Slashdot Log In
DHS Wants Master Key for DNS
Posted by
Zonk
on Sat Mar 31, 2007 12:33 PM
from the they-own-all-the-locks-and-doors dept.
from the they-own-all-the-locks-and-doors dept.
An anonymous reader writes "At an ICANN meeting in Lisbon, the US Department of Homeland Security made it clear that it has requested the master key for the DNS root zone. The key will play an important role in the new DNSSec security extension, because it will make spoofing IP-addresses impossible. By forcing the IANA to hand out a copy of the master key, the US government will be the only institution that is able to spoof IP addresses and be able to break into computers connected to the Internet without much effort. There's a further complication, of course, because even 'if the IANA retains the key ... the US government still reserves the right to oversee ICANN/IANA. If the keys are then handed over to ICANN/IANA, there would be even less of an incentive [for the U.S.] to give up this role as a monitor. As a result, the DHS's demands will probably only heat up the debate about US dominance of the control of Internet resources.'"
Related Stories
[+]
Technology: ICANN Wants Immunity 235 comments
rprins writes "In what is perhaps a reaction to recent Homeland Security demands, a strategic report by ICANN suggests that it should take on the model of a private international organization (PDF). That would make ICANN immune from US law and regulations. However, it's unlikely that the Bush administration would grant ICANN these privileges. So the organization might opt to relocate to Switzerland where such privileges are easier to attain."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
DNSSec (Score:5, Informative)
No. It secures DNS. So you cant spoof domain names. It secures that the DNS Server is authorative so the DNS query was answered right. If somebody spoofes an IP in your network, you won't be saved.
Re:DNSSec (Score:5, Insightful)
Parent
Re:DNSSec (Score:5, Funny)
Parent
Re:DNSSec (Score:5, Insightful)
Parent
Re:DNSSec (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
Re:DNSSec (Score:5, Insightful)
In other words, it's perfectly possible to be neutral *and* an asshole. I'm not saying Switzerland is either (I haven't read up on this), but generally speaking, there is no contradiction between your claims and those of the GP.
Parent
Re:DNSSec (Score:5, Interesting)
Now, a DNS system that was largely immune to DoS attacks, that would be useful. That's the real problem we face with DNS. But dnssec doesn't help with that at all.
Parent
Re: (Score:3, Insightful)
I fixed your spelling but that's minor. I'm a US citizen, but what in the world ever gave you the idea that we the US people actually believe those jerks inside the beltway? I don't trust any of them. I just hope we can survive as a country till Noon Jan 20, 2009. Regardless of who wins the not too well concealed game of musical chairs, we at least will be rid of one 'born again Christian' and ca
Re:DNSSec (Score:5, Insightful)
The whole idea of ICANN as I see it, is to assure that the net works, FOR EVERYONE. And yes, IMO ICANN has made some mistakes, but they pale in comparison to the mistakes that would be made if our government had access to the master keys, and could use the internet as just another weapon, for whatever purpose they might have in mind this week/month/year. That scenario scares me shitless.
The internet has been IMO, the greatest tool ever in terms of understanding our fellow humans. The near instant communications, not between governments who may have an agenda, but between people (who may in fact also have an agenda) has allowed those of us who are willing to learn, to learn what makes the other guy tick. Sadly, we seem to be all too infested with those who not only have an agenda, but are only willing to learn how to use it to their advantage and to hell with everybody else. These are the same individuals/groups/governments that refuse to learn from history, and are therefore doomed to repeat every mistake made over written history, just to see if they can make it work this time around. This is the same bunch who, when it blows up in their faces, always has a ready scapegoat, usually called the other guy...
Besides, we already have the "plug you out" in the form of the RBL, which has been used to unplug an errant domain or country, several times. The point is that this has for the most part, been applied sparingly, and only after repeated warnings to the offending region or country.
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The way of the world is to praise dead saints and prosecute live ones.
-- Nathaniel Howe
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Er, no, that's what DNSSec prevents. Just as SSL stops man in the middle attacks for normal TCP traffic, DNSSec makes sure the domain query responses are authentic. The man in the middle doesn't have the key and cannot sign his forged response; he can only forward legitimate responses.
Incentive for alternative roots (Score:5, Insightful)
Granted, I won't be fully trusting the information from either set, so it's not as if my system security is dependant on it.
Re:Incentive for alternative roots (Score:5, Insightful)
By the way, how scary is it that DHS used to be the commonly used acronym associated with "Department of Human Services". And now this...
Good to know that DHS can put its hands in ANYTHING regardless of nature as long as they claim it has some association in some minor (or even non-existent but hypothetical) way.
Parent
Re: (Score:3, Insightful)
Re:Incentive for alternative roots (Score:5, Insightful)
Parent
Re:Incentive for alternative roots (Score:5, Insightful)
I hope they do that and piss off rest of the world so that they form an independent organization for such matters.
Parent
Re:Incentive for alternative roots (Score:4, Insightful)
You can be assured that, whatever information is collected on you by the government will not be adequately protected, and will be abused. Power grabs like this one must be resisted.
Parent
Re:Incentive for alternative roots (Score:5, Insightful)
Terrorism is the act of inciting TERROR. I'm not terrified of losing all of my money, or of someone owning my computers or even disrupting my Internet connection. Being cut to pieces by rusty shrapnel, or possibly tortured while tied down in a dark room. Now *that* incites terror. Having to fight for my survival after being severely injured. THAT incites terror. If my computers or networks cease to function, it is inconvenience, NOT friggin' terrorism. People need to stop lightly throwing that word around. Terrorists don't give a fuck about your fucking computer or money. They care about SCARING THE HELL OUT OF YOU THROUGH VIOLENCE. In that regard, they've done really well (been to an airport lately?).
Same goes for 'cyberterrorism'. An interesting paper on the topic presented by Jay Dyson at Toorcon 2002: http://www.treachery.net/articles_papers/tutorial
Parent
This could get complicated (Score:3, Interesting)
Now, imagine if ISPs or countries worldwide could choose which set of root servers to use. Imagine if ISPs and go
Re: (Score:3, Insightful)
Alternative Keys, not Alternative Roots (Score:3, Insightful)
Th
Re: (Score:3, Insightful)
Well if that's the case then I guess theres no point in doing anything about it.
Re:Incentive for alternative roots (Score:4, Interesting)
God, it sounds like the exact same ideas that the USSR had running puppet governments in the other Soviet States.
Parent
Maybe this will be more to your liking ... (Score:5, Insightful)
There
In any event, I didn't perceive his remarks as being particularly U.S.-centric, although it's popular hereabouts to redirect any commentary about Internet infrastructure into criticisms of U.S. policies. Odd that, of all the various services and protocols that traverse the Internet, we get heat for one that has always been run rather well. We are the ones that have, like it or not, run the roots with more even-handedness than most countries around the world would have. Hell, we even let a bunch of hardline Communist states on board, although none of them seem particularly grateful.
Maybe that bothers you, that you don't really have any valid criticisms of our policies towards "Internet governance". Maybe you'd like to invent some reason to "wrest control of the Internet away from the United States" (whatever that means
China's attitude towards the Internet is one that is, unfortunately, becoming more popular with governments of various stripes. They day will come the people of this planet will wish someone were still managing the global DNS infrastructure with something resembling the United States' largely hands-off approach. Don't count on that though.
God, it sounds like the exact same ideas that the USSR had running puppet governments in the other Soviet States.
I don't know what to do with this one. Comparing 13 or so server banks around the world with a nation that annexed multiple countries by main strength and created a true Empire
Parent
wtf! (Score:5, Insightful)
Didnt know that spoofing an IP what all it took to break into a computer.....
How are you gentlemen. (Score:4, Funny)
Sure, you can have the master key... (Score:5, Funny)
Re:Sure, you can have the master key... (Score:5, Funny)
-- DHS.
Parent
Multiple keys (Score:3, Insightful)
I'm surprised the US Government is doing this; I'd have expected them to obtain the key through back channels rather than out-and-out demanding it.
Re: (Score:3, Informative)
The result is that instead of computers being configure to trust a single root zone key from IANA, it is likely that every ccTLD will have its own key, and that the standard configuration of DNS as shipped with an OS or distribution will contain the public keys or hashes for every one of them. This is argu
Subby failed reading comprehension (Score:5, Informative)
Should U.S. DHS be trusted? (Score:5, Interesting)
The crucial signing key is for Windows Update (Score:5, Insightful)
The truly powerful signing key is for Windows Update. If you have that key, you can take over every Microsoft computer in the world . Change the operating system. Install anything, including a new key. Reboot the machine.
Who has that key? Do we know?
Whoever has both the DNS root key and the Windows Update signing key rules the Internet. Or at least all the Microsoft client systems. They can redirect Windows Update requests to themselves, then download their own update and have it accepted.
Unfortunately, this isn't a joke.
Re:The crucial signing key is for Windows Update (Score:4, Insightful)
You can already take over every microsoft computer in the world. All it takes is a zero day exploit. How exactly is a spam botnet fundementally different from a botnet controlled by the US Government?
The security of encryption keys is only a concern when the security of the rest of the system is not in quesiton.
Parent
No, it's not a joke. (Score:5, Interesting)
If you can force a Windows Update cycle, you can change the hard-coded values. Microsoft Update can patch any part of the OS and can force a reboot. (A reboot can be forced on any machine with updates turned on, even if auto reboot is supposedly turned off.)
If you can make changes to DNS, you can change the IP address for "the important *.microsoft.com sites", redirecting the updates to an attack site.
So possession of both of those keys gives full control of all Windows Update enabled clients.
Parent
We asked, you spoke, we listened. END OF STORY (Score:3, Funny)
We are denied the key.
We deny having the key.
out of control (Score:5, Insightful)
Routing and private keys? (Score:4, Interesting)
In any case my boxes don't give access to just the IP address, they give access based on private keys, DNS, and the IP address. Another case of government technical cluelessness thinking that the master key unlocks ALL DA COMPUTORS IN DA VERLD?
You know... (Score:5, Interesting)
Now, though, I'm starting to see where I went wrong. I was assuming that the government of the United States could never be as fucked up as the one in, say, China. I was being horribly short-sighted. I should have known that this kind of shit was only a matter of time.
So how much worse could letting the U.N. have control of ICANN be than something like this? I say fuck it. Let them have it, and give it some independent oversight. For the life of me, I cannot believe that I am actually looking to foreign nations to ensure the neutrality and openness of the Internet, but there you have it.
Re:You know... (Score:5, Interesting)
Parent
Re: (Score:3, Interesting)
Irrelevant. No one country should have control of a global resource. Even ignoring the potential for abuse, global resources should be managed globally, it's as simple as that.
I cannot believe that I am actually looking to foreign nations to ensure the neutrality and openness of the Internet
Yeah, because us dirty foreigners don't even know how to spell "freedom", let alone have any respect for it.
Hah. The US government has answered. (Score:4, Funny)
How is this significantly different? (Score:5, Insightful)
Right now, Verisign (or any of the widely-trusted X.509/SSL certificate authorities) can generate fake certificates for arbitrary sites, and your ISP can poison the DNS (from your perspective).
Incompetent government employees (or corrupt or foreign governments) are not the only adversaries we need to deal with. DNSSEC, like the current HTTPS trust system, reduces the number of potential attackers, but it doesn't eliminate them all. We know this, and we deal with it by only vesting a limited amount of trust in these systems.
The discussion should not be about whether or not the US DHS specifically should be given access to the keys; The discussion should be about the importance of minimizing the number of points where the system can be attacked: Only those entities who strictly need the keys in order to administer the DNSSEC system should be given access. The DHS doesn't need DNSSEC keys in order to make DNSSEC work, so the DHS should not get the keys. It's as simple as that.
So what? (Score:3, Insightful)
Anybody --- not just the DHS --- can spoof the DNS today. And yet, by all available evidence, DNS spoofing is vanishingly rare. Mutual authentication over the untrusted Internet is a solved problem: TLS provides an end-to-end guarantee that your connection to your banking web application terminates with someone who can vouch for your bank's crypto keys. And you don't simply trust SSL certificates to the government: you also trust a myriad of commercial entitities as well.
This is a red herring on multiple levels. There are lots of places that intelligence agencies can step in to violate your privacy on the Internet; you "trust" an access-layer providers, a number of backbone providers, the owners of the DNS roots, the certificate authorities, Google, and probably 10 more entities. But more importantly, DNSSEC is irrelevant. Nobody depends on it now (it doesn't "exist"now: tell me how my Mac does a secure lookup for Google.com on Speakeasy). It's likely that nobody ever will depend on it. And that's OK, because we have better mechanisms in place. We should spend more effort on adding negotiated opt-in SSL for things besides web and mail, and less on huge infrastructure projects to "secure" one tiny link in the connectivity chain.
Too many secrets? (Score:3)
Who cares about DNS? (Score:3, Insightful)
Each group seems to be a company which holds (in the case of Verisign) 15 individual certificates.
Each of these certificates can be used to set up a 'trusted' HTTPS connection.
If you don't know what that means, google for "verisign microsoft fake certificate"
I'm as paranoid as the next guy, but I think that haing companies with stellar security track-records like verisign issuing browser certificates is much more of a problem that DHS messing with DNS.
If you're worried about DNS/CAs/??? don't use them. Set up an SSH tunnel or a VPN, exchange keys securely (i.e. off-line, in person, verifying signatures) and live happily ever after.
Honestly, given the general state of computer security this is like complaining that someone might mess with your street-directory while driving a Pinto with "USA forever" stickers through Baghdad in rush-hour.....
Scary! (Score:5, Insightful)
This is one of many cases that show that the US government is really messed up.
They want the keys to something the whole world depends on, and the ability to disrupt it, but deny that to anyone else.
The same goes for the militarization of space: they want to be able to do it, and deny anyone else from doing the same.
The same goes for weapons of mass destruction: they want to keep it, and allow current allies to keep it, yet selectively deny certain current enemies (real or perceived) from having the same.
This double standard, coupled with unilateral actions against the advice and objections of the most of the world, is what makes the current US government so scary.
Indeed this feels like the saying: Gods may do what cattle can't [wikipedia.org].
Americans can do better than that. You guys used to admired, and yes, envied, but in a good way. The rest of the world looked up to you.
Now this admiration has turned to resentment, and resignation. The rest of the world cannot vote in US presidential elections, yet we are affected by that decision without having a say at all. Sort of like when you rebelled against a king that taxed you without representation.
It is beyond most of the world why you reelected the same administration again, despite of all its short comings, and their continued heavy handed meddling.
The Democrat taking over congress is a good sign.
Please continue to fix this. You indeed can, and you deserve better. The rest of the world deserves better too.
Re: (Score:3, Insightful)
How feasible is it for we in the rest of the world to create "another Internet" and leave the current one with the US government? I can see major powers like China and Russia in support of this measure. But is it even possible?
Quite feasible actually. China already runs it's own DNS root servers. The trick becomes to make this as seamless as possible to the end users. But there are ulterior motives for this, to control the people.
For example say China wanted ibm.com to resolve to their own servers, th
Re:Politics, politics (Score:4, Insightful)
The problem with all this saber-rattling about "control of the Internet" is that there's just too much economic power involved to arbitrarily change anything. Yes, one can complain about U.S. management of DNS (although the system does work rather well), one can complain about what the U.S. might do with DNS (although we haven't done anything yet) but sometimes, change for the sake of change is dangerous. The impact on world economies if DNS were to suffer any significant or long-lasting disruption would be severe. If any major changes or transfer of control of the Domain Name System ever get made, they'd best be made in the light of technological reality and not the immediate political need to stand up to the U.S. Remember what happened with Verisign and SiteFinder? That was just a taste of what might happen to the network if people start squabbling over the roots and waving their dicks around.
Be careful what you wish for.
Parent