'Cause, like, it's only the Web, see, no big deal. Chill, brah!
Wired | Experts Accuse Bush Administration of Foot-Dragging on DNS Security HoleM
Despite a recent high-profile vulnerability that showed the net could be hacked in minutes, the domain name system -- a key internet infrastructure -- continues to suffer from a serious security weakness, thanks to bureaucratic inertia at the U.S. government agency in charge, security experts say.
Kaminsky quietly worked with large tech companies to build patches for the net's name servers to make the attack more difficult. But security experts, and even the NTIA, say those patches are just temporary fixes; the only known complete fix is DNSSEC -- a set of security extensions for name servers.
But because DNS servers work in a giant hierarchy, deploying DNSSEC successfully also requires having someone trustworthy sign the so-called "root file" with a public-private key. Otherwise, an attacker can undermine the entire system at the root level, like cutting down a tree at the trunk. That's where the politics comes in. The DNS root is controlled by the Commerce Department's NTIA, which thus far has refused to implement DNSSEC.
"A few years ago, there were still technical hurdles to actually signing and using DNSSEC, but in the past few years, a lot of software tools, both commercial and open-source, have come out, and now it's a completely solved problem," Woodcock said. "All that's left is the far less tractable, purely political problem."
"Arguing over who gets to hold the cryptographic keys in the long run [should] wait until we're not facing a critical threat," Woodcock said.
Dirk Deppy at