[95686] in North American Network Operators' Group
Re: America takes over DNS
daemon@ATHENA.MIT.EDU (J. Oquendo)
Mon Apr 2 07:40:19 2007
Date: Mon, 02 Apr 2007 07:32:44 -0400
From: "J. Oquendo" <sil@infiltrated.net>
To: michael.dillon@bt.com
Cc: nanog@merit.edu
In-Reply-To: <D03E4899F2FB3D4C8464E8C76B3B68B0221C13@E03MVC4-UKBR.domain1.systemhost.net>
Errors-To: owner-nanog@merit.edu
This is a cryptographically signed message in MIME format.
--------------ms070904070002070601050701
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
michael.dillon@bt.com wrote:
> Very interesting because it is the second story on the list this weekend
> which highlights that DNS domain registries (and ultimately the root
> zone) are a single point of failure on the Internet. Wouldn't the holder
> of these keys be the only ones able to spoof DNSSEC? And if the criminal
> community ever cracks DHS (through espionage or bribery) to acquire
> these keys, what would be the result.
>
A single bodied government which holds the keys to this is quite possibly
a bigger problem than what we currently have. Way too much censorship if
you ask me. Not to get super political here, but there is far too much
going as it is concerning what can be said, shown, viewed by too many
organizations in power as is.
>
> Given that the existing DNS is built around two disctinct classes of IP
> address, i.e. stable ones that always lead to a root nameserver, and
> unstable ones which lead to other Internet hosts, could we not design a
> more flexible naming system around that concept? Could we not have more
> than 13 stable IP addresses in the net? Could we not leverage something
> like route servers in order to find the root of a local naming
> hierarchy?
>
Problems I can see with this would be when someone on the P2P begins
injecting false data into a stream. How would the mesh be structured so
as to avoid this. Perhaps using the same methods as ICANN, or NANOG, a
group of say 50 companies can be designated the task of maintaining
root servers on a revolving basis. The server could be configured in
secure fashion (whatever this means nowadays) with maybe checksums
and pass off the information to one another. E.g.:
Verified Lookup
User --> whois something.com --> nameserver1
nameserver1 --> I see something.com at 11.11.11.11 --> nameserver2
nameserver1 --> where do you see it nameserver2
nameserver2 --> I see it at 11.11.11.11 --> nameserver1
nameserver1 --> something.com is at 11.11.11.11 --> User
Problematic Lookup
User --> whois something.com --> nameserver1
nameserver1 --> I see something.com at 11.11.11.11 --> nameserver2
nameserver1 --> where do you see it nameserver2
nameserver2 --> I see it at 22.11.11.11 --> nameserver1
nameserver2 --> where DO YOU SEE something.com --> nameserver3
nameserver3 --> something.com is at 11.11.11.11 --> nameserver1
nameserver1 --> After double checking go to 11.11.11.11 --> user
Creating entries:
nameserver1:
something.com is at 11.11.11.11 let's create a hash
# sample hashing using md5 and sha
$ echo "something.com 11.11.11.11"|shasum
8cb7294f15be3f5b95d24f0e9bf77a57d95345fb
$ echo "something.com 11.11.11.11"|md5
c48af0b24a9014ccdce8b1233ffbb052
Both combined:
8cb7294f15be3f5b95d24f0e9bf77a57d95345fbc48af0b24a9014ccdce8b1233ffbb052
Enforced Lookup:
User --> whois something.com --> nameserver1
nameserver1 --> Let me check my entry...
nameserver1 -->
8cb7294f15be3f5b95d24f0e9bf77a57d95345fbc48af0b24a9014ccdce8b1233ffbb052
nameserver1 --> After checking go to 11.11.11.11 --> user
Re-enforced Lookup:
User --> whois something.com --> nameserver1
nameserver1 --> Let me check my entry...
nameserver1 -->
8cb7294f15be3f5b95d24f0e9bf77a57d95345fbc48af0b24a90XXXXXXXXXXXXXXXXXXXX
nameserver1 --> Not what I have. What do you see --> namerserver2
nameserver2 -->
8cb7294f15be3f5b95d24f0e9bf77a57d95345fbc48af0b24a9014ccdce8b1233ffbb052
nameserver2 --> Something fishy there --> nameserver1
nameserver1 --> Unresolved domain --> User
Any nameserver can now compare that kind of hash before it sends
out replies. If the hash matches, it's legit, if not, obviously
there's a problem. What I can see happening with something like
this would be DNS administrators having to recalculate hashes
whenever they renumber one of their machines.
Something like this would also deter "criminal gangs" from
fiddling with DNS since it would likely be too difficult to
counter. Hijackings could possibly cease, as well as the
possibility of reducing malware if done correctly.
My guess is load balancing, round robin DNS, etc., could affect
this, but I'm sure other engineers here can figure out something
better than allowing any government from intervening and trying
to maintain what's perhaps one of the most fragile functions on
the Internet. Maybe even multiple checksums for sites doing
above-mentioned (load balancing, etc.)
--
====================================================
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil . infiltrated @ net http://www.infiltrated.net
The happiness of society is the end of government.
John Adams
--------------ms070904070002070601050701
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIQGDCC
BIowggNyoAMCAQICECf06hH0eobEbp27bqkXBwcwDQYJKoZIhvcNAQEFBQAwbzELMAkGA1UE
BhMCU0UxFDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9vdDAeFw0w
NTA2MDcwODA5MTBaFw0yMDA1MzAxMDQ4MzhaMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMC
VVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBDaXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5l
dHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVRO
LVVTRVJGaXJzdC1DbGllbnQgQXV0aGVudGljYXRpb24gYW5kIEVtYWlsMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsjmFpPJ9q0E7YkY3rs3BYHW8OWX5ShpHornMSMxqmNVN
NRm5pELlzkniii8efNIxB8dOtINknS4p1aJkxIW9hVE1eaROaJB7HHqkkqgX8pgV8pPMyaQy
lbsMTzC9mKALi+VuG6JG+ni8om+rWV6lL8/K2m2qL+usobNqqrcuZzWLeeEeaYji5kbNoKXq
vgvOdjp6Dpvq/NonWz1zHyLmSGHGTPNpsaguG7bUMSAsvIKKjqQOpdeJQ/wWWq8dcdcRWdq6
hw2v+vPhwvCkxWeM1tZUOt4KpLoDd7NlyP0e03RiqhjKaJMeoYV+9Udly/hNVyh00jT/MLbu
9mIwFIws6wIDAQABo4HhMIHeMB8GA1UdIwQYMBaAFK29mHo0tCb3+sQmVO8DveAky1QaMB0G
A1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/
BAUwAwEB/zB7BgNVHR8EdDByMDigNqA0hjJodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9BZGRU
cnVzdEV4dGVybmFsQ0FSb290LmNybDA2oDSgMoYwaHR0cDovL2NybC5jb21vZG8ubmV0L0Fk
ZFRydXN0RXh0ZXJuYWxDQVJvb3QuY3JsMA0GCSqGSIb3DQEBBQUAA4IBAQAZ2IkRbyispgCi
54fBm5AD236hEv0e8+LwAamUVEJrmgnEoG3XkJIEA2Z5Q3H8+G+v23ZF4jcaPd3kWQR4rBz0
g0bzes9bhHIt5UbBuhgRKfPLSXmHPLptBZ2kbWhPrXIUNqi5sf2/z3/wpGqUNVCPz4FtVbHd
WTBK322gnGQfSXzvNrv042n0+DmPWq1LhTq3Du3Tzw1EovsEv+QvcI4l+1pUBrPQxLxtjftz
Mizpm4QkLdZ/kXpoAlAfDj9N6cz1u2fo3BwuO/xOzf4CjuOoEwqlJkRl6RDyTVKnrtw+ymsy
XEFs/vVdoOr/0fqbhlhtPZZH5f4ulQTCAMyOofK7MIIFwTCCBKmgAwIBAgIQCtGhjfhz35st
CJNIS5OrJzANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcw
FQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3Jr
MSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VS
Rmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw0wNjEwMDUwMDAwMDBa
Fw0wNzEwMDUyMzU5NTlaMIHZMTUwMwYDVQQLEyxDb21vZG8gVHJ1c3QgTmV0d29yayAtIFBF
UlNPTkEgTk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW5kIENvbmRpdGlvbnMgb2Yg
dXNlOiBodHRwOi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeTEfMB0GA1UECxMWKGMpMjAw
MyBDb21vZG8gTGltaXRlZDETMBEGA1UEAxMKSi4gT3F1ZW5kbzEiMCAGCSqGSIb3DQEJARYT
c2lsQGluZmlsdHJhdGVkLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvcecKOQO
JDqytURULI+i0ju6GBa7bHBqxalyuhBT6jrSIwQmx+J5KpjuRaXQgSm73AJNSPx+qGGl1X65
w1gMZ8jHZ0nnVranOic31Um089ulE6pBY1V8MsVeiue+77xi6O/mEn8Jnea+ysIlTu+GZeQf
+W2RBTHXM6ErPKBES3UCAwEAAaOCAjAwggIsMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh8
3j2uBG59MB0GA1UdDgQWBBRuQC562baQcF8itYR4eJVy0awkFzAOBgNVHQ8BAf8EBAMCBaAw
DAYDVR0TAQH/BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZI
AYb4QgEBBAQDAgUgMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEW
HWh0dHBzOi8vc2VjdXJlLmNvbW9kby5uZXQvQ1BTMIGlBgNVHR8EgZ0wgZowTKBKoEiGRmh0
dHA6Ly9jcmwuY29tb2RvY2EuY29tL1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRp
b25hbmRFbWFpbC5jcmwwSqBIoEaGRGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9VVE4tVVNFUkZp
cnN0LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kRW1haWwuY3JsMIGGBggrBgEFBQcBAQR6MHgw
OwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL1VUTkFkZFRydXN0Q2xpZW50
Q0EuY3J0MDkGCCsGAQUFBzAChi1odHRwOi8vY3J0LmNvbW9kby5uZXQvVVROQWRkVHJ1c3RD
bGllbnRDQS5jcnQwHgYDVR0RBBcwFYETc2lsQGluZmlsdHJhdGVkLm5ldDANBgkqhkiG9w0B
AQUFAAOCAQEABj58KGEDtRZdukfsQ6F5wvMo4/yXdO/rpEYaPKEmBFOOu+o27qJ3pet9+ubi
cL5s6iPoq/pdonReD6bQKGyOmnUZdoznN7/S/sTJ65gjBogLk1BHc2JUiYsH79PuXT6kLqRJ
G3ufchBFNUuz4wSUs/j4hXRXz8vbWBncykNvtPmy1vIK4LSyccP1RIeU/uMMcneoZ5Urayso
YDlx8pAh3dL/12cTBpof3Iusl7e+TR5Vf/W3HmjzQrHyuMTueiB7lbwDhXyohjaB4FMHlhgm
lOf8SveLjvVKFZPJ5oJb/fVUKoDS6dInb0Vq09YMI0Jcwzj0CvajjtmUja/xpjcftjCCBcEw
ggSpoAMCAQICEArRoY34c9+bLQiTSEuTqycwDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNVBAYT
AlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRo
ZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29t
MTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1h
aWwwHhcNMDYxMDA1MDAwMDAwWhcNMDcxMDA1MjM1OTU5WjCB2TE1MDMGA1UECxMsQ29tb2Rv
IFRydXN0IE5ldHdvcmsgLSBQRVJTT05BIE5PVCBWQUxJREFURUQxRjBEBgNVBAsTPVRlcm1z
IGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0cDovL3d3dy5jb21vZG8ubmV0L3JlcG9zaXRv
cnkxHzAdBgNVBAsTFihjKTIwMDMgQ29tb2RvIExpbWl0ZWQxEzARBgNVBAMTCkouIE9xdWVu
ZG8xIjAgBgkqhkiG9w0BCQEWE3NpbEBpbmZpbHRyYXRlZC5uZXQwgZ8wDQYJKoZIhvcNAQEB
BQADgY0AMIGJAoGBAL3HnCjkDiQ6srVEVCyPotI7uhgWu2xwasWpcroQU+o60iMEJsfieSqY
7kWl0IEpu9wCTUj8fqhhpdV+ucNYDGfIx2dJ51a2pzonN9VJtPPbpROqQWNVfDLFXornvu+8
Yujv5hJ/CZ3mvsrCJU7vhmXkH/ltkQUx1zOhKzygREt1AgMBAAGjggIwMIICLDAfBgNVHSME
GDAWgBSJgmd9xJ0mcABLtFBIfN49rgRufTAdBgNVHQ4EFgQUbkAuetm2kHBfIrWEeHiVctGs
JBcwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwIAYDVR0lBBkwFwYIKwYBBQUHAwQG
CysGAQQBsjEBAwUCMBEGCWCGSAGG+EIBAQQEAwIFIDBGBgNVHSAEPzA9MDsGDCsGAQQBsjEB
AgEBATArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8ubmV0L0NQUzCBpQYD
VR0fBIGdMIGaMEygSqBIhkZodHRwOi8vY3JsLmNvbW9kb2NhLmNvbS9VVE4tVVNFUkZpcnN0
LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kRW1haWwuY3JsMEqgSKBGhkRodHRwOi8vY3JsLmNv
bW9kby5uZXQvVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50aWNhdGlvbmFuZEVtYWlsLmNy
bDCBhgYIKwYBBQUHAQEEejB4MDsGCCsGAQUFBzAChi9odHRwOi8vY3J0LmNvbW9kb2NhLmNv
bS9VVE5BZGRUcnVzdENsaWVudENBLmNydDA5BggrBgEFBQcwAoYtaHR0cDovL2NydC5jb21v
ZG8ubmV0L1VUTkFkZFRydXN0Q2xpZW50Q0EuY3J0MB4GA1UdEQQXMBWBE3NpbEBpbmZpbHRy
YXRlZC5uZXQwDQYJKoZIhvcNAQEFBQADggEBAAY+fChhA7UWXbpH7EOhecLzKOP8l3Tv66RG
GjyhJgRTjrvqNu6id6Xrffrm4nC+bOoj6Kv6XaJ0Xg+m0Chsjpp1GXaM5ze/0v7EyeuYIwaI
C5NQR3NiVImLB+/T7l0+pC6kSRt7n3IQRTVLs+MElLP4+IV0V8/L21gZ3MpDb7T5stbyCuC0
snHD9USHlP7jDHJ3qGeVK2srKGA5cfKQId3S/9dnEwaaH9yLrJe3vk0eVX/1tx5o80Kx8rjE
7noge5W8A4V8qIY2geBTB5YYJpTn/Er3i471ShWTyeaCW/31VCqA0unSJ29FatPWDCNCXMM4
9Ar2o47ZlI2v8aY3H7YxggPPMIIDywIBATCBwzCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBO
ZXR3b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVU
Ti1VU0VSRmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbAIQCtGhjfhz35st
CJNIS5OrJzAJBgUrDgMCGgUAoIICYTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqG
SIb3DQEJBTEPFw0wNzA0MDIxMTMyNDRaMCMGCSqGSIb3DQEJBDEWBBSuA3il12RJQEL3pUC6
F7gLqzKCfjBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAN
BggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCB1AYJKwYBBAGCNxAEMYHG
MIHDMIGuMQswCQYDVQQGEwJVUzELMAkGA1UECBMCVVQxFzAVBgNVBAcTDlNhbHQgTGFrZSBD
aXR5MR4wHAYDVQQKExVUaGUgVVNFUlRSVVNUIE5ldHdvcmsxITAfBgNVBAsTGGh0dHA6Ly93
d3cudXNlcnRydXN0LmNvbTE2MDQGA1UEAxMtVVROLVVTRVJGaXJzdC1DbGllbnQgQXV0aGVu
dGljYXRpb24gYW5kIEVtYWlsAhAK0aGN+HPfmy0Ik0hLk6snMIHWBgsqhkiG9w0BCRACCzGB
xqCBwzCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0IExha2Ug
Q2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRwOi8v
d3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhl
bnRpY2F0aW9uIGFuZCBFbWFpbAIQCtGhjfhz35stCJNIS5OrJzANBgkqhkiG9w0BAQEFAASB
gEsCMpf4jSOHiI23znnurDuoXAZxdftp56HI6efqQUAHL2GDCFO+I6pkPhI5Oh5v/aina7wB
CLGplSwhFXoA1TQSgp0sqHVHpJTVHBGAoBZ28oea+PnKALP6+7XJf/uoUiV9wLeikPp02Og/
WotFgLaPHEmUYKJRmQGoPRUT52SJAAAAAAAA
--------------ms070904070002070601050701--
