News for hackers. Stuff that matters.

A comment on DNSSEC KSK rollover breaks DNS resolution for .nz domains. Parent comment

Re:DNSSEC KSK rollover breaks DNS resolution for .nz domains by tssva on Monday May 29, 2023 @07:29PM (#36119345)
They serve different purposes. DoH protects DNS information while in flight. DNSSEC cryptographicly signs DNS records so they can be validated as being created by the owner of the domain. With only DoH you can be assured of privacy in flight and that the response hasn't been changed in flight; however, you don't know that the records on the server you connected to have not been manipulated.
[ Parent | on HN ]
Re:DNSSEC KSK rollover breaks DNS resolution for .nz domains by tptacek on Monday May 29, 2023 @07:32PM (#36119364)
The motivating use case for "cryptographically signing DNS records so they can be validated as being created by the owner of the domain" was the protection of those records in flight, which is something DoH does.

A reminder that DNSSEC's "cryptographic security" coalesces to the single AD=true bit in the DNS header by the time DNS responses hit your browser; DNSSEC is a server-to-server protocol. So in almost all cases, save those in which nerds have run full recursers on their desktops, the server trust situation with DNSSEC is largely the same as that of DoH.

[ Parent | on HN ]
Re:DNSSEC KSK rollover breaks DNS resolution for .nz domains by tssva on Tuesday May 30, 2023 @03:42AM (#36122153)
> The motivating use case for "cryptographically signing DNS records so they can be validated as being created by the owner of the domain" was the protection of those records in flight, which is something DoH does.

According to the original DNSSEC RFC, RFC2065, the purpose of DNSSEC is to provide data origin integrity and authentication. It also states "In addition, no effort has been made to provide for any confidentiality for queries or responses. (This service may be available via IPSEC [RFC 1825].)" IPSEC didn't end up providing that role but DoH does. It doesn't address the issue of data origin integrity though.

[ Parent | on HN ]
Re:DNSSEC KSK rollover breaks DNS resolution for .nz domains by corford on Tuesday May 30, 2023 @09:51AM (#36124903)
Nice quote. I don't understand why so many people on HN have such a vocal dislike of DNSSEC and DoT. It's perfectly ok for DNSSEC, DoT and DoH to co-exist.
[ Parent | on HN ]