides, it's not like the use of DNSSEC prevent you from continuing to also rely on additional measures; such as good old fashions CAs, or something better.

floatboth2• 12 years ago

Well, only ICANN being able to issue fake signatures is much better than hundreds of random organizations around the world being able to do so.

dfc8• 12 years ago

  > Sign it over to the government

This is already something I do not like about the CA system. I do not understand why people talk about DNSSEC as if it is more of a land grab by government than the currently deployed CA trust model. The last time[^1] this came up it seemed like we agreed that the CA infrastructure and DNSSEC are essentially the same when it comes to nation-state involvement/interference/infestation. Is the "sign it over to the government" bit merely a rhetorical device employed to drive the point home or has something changed?

[^1]: https://news.ycombinator.com/item?id=7615911

tptacek7• 12 years ago

One difference between the CA system and DNSSEC w/r/t/ government dependence is that DNSSEC's dependence on government fiat is explicit and de jure, and the CA system's is implied and de facto.

Another difference between CA and DNSSEC government dependence is that DNSSEC is, as I said, baked into the core of the Internet; it sets policy for name resolution. It's difficult to override decisions made by DNS/DNSSEC. The same isn't true of the CA system; for instance, everyone using Chrome and Firefox is routinely overriding the CA system when they use Google Mail.

No, it's not simply a rhetorical device.

IvyMike3• 12 years ago

I remember seeing you mention a draft of an DNSSEC "jeremiad", but I never saw the final product. A quick Google search doesn't find it. Has it been made available to a wider audience yet?

tptacek7• 12 years ago

No, not yet. It's 7000 words long (I cover a lot of detail, including stuff from pre-DNSSECter and pre-DNSSECbis, and a lot of it doesn't really need to be there). I'll post it someday soonish.

peterwwillis• 12 years ago

I'm not a big fan of Fedora's toxic adoption of shitty technology, but it would be unfair to lay a lot of blame on Fedora for this. You aren't forced to use DNSSEC, it's just going to use DNSSEC if a domain is set up to use it. The people to blame for the adoption of DNSSEC are the asshats that try to push it as a solution for all our problems, or mandate it across organizations.

Where Fedora does have blame is the extensive weasel language they use to pretend DNSSEC is the only solution for providing "trust". DNSCurve doesn't exist according to Fedora.

wtallis• 12 years ago

CeroWrt picked up the DNSSEC-enabled version of dnsmasq as soon as it was released, and it's been a huge hassle even among that small and technically capable userbase. Fedora has done more to try to make it usable (detecting captive portals, etc.), but there are simply too many broken networks and DNS servers out there for DNSSEC to be used to do anything more strict than putting a red flag in the browser's URL bar.

floatboth2• 12 years ago

FreeBSD 10 ships with Unbound in the base system too... Sadly, it's not enabled by default, but a lot of people enable it for performance (caching) and they get security for free.

# sysrc local_unbound_enable=YES # service local_unbound start

Fedora 21 To Have DNSSEC Validation Enabled By Default

Related Stories