Re: [gentoo-dev] DNSSEC (w/ DLV) live on *.dev.gentoo.org

[Doug Goldstein]

On Sun, Jan 6, 2013 at 7:31 PM, Robin H. Johnson <robbat2@g.o> wrote:
> Just a heads up,
>
> DNSSEC is now live on *.dev.gentoo.org hosts.

So for those that had to look up some or all of what Robin mentioned,
I'll summarize below.

>
> There is a DLV anchor registered at dlv.isc.org, so all public DNSSEC
> lookups within the domain should work fine.

DLV allows you to break out of the traditional each parent needs to be
signed and has an aside database that can confirm a specific node.
Very useful when the TLD didn't support signing or if a DNS provider
you use doesn't support DNSSEC. Stands for DNSSEC Lookaside
Validation.

>
> Here's visualisation on my two test cases:
> http://dnsviz.net/d/dev.gentoo.org/dnssec/
> http://dnsviz.net/d/mv78100.arm.dev.gentoo.org/dnssec/
>
> If there are no problems reported in a week or two, I'm going to enable
> this for the rest of our DNS zones, as well as registering the DS
> records with the TLD.

Basically getting rid of the need for the DLV and having the whole
chain signed from the root down to each domain.


> Thereafter, I'd also like to deploy DANE and SSH
> fingerprints in DNS, and remove our reliance any elements of the CA
> chain.

SSH supports a specific record called SSHFP which stores the hosts key
for validation. To against it when it enabled you should be able to do
something like:

$ ssh dev.gentoo.org -o VerifyHostKeyDNS=yes

DANE is DNS-based Authentication of Named Entities. Looks like its a
working group to add more public keys into DNS and get applications or
protocols to support it.

>
> I haven't implemented NSEC3 by way of a conscious choice. I don't see
> the need for any private information in our DNS records - simply
> obscuring them isn't really security.

NSEC3 is related to exposing the entities in your whole DNS record.
With DNSSEC you end up getting the whole zone to verify that its
signed. This has the side effect if you had www.mycompany.com but you
also had secret.mycompany.com, with DNSSEC your hostname secret would
be reveled as existing. NSEC3 attempts to mitigate this.

For more info on everything see:
http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions
>
> --
> Robin Hugh Johnson
> Gentoo Linux: Developer, Trustee & Infrastructure Lead
> E-Mail     : robbat2@g.o
> GnuPG FP   : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
>

Excellent job getting us DNSSEC support btw!

-- 
Doug Goldstein