Paths2Trust

removing risk or adding value: the bipolar nature of DNSSEC

People don't like to buy insurance.  But they continue to buy insurance because they have to.  They must deal with risk, be it for medical insurance, life insurance or whatever.

The most interesting insurance salesman I ever heard about would drive a hearse when visiting potential life insurance clients.  Although it's macabre, he made his point on dealing with risk....

But people still won't buy insurance if they don't have to.  Or they don't buy enough.

Up until now, DNSSEC has been sold like an insurance policy.  It's there to reduce risk. You don't want bad things happening to good people, and you certainly want to protect people from fraudulent web site hijacking.

But DNSSEC is NOT just about dealing with risk.  It can be about adding value as well. People are much more willing to spend time and money on something that brings value than on just buying an insurance policy.

What kinds of things can DNSSEC enable?  Well, think about DNS as the world's largest public data base.  It can contain other things besides internet addresses.  Examples include certificates, SSH fingerprints, text records and so forth.  Once the DNS can be trusted (that's where DNSSEC comes in), all sorts of killer apps can be developed to provide positive value to end users.  Ideas have been proposed for anti-spam, and identity management for SSH logins.  There are ideas for iPhones and BlackBerries, not just laptops.  

Once the DNSSEC infrastructure begins to scale up, keep an eye out for these new DNSSEC-enabled applications.  At that point DNSSEC will be much more than just "removing the negative".... it will be about "adding the positive"  -- as in positive value creation.  Now that's a market-maker!

DNSSEC Awareness

Earlier, I wrote about making DNSSEC deployment happen more widely by separating out the work for DNSSEC signing (the "transmitters") from DNSSEC validating resolvers (the "receivers").  Baby steps are going to be needed to get each side of the equation working, and to eventually build up to a huge deployment.

The activities necessary to get the "receivers" ramped up are: awareness, education, easy-trust-anchors, and diagnostics.  Last-time I wrote about easy-trust-anchors.  Let's go back to awareness & education.

I wrote to the author of the "DNSSEC in 6 minutes" but haven't heard back yet.  I hope to hear soon, but if not, I'll develop my own document.  The cookbook can be quite simple, especially if it references the TAR retrieval scripts.  But how do we get people to know how to do this?  This is the AWARENESS issue.  And maybe INCENTIVES, too...

For starters, we can work with the DNSSEC deployment working group, chaired by Jim Galvin.  There's bound to be good ideas to get wide distribution of the cookbook. 

A new group, the DNSSEC Industry Coalition, has also just formed, as written up in this NetworkWorld article.  As a member of this group, I am thrilled that we are talking about using DNSSEC for more than just protecting against cache poisoning, but using secure DNS to enable new killer applications such as anti-spam and other ideas.  This type of thing might provide the INCENTIVES to get the masses rolling.  Getting registrars involved in the education process will surely help, and that is a major focus of the industry coalition.

In the meantime, if you have any ideas on awareness and education, send them to me and I'll pass them on to the group.

Eye Surgery

I had eye surgery yesterday -- I had a cataract removed from my left eye and an artificial lens put in place.  I was surprised to even have a cataract at SUCH a YOUNG AGE (mid-50's), but apparently the high country of Colorado has a lot more UV light that can cause these sorts of problems.

Anyway, the surgery was amazing from an analytic point of view, and a little freaky from an emotional point of view.  No pain, just a little anxiety with loss of vision during the procedure and strange sensations as the doc used ultrasound to break apart the cataract and then insert an artificial lens into my organic lens.  My daughter is in med school so she was allowed into the surgery room to watch the procedure, which took all of 15 minutes.  She thought it was pretty cool.  Thank goodness for modern technology.  Anyway, I went home afterward and I could see reasonably well the first day and it's even better today. 

I see dead people.  Oh wait, wrong movie. 

I see that I'm off subject again... so back to DNSSEC with the next post.  Just thought you'd want to know wazzup....

E.T. Phone Home

One of the phrases used in high-tech that drives me absolutely crazy is "all the customer has to do is..." followed by a lengthy set of steps the customer ISN'T going to do.  Not if there is an easier alternative...like doing nothing.

So that's why I don't like the current solutions for deploying DNSSEC trust anchors.  And why I believe it's going to get simpler with some automation scripts.

Does trust-anchor management need automation?  after all, it only takes two lines in the named.conf file:  "dnssec-enable: yes" and a "$include trust_anchors_and_dlv".

But then it gets trickier.  Where do I get the trust anchors file?  How many are there?  How do I know I can trust them?

There is talk of building trust-anchor repositories, but they don't quite exist yet.  Even when they do, I believe a small script needs to be published that Joe the Administrator can download from sourceforge or equivalent.  The script would "phone home" on a regular basis to securely retrieve trust-anchors, validate them against a secure redundant copy elsewhere, verifies signatures, etc.  It might even register itself each time it runs so that a world-wide counter of VALIDATING RESOLVERS could be updated.  Then we could have an animated map of the world display how fast DNSSEC resolvers are being deployed, just like Dan Kaminsky did at Black Hat to show how fast the DNS patch was deployed.

Is this hard to do?  Nope.  Look for it soon. 

In the meantime, if you want to manually install some trust-anchors, I'd suggest leveraging the work done by Duane Wessels over at DNS-OARC.  He has an open validating resolver with trust anchors.  It even uses the ISC DLV which is great!  I tried resolving my company name, www.secure64.com with this resolver and it came back with the AD bit set to indicate "Authenticated Data".  Perfect.  To use the Validating Resolver, check out he secure web site https://www.dns-oarc.net/oarc/services/odvr

To see how he did it:

https://www.dns-oarc.net/files/odvr/configs/bind/named.conf
https://www.dns-oarc.net/files/odvr/configs/bind/trusted-keys.conf

https://www.dns-oarc.net/files/odvr/configs/unbound/unbound.conf
https://www.dns-oarc.net/files/odvr/configs/unbound/trusted-keys.conf
https://www.dns-oarc.net/files/odvr/configs/unbound/dlv-keys.conf

Building towards a tipping point: the DNSSEC "Receiver"

OK, getting back to the main subject....

How might we get the bazillion DNS caching servers out there to turn on DNSSEC validation (the "receiver" part of DNSSEC)?  Well, in fact, there are multiple activities that need to ramp up to enable a DNSSEC tipping point:

1. Awareness: all the "Joe the Administrator" guys have to know that it's a good idea to turn this on, don't-cha-know

2. Education and Demonstrations: and they need to know that it's fairly easy to turn it on, you-betcha!

3. Trust-Anchors and DLV's we can trust:  this is the big missing piece... Joe the Administrator has to regularly update trust anchors and it better be painless.  (ok, no more political jokes...)

4. Diagnostics:  prove to Joe that it is really working and isn't doing bad things

These will be the subjects of multiple blog postings.  But let's start with a brief intro to #2: education.  Joe the Administrator needs a really simple recipe...something like the DNSSEC in 6 minutes tutorial -- only shorter and simpler to talk about just the validation side of DNSSEC.  (http://www.usenix.org/event/lisa08/dnssec_bof.pdf)

I think separating out the receiver side (validation) side from the transmitter side (zone signing) will make this a simple recipe that administrators can deal with.  But the recipe will be incomplete without setting up trust anchors.  Making that simple will be the subject of the next posting.
 

Bananagrams

OK, it's only my second post and I'm way off subject, but I just had to tell you about a game we played over the Thanksgiving break. 

It's called "bananagrams" (www.bananagrams-intl.com) and it's way fun!  It's like scrabble, except everybody plays simultaneously to complete crosswords on the table in front of them (there is no game board).  Each time all the letters in front of you are used up you yell "peel" and everyone has to take a new tile.  This goes on until someone finally uses up all the tiles in their own pile.  It takes 2 minutes to learn, and it is TOTALLY addicting.  It has won all sorts of awards as well.  We found it at Barnes and Nobles for around $15, but you can probably find it online as well.  Try it! 

OK, next posting I'll get back on subject....