DNSSEC - What doesn't it cover?

Question

I'm currently revising for an exam to do with DNS/DNSSEC.

While I know DNSSEC provides various security enhancements for DNS, I would like to dive a bit deeper(for my own thirst for knowledge!) and would like to know what is still problematic security wise even after DNSSEC is employed? After all it can't have solved all programs DNS was having with regards to security, right?

Thanks

score 1 · Accepted Answer · answered Apr 29 '10 at 14:27

The primary issues that DNSSEC don't solve are:

false data inserted at the master server - if someone hacks your DNS operator they can in theory insert false data that will be signed with your own key.
encryption of DNS queries - the content of the queries and the resulting answers is still clear text on the wire

The former problem is currently unsolved. The latter one is not really seen as a real security issue, since many people willingly allow third parties (Google, OpenDNS, etc) to see their DNS queries anyway.

"Cracks your DNS operator" or your registrar or the registry itself, which already happened. — bortzmeyer, May 03 '10 at 07:25

score 1 · Answer 2 · answered Apr 29 '10 at 14:44

1

It depends in what are your definition of "security". If we use the "CIA triad" -confidentiality, integrity and availability-, DNSSEC only apply (and was designed) for the second one: integrity.

answered Apr 29 '10 at 14:44

huguei

31
2

1

DNS done right already has "availability" - DNSSEC doesn't need to solve that. – Alnitak Apr 29 '10 at 14:51

score 1 · Answer 3 · answered Apr 29 '10 at 14:45

This question really should be, "What DOES DNSSEC do?"

To answer that, DNSSEC is a way to verify that the data you're getting back from the server is legitimate. The records are signed with a private key which can then be verified using the public key published in the record set.

It does not encrypt the records to keep people from seeing them (the whole point of DNS is to distribute that information for public consumption, so this isn't a concern in the vast majority of cases anyway).

It also does not protect against DDoS attacks, reflection attacks, amplification attacks, etc.

You might also refer to RFC 3833, Threat Analysis of the Domain Name System for more information.

some of the threats documented in RFC 3833 were addressed by later DNSSEC RFCs. §2.6 and §2.7 (proof of non-existence and wildcards) are fixed by NSEC, for example. — Alnitak, Apr 29 '10 at 14:56

score -2 · Answer 4 · edited Apr 13 '17 at 12:14

-2

The best answer to this is to have a look at DJB's writings on this:

http://cr.yp.to/djbdns/forgery.html

LWN has some good articles too:

http://lwn.net/Articles/230050/

And some great answers from this very site:

DNSCurve vs DNSSEC

edited Apr 13 '17 at 12:14

Community

1

answered Apr 29 '10 at 13:56

LapTop006

6,466
19
26

The DJB paper seems completely unrelated. – bortzmeyer May 03 '10 at 07:27

score -3 · Answer 5 · answered Apr 29 '10 at 14:00

-3

You may find this discussion interesting.

answered Apr 29 '10 at 14:00

chmeee

7,270
3
29
43

.. but irrelevant – Alnitak Apr 29 '10 at 14:50
2

Not only irrelevant but also quite trollish – bortzmeyer May 03 '10 at 07:28

DNSSEC - What doesn't it cover?

5 Answers5