Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Privacy Government The Internet United States Networking Politics Technology

DHS Wants Master Key for DNS 266

An anonymous reader writes "At an ICANN meeting in Lisbon, the US Department of Homeland Security made it clear that it has requested the master key for the DNS root zone. The key will play an important role in the new DNSSec security extension, because it will make spoofing IP-addresses impossible. By forcing the IANA to hand out a copy of the master key, the US government will be the only institution that is able to spoof IP addresses and be able to break into computers connected to the Internet without much effort. There's a further complication, of course, because even 'if the IANA retains the key ... the US government still reserves the right to oversee ICANN/IANA. If the keys are then handed over to ICANN/IANA, there would be even less of an incentive [for the U.S.] to give up this role as a monitor. As a result, the DHS's demands will probably only heat up the debate about US dominance of the control of Internet resources.'"
This discussion has been archived. No new comments can be posted.

DHS Wants Master Key for DNS

Comments Filter:
  • DNSSec (Score:5, Informative)

    by tronicum ( 617382 ) * on Saturday March 31, 2007 @01:37PM (#18556833)
    ...it will make spoofing IP-addresses impossible...

    No. It secures DNS. So you cant spoof domain names. It secures that the DNS Server is authorative so the DNS query was answered right. If somebody spoofes an IP in your network, you won't be saved.

    • Re:DNSSec (Score:5, Insightful)

      by krbvroc1 ( 725200 ) on Saturday March 31, 2007 @02:53PM (#18557495)
      What are you talking about? How can giving a secret key to a third-party 'secure DNS'. If I am the only one who has a key to my house and I make an additional copy and give it to a third-party, my house is now less secure. Why are you and the article spinning this as a some greater level of security. Your correction about IP vs DNS spoofing is correct.
  • This should ( rightly so ) piss off external entities ( ie: foriegn nations ) enough to have them setup alternative roots. And I, for one, will be using those as apposed to the "secure" ones.

    Granted, I won't be fully trusting the information from either set, so it's not as if my system security is dependant on it.
    • by Seumas ( 6865 ) on Saturday March 31, 2007 @02:06PM (#18557081)
      I still have yet to understand what fear they have of internet terrorism. When was the last time terrorists killed someone over the internet?! This sounds more like the supposedly disbanded TIA working under the guise of DHS.

      By the way, how scary is it that DHS used to be the commonly used acronym associated with "Department of Human Services". And now this...

      Good to know that DHS can put its hands in ANYTHING regardless of nature as long as they claim it has some association in some minor (or even non-existent but hypothetical) way.
    • Imagine if there were 2 or more sets of "root" servers which were by and large identical. One under the thumb of the USA and one run by the international community, and maybe one set run by each repressive regime on the planet, e.g. China. All would get authoritative data from domain registrars just like the current root. All would be open to "controlled poisoning" by those who held the keys.

      Now, imagine if ISPs or countries worldwide could choose which set of root servers to use. Imagine if ISPs and go
      • check with the authoritative nameserver for the domain as reported by whois

        As reported by who's whois? It's not like whois is some totally unrelated system -- it's tied to the same information as any other part of DNS.

        You can certianly query along different root paths and compare the results without naming an authority, but if you're going to use whois to resolve conflicts you'd have to pick a root path for your whois requests and trust it to be accurate.
    • true, and it has. Take a look at ORSN [orsn.net], when this news was discussed on heise.de (an influential IT-news service in Germany) many posters linked to that European Open Root Server Network.

      (re: your signature: as a German I should love him, but who is Hasslehoff?)
    • Re: (Score:3, Insightful)

      by pikine ( 771084 )
      I guess China had already seen this coming [slashdot.org]!
      • > I guess China had already seen this coming!

        Of course they did. Ever since they got caught hacking Falun Gong web sites from machines at the Ministry of Defense (among many other activities) they've been spoofing their IPs.
    • What we need here is alternative keys to verify the signatures on TLDs like .com, .net, .uk, .de, .iq etc. You can do that without setting up an alternative root system. Of course, while the DHS is demanding the keys for the root from ICANN publicly, you *know* they'll be privately demanding the keys for .com from Verisign or whoever it is these days, and trusting .com not to be forged is really a much bigger issue than whether the US politicians may decide to forge keys in .cn some day just for fun.


    • Re: (Score:2, Interesting)

      Our country has many exciting oppertunities and yet they are being stripped from us because of our government is pushing other countries away from our trust by trying to institue messure that they have *no* constitutional right or global right in doing. Making laws with out the correct due process, without checks and balance. This is not a correct process of allowing such a decission to be addressed. The people in America are the governing voice via the constition, bill of rights and declaration of inde
  • wtf! (Score:5, Insightful)

    by BuR4N ( 512430 ) on Saturday March 31, 2007 @01:43PM (#18556889) Homepage Journal
    "and be able to break into computers connected to the Internet without much effort"

    Didnt know that spoofing an IP what all it took to break into a computer.....
    • Didnt know that spoofing an IP what all it took to break into a computer.....

      What, doesn't anybody use rlogin/rsh anymore with .rhosts files?
  • The mental picture that first struck me:

    A farmer giving the fox the keys to the henhouse.
  • by bluemonq ( 812827 ) * on Saturday March 31, 2007 @01:44PM (#18556899)
    All your IP are belong to us. You are on the way to being rooted. You have no chance to 200 make your time.
  • by Cylix ( 55374 ) on Saturday March 31, 2007 @01:45PM (#18556903) Homepage Journal
    When you pry if from my cold dead hands!
    • by Anonymous Coward on Saturday March 31, 2007 @01:49PM (#18556935)
      Your proposal is acceptable.

      -- DHS.
      • So you are equating DHS with giant terroristic insectoid aliens bent on universal destruction? Hum. Seems reasonable.

        • by ameline ( 771895 )
          I was pointing out that saying "You can have my X when you pry it from my cold dead hands" does not seem to slow down these sort of people very much if they have a serious desire to take your X away from you.
    • Re: (Score:2, Funny)

      ..In other news Cylix, a Slashdot poster was found dead today outside his home. Police investigating suspect that theft was the motivation as his wallet was missing.

      Various Internet companies today suspect that their domain names have been compromised. Blaming the new "secure" DNS system, companies are still unable to tell what the extent of this damage is.

      Also in todays news:

      Iran in massive cleanup operation after Israeli nuclear strike.
      Microsoft again found guilty of anti-trust violations.
      SCO share price
  • Multiple keys (Score:3, Insightful)

    by russotto ( 537200 ) on Saturday March 31, 2007 @01:50PM (#18556943) Journal
    Does Secure DNS allow multiple keys to be required before a query is trusted? That is, would it be possible with the protocol as defined for a foreign root server (e.g. the servers authoritative for .nl) to sign its responses with its own self-signed or trusted-organization-signed key as well as with the IANA-signed key, and have savvy clients trust such servers only if both keys are present?

    I'm surprised the US Government is doing this; I'd have expected them to obtain the key through back channels rather than out-and-out demanding it.
    • Which is worse? (Score:2, Interesting)

      by FMota91 ( 1050752 )
      The fact that the US Government wants this key, or the fact that it has requested it publicly?

    • Re: (Score:3, Informative)

      by Eric Smith ( 4379 ) *
      In principle, there is no reason why a ccTLD key needs to be signed by IANA, ICANN, the US DoD, or anyone else, as long as the DNS implementation on client computers is configured to trust that ccTLD key.

      The result is that instead of computers being configure to trust a single root zone key from IANA, it is likely that every ccTLD will have its own key, and that the standard configuration of DNS as shipped with an OS or distribution will contain the public keys or hashes for every one of them. This is argu
      • Under that system, if new ccTLDs are added, it will force an update to all DNSSec users. This may be acceptible though.

        The master key is trusted by all and signs every TLD and ccTLD, right? Does this key expire after a set number of years? If so, how is replacement handled, especially for systems that may be offline for long periods of times? Just wondering.
  • Another "Internet" (Score:2, Interesting)

    by bogaboga ( 793279 )
    How feasible is it for we in the rest of the world to create "another Internet" and leave the current one with the US government? I can see major powers like China and Russia in support of this measure. But is it even possible?
    • All they have to do is
      1. set up their own root DNS servers (easy, anyone can do that)
      2. convince their citizens to configure their computers to use their root DNS servers instead of the ICANN root DNS servers

      Many people have done the first, but no one has succeeded at the latter. But if a government were to do it, they might well succeed.

      However, other countries may not even need to do that. If they use a ccTLD (e.g., .cn for China, .lk for Sri Lanka, etc), they can control the DNS key for that ccTLD, a

      • You would also need to convince the citizens to get direct connections to your servers and start assigning IP addresses, much in the same way that IANA does. This is, in theory, wholly possible. Then you could have a separate internet that gets away from government regulation. But, Homeland Security may get suspicious and you might see one of the infamous National Security letters forcing you to open your network or face imprisonment and fines. Either way, as long as King George has his way, privacy wil
    • Re: (Score:3, Insightful)

      by canuck57 ( 662392 )

      How feasible is it for we in the rest of the world to create "another Internet" and leave the current one with the US government? I can see major powers like China and Russia in support of this measure. But is it even possible?

      Quite feasible actually. China already runs it's own DNS root servers. The trick becomes to make this as seamless as possible to the end users. But there are ulterior motives for this, to control the people.

      For example say China wanted ibm.com to resolve to their own servers, th

      • This make DNS in the middle attacks -- even with SSL -- trivial.

        How? I can redirect you to my own site, but how do I spoof your SSL certificate? I can generate a similar one and try to fool you into accepting it, but I can't see how you can sniff traffic on an SSL encrypted channel just by gaining control of the DNS server.
    • How feasible is it for we in the rest of the world to create "another Internet" and leave the current one with the US government?

      Oh that... Its called IPv6.
  • by Anonymous Coward on Saturday March 31, 2007 @01:54PM (#18556979)
    No where in that article did it say that DNSSEC would prevent spoofed IP Addresses. This is about DNS, not about IP addresses. Also, the fact that the DHS wants they master keys does not mean they'll be able to hack into your computer without any problem. It boggles my mind that this Summary was allowed to hit the main page. wow...just wow.
    • by 3247 ( 161794 )

      No where in that article did it say that DNSSEC would prevent spoofed IP Addresses.
      Even if the article did not say so, it actually does: With DNSSEC, you can securely put certificates for IPSEC or SSL/TLS into the DNS.
    • There are two ways to spoof IP addresses - trick somebody into thinking the machine they want is at a bad guy's IP address instead of the real one, or trick somebody into thinking that the IP address they're trying to reach is on a bad guy's machine instead of the real one.

      DNS primarily lets you look up the IP address corresponding to a domain name, and DNSSEC prevents this from being spoofed. Spoofing the routing protocols so that IP packets go to the bad guy's machine is obviously not DNS's problem.

  • by Animats ( 122034 ) on Saturday March 31, 2007 @01:58PM (#18557007) Homepage

    The truly powerful signing key is for Windows Update. If you have that key, you can take over every Microsoft computer in the world . Change the operating system. Install anything, including a new key. Reboot the machine.

    Who has that key? Do we know?

    Whoever has both the DNS root key and the Windows Update signing key rules the Internet. Or at least all the Microsoft client systems. They can redirect Windows Update requests to themselves, then download their own update and have it accepted.

    Unfortunately, this isn't a joke.

    • One key to rule them all and in the darkness bind them.
    • Re: (Score:2, Funny)

      by iminplaya ( 723125 )
      Heh, Good thing I turned off Windows update
    • by Workaphobia ( 931620 ) on Saturday March 31, 2007 @04:57PM (#18558777) Journal
      I am absolutely shocked that no one has given the obvious reply, seeing as how this is slashdot.

      You can already take over every microsoft computer in the world. All it takes is a zero day exploit. How exactly is a spam botnet fundementally different from a botnet controlled by the US Government?

      The security of encryption keys is only a concern when the security of the rest of the system is not in quesiton.
      • Re: (Score:2, Insightful)

        by Scudsucker ( 17617 )
        I am absolutely shocked that no one has given the obvious reply, seeing as how this is slashdot.

        Because you were the first incompetent boob to come along. There is a HUGE, obvious difference between a zero day exploit spreading from computer to computer and millions of PC's getting an exploit at the same time because they were set to automatically download updates from Windows Update. Or did you stop to consider the fact that basic security will keep you from being infected by a zero day exploit? A firew
  • by sciop101 ( 583286 ) on Saturday March 31, 2007 @02:04PM (#18557067)
    US Gov: We want the key.

    We are denied the key.

    We deny having the key.

  • out of control (Score:5, Insightful)

    by TheSHAD0W ( 258774 ) on Saturday March 31, 2007 @02:06PM (#18557083) Homepage
    I think this is horrible news, if only because it provides more potential sources for unauthorized personnel to access the key. DHS has no real use for the key, which has as its only purpose the prevention of man-in-the-middle attacks against legitimate websites. DHS has the power to subpoena the owners of those sites for communications details, and terrorists' communications will use other forms of secure handshaking to verify legitimacy if they don't already. The only reason DHS would need these keys is if they wanted the ability to immediately tap into communications w/ legitimate sites, without delaying for a court order or other oversight. Giving them this power would only allow them to fly further out of control.
  • by pashdown ( 124942 ) <pashdown@xmission.com> on Saturday March 31, 2007 @02:10PM (#18557133) Homepage
    I've always thought IP spoofing is a weak attack due to routing and ingress filters. Any network worth its salt will block its own addresses from coming in from the outside, but nevertheless routing has to return the TCP ack back to the proper AS#. How does DNSSec override these precautions?

    In any case my boxes don't give access to just the IP address, they give access based on private keys, DNS, and the IP address. Another case of government technical cluelessness thinking that the master key unlocks ALL DA COMPUTORS IN DA VERLD?
  • Finally, a way to give the net.kooks at ORSN et al -- and other purveyors of alternative DNS roots [wikipedia.org] -- some sort of credibility... prove that the kooks were right all along! The cabal does exist, and they're running the US government. What a stroke of genius! This single act could be the single most harmful thing to hit the net since Cantor and Seigel :(
  • the US government will be the only institution that is able to spoof IP addresses

    the US government will be the only OTHER institution that is able to spoof IP addresses.

    whoever is the creator (icann?) of the master keys is also able to spoof DNSsec.

  • You know... (Score:5, Interesting)

    by FunWithKnives ( 775464 ) <<ten.tsirorret> <ta> <tcefrePxodaraP>> on Saturday March 31, 2007 @02:31PM (#18557315) Journal
    When the story first broke about other nations wanting an independent international body to oversee the root servers and such, I was completely against it. It sounded to me like another pointless stance by the U.N., compounded by the fact that the ARPANet was invented and fleshed out here in the U.S. Not to mention the few unsavory members of the U.N. that would end up with some say as to the future of the Internet.

    Now, though, I'm starting to see where I went wrong. I was assuming that the government of the United States could never be as fucked up as the one in, say, China. I was being horribly short-sighted. I should have known that this kind of shit was only a matter of time.

    So how much worse could letting the U.N. have control of ICANN be than something like this? I say fuck it. Let them have it, and give it some independent oversight. For the life of me, I cannot believe that I am actually looking to foreign nations to ensure the neutrality and openness of the Internet, but there you have it.
    • Re:You know... (Score:5, Interesting)

      by DaMattster ( 977781 ) on Saturday March 31, 2007 @02:54PM (#18557511)
      I definitely agree with you there and I am a U.S. Citizen. At this point, I think by making ICANN and IANA independent of U.S. control we are safeguarding our own rights what with the wild abuses of the Patriot Act, the FBI, and the Department of Homeland Security. I hope ICANN doesn't capitulate. ICANN shouldn't give them shit.
    • Re: (Score:3, Interesting)

      by Tim C ( 15259 )
      I was assuming that the government of the United States could never be as fucked up as the one in, say, China

      Irrelevant. No one country should have control of a global resource. Even ignoring the potential for abuse, global resources should be managed globally, it's as simple as that.

      I cannot believe that I am actually looking to foreign nations to ensure the neutrality and openness of the Internet

      Yeah, because us dirty foreigners don't even know how to spell "freedom", let alone have any respect for it.
    • by dbIII ( 701233 )

      Not to mention the few unsavory members of the U.N. that would end up with some say as to the future of the Internet.

      Some country with torture and show trials ... hang on, the USA is trying very hard to become one of those unsavory members of the U.N.

  • by SLi ( 132609 ) on Saturday March 31, 2007 @02:32PM (#18557329)
    I'm glad the US government decided to answer themselves the very short-sighted people who are almost in the majority in every ICANN-shouldn't-be-controlled-by-the-US article who ask something like "Who would you trust more to control the Internet, the US government or a body where countries with poor human rights record have a say".
  • Maybe it's time to start working up an alternative to DNS zones?

    It's either that or coming up with a way of keeping such information outside of the hands of a foreign power (the USA is a foreign power from my country. Not an enemy by any hands at this time... but it has been).
  • Control over the internet needs to be taken away from the Americans. We need to assure that nobody has "control" over the internet.
    • That is my theory.
      See, there is a use for the UN to control it.
      It may screw it up but it won't harm us badly, purposfully, either.
  • by Schraegstrichpunkt ( 931443 ) on Saturday March 31, 2007 @02:54PM (#18557519) Homepage

    Right now, Verisign (or any of the widely-trusted X.509/SSL certificate authorities) can generate fake certificates for arbitrary sites, and your ISP can poison the DNS (from your perspective).

    Incompetent government employees (or corrupt or foreign governments) are not the only adversaries we need to deal with. DNSSEC, like the current HTTPS trust system, reduces the number of potential attackers, but it doesn't eliminate them all. We know this, and we deal with it by only vesting a limited amount of trust in these systems.

    The discussion should not be about whether or not the US DHS specifically should be given access to the keys; The discussion should be about the importance of minimizing the number of points where the system can be attacked: Only those entities who strictly need the keys in order to administer the DNSSEC system should be given access. The DHS doesn't need DNSSEC keys in order to make DNSSEC work, so the DHS should not get the keys. It's as simple as that.

  • So what? (Score:3, Insightful)

    by tqbf ( 59350 ) on Saturday March 31, 2007 @03:24PM (#18557787) Homepage

    Anybody --- not just the DHS --- can spoof the DNS today. And yet, by all available evidence, DNS spoofing is vanishingly rare. Mutual authentication over the untrusted Internet is a solved problem: TLS provides an end-to-end guarantee that your connection to your banking web application terminates with someone who can vouch for your bank's crypto keys. And you don't simply trust SSL certificates to the government: you also trust a myriad of commercial entitities as well.

    This is a red herring on multiple levels. There are lots of places that intelligence agencies can step in to violate your privacy on the Internet; you "trust" an access-layer providers, a number of backbone providers, the owners of the DNS roots, the certificate authorities, Google, and probably 10 more entities. But more importantly, DNSSEC is irrelevant. Nobody depends on it now (it doesn't "exist"now: tell me how my Mac does a secure lookup for Google.com on Speakeasy). It's likely that nobody ever will depend on it. And that's OK, because we have better mechanisms in place. We should spend more effort on adding negotiated opt-in SSL for things besides web and mail, and less on huge infrastructure projects to "secure" one tiny link in the connectivity chain.

  • why does a master key even exist? if a system is to be secure, make it secure. don't allow some organization with a master key to be able to do stuff. if a master key exists to anything, it will be leaked in due time, if people want it.

    second, why does the US government get rights? the organization in question should just relocate to another country where the US government has no jurisdiction.

    finally, i thought .com/.net/.org were shared by the entire world and are not specifically "US" domain names. why is
  • Clearly, the author has no idea what BIND is, what it does, or how it works. BTW, there are root servers in Europe too.
  • by 00_NOP ( 559413 ) on Saturday March 31, 2007 @04:03PM (#18558173) Homepage
    The way the story is written the key is presumably "CTEC ASTRONOMY". Getting the key will not make it easy to break into people's computers if the security is done properly (not unless they have some quantum computers brute forcing various keys), but it would make it easy to pretend to be part of someone's network.
  • Right, let's give the DHS the key so that only they can spoof their addresses. How is this good?

    Why isn't is given to a group to control and enforce that has some balance, other than just 'trusting' that government should have this power?

    "The Internet is free, oh except we hold the keys . . . " doesn't sound quite right to me.

  • by IchBinEinPenguin ( 589252 ) on Saturday March 31, 2007 @09:56PM (#18562297)
    Firefox has 44 groups of certification authorities!
    Each group seems to be a company which holds (in the case of Verisign) 15 individual certificates.
    Each of these certificates can be used to set up a 'trusted' HTTPS connection.
    If you don't know what that means, google for "verisign microsoft fake certificate"

    I'm as paranoid as the next guy, but I think that haing companies with stellar security track-records like verisign issuing browser certificates is much more of a problem that DHS messing with DNS.

    If you're worried about DNS/CAs/??? don't use them. Set up an SSH tunnel or a VPN, exchange keys securely (i.e. off-line, in person, verifying signatures) and live happily ever after.

    Honestly, given the general state of computer security this is like complaining that someone might mess with your street-directory while driving a Pinto with "USA forever" stickers through Baghdad in rush-hour.....
  • Scary! (Score:5, Insightful)

    by kbahey ( 102895 ) on Sunday April 01, 2007 @01:16AM (#18563861) Homepage
    You know what?

    This is one of many cases that show that the US government is really messed up.

    They want the keys to something the whole world depends on, and the ability to disrupt it, but deny that to anyone else.

    The same goes for the militarization of space: they want to be able to do it, and deny anyone else from doing the same.

    The same goes for weapons of mass destruction: they want to keep it, and allow current allies to keep it, yet selectively deny certain current enemies (real or perceived) from having the same.

    This double standard, coupled with unilateral actions against the advice and objections of the most of the world, is what makes the current US government so scary.

    Indeed this feels like the saying: Gods may do what cattle can't [wikipedia.org].

    Americans can do better than that. You guys used to admired, and yes, envied, but in a good way. The rest of the world looked up to you.

    Now this admiration has turned to resentment, and resignation. The rest of the world cannot vote in US presidential elections, yet we are affected by that decision without having a say at all. Sort of like when you rebelled against a king that taxed you without representation.

    It is beyond most of the world why you reelected the same administration again, despite of all its short comings, and their continued heavy handed meddling.

    The Democrat taking over congress is a good sign.

    Please continue to fix this. You indeed can, and you deserve better. The rest of the world deserves better too.
  • by hardaker ( 32597 ) on Sunday April 01, 2007 @10:51AM (#18566675) Homepage
    DNSSEC provides the ability for the data to be signed. The politics have come in, of course, as to who has those keys. (Now mind you, right now the US government or anyone at all can already spoof DNS responses today and interestingly enough when politics get involved, it takes longer for deployment of secure protocols to happen. whee....)

    But, DNSSEC does provide every zone owner with the ability to hold a very special key so that no one else may be able to spoof stuff in their zone. Everyone would want to trust .com's key, because they're the one with all the data you need. The roots hold all the information about the TLDs, so you need to trust the roots to be able to get information about .com's servers. If someone controlled the keys for the roots and you trusted those keys (had them configured as "trust anchors") then they could spoof (signed) .com record, the .com keys, etc down until example.com so you'd trust the results for example.com as secure.

    But here's the secret: if you don't trust the root zone owners, then instead you can choose to set trust anchors tied to the .com key instead. You don't have to trust the root zone keys, it just makes it easier to trust only one. Paranoid people are certainly welcome to maintain a list of trusted keys for any zones they deem to be "importantly" critical. If you had a trust anchor configured for .com, then it wouldn't matter what someone with the real root zone key could do with it... You wouldn't trust the eventual results from a fake .com server a root had told you about because the cryptography would warn you that it didn't match up to your expected trust anchor for .com. I suspect that most country TLDs will already do this for their own government results (IE, .se, who already runs a secured zone, will configure the .se keys as trust anchors in its government systems).

    Here's an interesting proposal for the root zone: pick two countries that hate each other and are likely to never have the same agenda. Let's call them X and Y. Give each of these countries a root key, and make the root zone use and publish results from both of them. Then, you could configure trust anchors pointing to both the X and Y keys. You could configure your system to make sure to check the DNSSEC results to validate the information up to both of these keys. That way you could ensure that since you trusted X and Y to never conspire against you together, and you would know that neither X or Y alone could have spoofed DNS data then you suddenly find yourself safe. Because of the distrust. I love the irony.

    (now: you don't want to have a zillion keys for the roots... The packet sizes get larger as you add more keys, and it turns out you probably don't want more than 3 at most).

APL hackers do it in the quad.