When asked about DNSSEC, which is a forklift upgrade of a core Internet protocol that has the deliberate effect of giving NSA and GCHQ control of TLS keys for hosts in .COM, .UK, .NET, .ORG, and .IO, this was Snowden's answer:
Edward Snowden: So, I agree with you and I mean this is what's important about the IETF. Just because I say it, doesn't mean it's gospel. I can be wrong about an incredible amount of things. Nobody should trust me. Nobody should grant any sort of outsized weight to what I say.
When I talk about the NSA, I mentioned it in correlation with DANE and the DPRIVE initiative as well because the whole idea is that, yes, providing some mechanism for authentication of the responses between DNS queries is valuable. It's not an end to itself.
We still have to be able to say, "Well, all right, the certificate that you're getting from it, for a server is also reliable," and then we have to actually do more armour the requests themselves to make sure that they don’t become a new vector, they don't become manipulated.
Who knows like if eventually the DNS responses themselves that are provided through this become some sort of vulnerability because of the way they're parsed or whatever, but the whole idea is that we gotta start somewhere and then we've got to iterate from that point.
We've gotta begin building and when I think about things like DNSSEC, I don't think it's the golden age, we can solve all of the problems, but I do think that it's a start. It's better than the status quo. It's better than what we have today
And by getting the community thinking, by coming together and trying to develop some kind of solution, some kind of standard, we can start developing things that will allow us to build a bridge to the next generation of what we need to protect us against the next generation of coming attacks, and there's a lot of things that get in there. I mean cryptographic agility is one of the big hot things that we have to deal with as well.
I can barely follow this at all, but the part where he says DNSSEC is "better than the status quo" is pretty clear. The questioner responds, "so let's implement it".
Please be careful with what Snowden says. Whatever you think of his disclosures --- and most of my friends think they were brave and incredibly useful --- there is very little evidence that Snowden is qualified to advise anyone on cryptographic security, and some pretty significant evidence to the contrary.
It’s important to point out that this was NOT an official
IETF event, and neither was it giving external advocacy
organisations a stage (as some have intimated); rather,
it was entirely an effort of individuals, working within
the rules for requesting a room at IETF meetings.
I do not recognize the significance of "official" versus "unofficial" IETF events. I don't think there's a meaningful distinction to be made between them. Anyone in the world can show up to an "official" event, or participate in the mailing lists. That's a good thing, but it also means that "unofficial" advocacy and advice is as important as the "official" kind.
The real point is that no advice or consultation was being made, it was purely opinion-based commentary. There is no reason to believe it will affect WG charter, and in fact The Tao of IETF explicitly notes that face-to-face WG meetings aren't of high significance to the actual WG's charter. Snowden recommending DNSSEC isn't going to suddenly suspend all rational judgment in those circles.
If you spend some quality time reading IETF mailing lists, you'll learn that it's all "opinion-based commentary". I'm a little confused as to what your argument here is. The IETF works by means of people persuading other people to support proposals. That's the entire mechanism.
I wouldn't say that Snowden was intending to provide technical (or specifically cryptographic) advice in this Q&A. I would compare it to a power user giving feedback to the engineers working on improving their software.
What he brings to the table in discussions like this is basically having worked with people on surveillance projects. He knows how they operate and where they'd look for attack vectors. I think that's valuable when you have to think about designing any system with any kind of security requirements.
He literally stated himself that what he says shouldn't be accepted as gospel, and in a later question about MITM specifically confirmed that it's not his area of expertise. I don't think there's any risk of people suddenly jumping on the DNSSEC bandwagon just because of his lukewarm support.
His support isn't lukewarm. Also: now, when DNSSEC is almost dead, is the most important time to ensure that it actually becomes fully dead. It's like a zombie. You have to cut off the head and burn the body. DNSSEC is still intact and twitching.
I wouldn't classify statements like "we gotta start somewhere and then we've got to iterate from that point" or "It's better than what we have today" as a call to action to drop everything and start implementing DNSSEC as-is right away. I would interpret it as "yes, DNSSEC improves the situation in that it provides authenticated DNS replies (which - by itself - is an improvement, even though it's no magic wand that, alone, solves the cert trust issue), but there are legitimate concerns that need to be taken care of before it becomes really useful."
"DNSSEC improves the situation" is (a) false and (b) a concession to the narrative that DNSSEC is worth doing.
Someone actively engaged in trying to prevent centralization of Internet trust, and decoupling it from the Five Eyes governments --- a worthy goal, I think --- should be adamantly against DNSSEC. But here's Snowden doing the opposite.
It's not because Snowden is disingenuous. I think he's a true-believer. It's because he doesn't understand DNSSEC.
> This is a weird response to a comment that quotes Snowden at length providing technical advice to the IETF.
Viewed another way, its a perfectly obvious and not at all weird response to a comment that quotes Snowden explicitly disclaiming that he is any particular, before providing a very vague general impression of things "like" a particular technology about which he was specifically questioned, without providing anything that looks like actual specific technical advice.
Edward says this himself. Practically "Please be careful with my input". That said, his input is not nonsense. No one should take any writing at face value. Always ponder the message, the consequences and if there's an even better way.
Edward Snowden: [...] Just because I say it, doesn't mean it's gospel. I can be wrong about an incredible amount of things. Nobody should trust me. Nobody should grant any sort of outsized weight to what I say.
You're confusing vanilla DNSSEC with its proposed uses/abuses. DNSSEC just enforces the trust model that was already in place (the hierarchical nature of DNS) to ensure the authority and integrity of DNS responses. It doesn't provide confidentiality because that simply doesn't work in the shared DNS forwarder+cache model we all currently depend upon, much like HTTPS renders shared HTTP caches useless (which has implications for CDNs for example).
Proposals like DANE, using TLSA records, or deploying SSHFP records on DNSSEC enabled domains, are a different kettle of fish.
Whether or not you believe in DANE really depends on whether you're willing to accept that the DNS infrastructure is already security critical. Truth be told, if I can hijack your DNS, I can get a certificate for your domain using simple domain validation... but that's true of your web server as well. There's no easy answer here.
The current situation is that anyone can read DNS. If DNSSEC and DANE were implemented, that group would be restricted. In that sense it's better than the status quo, though admittedly only a little bit.
I'm all for implementing the perfect protocol if it exists or there is a known credible path to get there. But to my knowledge noone has proposed such a thing (namecoin maybe?), certainly not in a form that my grandmother would be likely to use.
Do you have a suggestion for how you would like to see DNS evolve to fix these issues?
No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments.
DNSSEC isn't an imperfect protocol; it's harmful, a net loss.
DNSSEC is not DANE. All DNSSEC does is prevent MITM injection of DNS packets which is almost certainly one of the techniques QUANTUM INSERT uses. So no surprise he thinks DNS should be hardened against it.
And as Chrome experimented with DANE then removed support for it, I don't think you have to worry about that either.
But even if you did - so what? There are CAs in areas controlled by the American and British and French and Chinese governments already. I don't see how it makes anything different.
2. DNSSEC is harmful for reasons that go past DANE.
3. I am worried about DNSSEC; I think it's a more reasonable thing to be worried about w/r/t/ surveillance than 95% of what's been posted to The Intercept.
4. QUANTUM INSERT will work fine in an all-DNSSEC world.
5. You can revoke a CA. It has happened more than once. You can't revoke a TLD.
I'm happy to talk more about how I think DANE CAs are different and worse than the 20391 X509 CAs we have today, but I'm not sure you're asking me to go on at length about that.
> No. DNSSEC does not encrypt the DNS. After DNSSEC is implemented, everyone will still be able to read DNS. The major difference will be that sites will store their TLS keys in the DNS, and will thus have vouchsafed them with a new set of CAs controlled by the Five Eyes governments.
Fair enough, my knowledge of DNSSEC is limited. I thought it provided confidentiality in addition to authentication, but I see I was mistaken.
I'm still not sure how you arrive at the conclusion that it is a net loss. Which attacks will DNSSEC enable that are not possible today? If you mean that it will give people a false sense of security, is that not the same as TLS today? Despite my hangups with the CA system I think we're better off with TLS than without it.
The NSA certainly has no problems with intercepting DNS requests today with their QUANTUM tools.
I am genuinely interested in hearing other ideas about how to provide confidentiality and authentication for DNS without central trust. Since you have clearly investigated these matters, I would like to ask again, are you aware of any promising projects or ideas in this regard? Because I would jump into the anti-DNSSEC camp in a heartbeat if one existed.
Thanks, that was a good read, and cleared up a lot of misunderstanding I had about DNSSEC!
You make a strong argument that DNSSEC cannot deliver any real advantages. I did not see anything to support your earlier statement that it's worse than nothing, but given the general uselessness of the protocol, I certainly won't be deploying it.
One thing that makes it 'worse than nothing' is that it contributes to amplification attacks due to large response packets: http://dnscurve.org/amplification.html
Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make.
Most of the people who I've seen advocate for DNSSEC are graybeard traditionalists who want centralized control, not cryptographers or security experts.
A decentralized system like Namecoin, but more like Stellar (with EdDSA signatures please) than Bitcoin, would probably serve as an appropriate replacement for DNSSEC. But even that probably isn't necessary. Every sane end-to-end encryption protocol assumes DNS is insecure anyway.
> Implement all of the above, and you've obsoleted any argument that DNSSEC advocates can make.
Still no offline signatures.
How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact").
You can have offline signatures in a design for a Stellar/Namecoin/EdDSA decentralized protocol.
> How is it that centralized control is worse than the TLS's "everybody has full power to impersonate you" decentralization? You know that Certificate Transparency is still subject to MITM attacks, right? It just makes it obvious that you were victim of one after the fact (if there is an "after the fact").
This is non sequitur. You're comparing a bad option where only a few can screw you over (DNSSEC) with a bad option where lots can screw you over (CAs).
I want a protocol where no one can screw you over, except yourself. And I want the government to be powerless to do anything about it without your consent. And if it function with high anonymity (e.g. with Tor Hidden Services on servers purchased with cryptocurrencies), all the better.
Edward Snowden: So, I agree with you and I mean this is what's important about the IETF. Just because I say it, doesn't mean it's gospel. I can be wrong about an incredible amount of things. Nobody should trust me. Nobody should grant any sort of outsized weight to what I say.
When I talk about the NSA, I mentioned it in correlation with DANE and the DPRIVE initiative as well because the whole idea is that, yes, providing some mechanism for authentication of the responses between DNS queries is valuable. It's not an end to itself.
We still have to be able to say, "Well, all right, the certificate that you're getting from it, for a server is also reliable," and then we have to actually do more armour the requests themselves to make sure that they don’t become a new vector, they don't become manipulated.
Who knows like if eventually the DNS responses themselves that are provided through this become some sort of vulnerability because of the way they're parsed or whatever, but the whole idea is that we gotta start somewhere and then we've got to iterate from that point.
We've gotta begin building and when I think about things like DNSSEC, I don't think it's the golden age, we can solve all of the problems, but I do think that it's a start. It's better than the status quo. It's better than what we have today
And by getting the community thinking, by coming together and trying to develop some kind of solution, some kind of standard, we can start developing things that will allow us to build a bridge to the next generation of what we need to protect us against the next generation of coming attacks, and there's a lot of things that get in there. I mean cryptographic agility is one of the big hot things that we have to deal with as well.
I can barely follow this at all, but the part where he says DNSSEC is "better than the status quo" is pretty clear. The questioner responds, "so let's implement it".
Please be careful with what Snowden says. Whatever you think of his disclosures --- and most of my friends think they were brave and incredibly useful --- there is very little evidence that Snowden is qualified to advise anyone on cryptographic security, and some pretty significant evidence to the contrary.