Does dnssec protect against malicious registrars?

Question

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).

This is especially interesting in the context of SSL certificates. At the moment any trusted certification authority can sign any server certificate. There is a proposal, which suggests, to store the signatures in DNS instead. This is a good idea, because it reduces the number of weak links, that are able to issue malicious certificates. But it puts access to the DNS servers for name resolution and key distribution in one central place.

Answer 1

No. DNSSEC does not protect the integrity of a DNS name if the registrar for that name is malicious (or compromised). The registrar for grumpyavians.com is the ultimate source of authority for who owns grumpyavians.com (and, e.g., what is the public key for grumpyavians.com). Consequently, if the registrar is malicious or compromised, then the registrar can transfer control or otherwise subvert security.

That said, I believe the situation is not quite as bad as you feared (it is not the case that any registrar anywhere can compromise every DNS name in existence). For instance, as far as I know, some random registrar cannot take control of every domain name under .com.

Here's my understanding of how it works. Today, Verisign administers .com. That means that Verisign totally controls .com, and has the DNSSEC signing keys that lets it create arbitrary records for foo.com names. There's a long list of domain registrars, who can all register domain names under .com. The way that works is that the registrar interacts with Verisign to request that some name (say, grumpyavians.com) be assigned to it; Verisign confirms that no one already owns grumpyavians.com, then assigns it to the registrar and keeps a record of this assignment. Transferring domains between registrars happens similarly.

Let's say you own some valuable domain name under .com (say, hungryfelines.com). Who are your DNSSEC records vulnerable to? They are vulnerable to Verisign, and to your registrar. I don't believe you are vulnerable to any other registrar, assuming that the domain transfer process is adequately secured. Caveat: the domain transfer process is beyond the scope of DNSSEC, but it is a significant potential point of vulnerability in practice.