DNSSEC implemented in the .us registry
The .us domain name joins a growing list of top-level Internet domains that are getting ready to improve DNS security by digitally signing DNS requests and replies for address information.
Domain Name Security Extensions (DNSSEC) have been implemented in the registry of the .us top-level Internet domain.
Neustar Inc., which has operated the .us registry since 2001, received permission to apply DNSSEC in October and signed the .us zone earlier this month. The company said it will encourage domain name registrars and registrants to incorporate a digital signature via DNSSEC into their domain records in early 2010.
The .us domain, one of a number of country codes used to identify the location of an entity within its Uniform Resource Locator (URL), joins a growing number of top level domains — including .gov and .org — getting ready to secure the Internet’s Domain Name System by digitally signing DNS requests and responses.
DNS translates easy-to-understand names in the form of URLs into numerical Internet Protocol (IP) addresses. DNS was not designed to provide security, and as a result this basic service underlying most activity on the Internet is vulnerable to spoofing and manipulation that could allow hackers to redirect traffic to fraudulent sites.
DNSSEC was developed to address this problem by digitally signing DNS queries and responses so that they can be authenticated using public signature keys. The protocols have been in the works for about 15 years, but implementation has been slow, at least in part because DNS has worked so well and nobody wants to fix what has not yet appeared to be broken.
DNSSEC complicates systems administrators’ jobs by requiring key generation and management, signing records and securing private keys on an ongoing basis as signatures expire and new ones are needed. But a growing number of vulnerabilities being discovered in DNS are spurring a move to secure the system through DNSSEC.
In late 2006 federal information security requirements called for agencies to use DNSSEC signatures on DNS servers classified as moderate- or high-impact information systems. But because most DNS servers are classified as low-impact systems, there was little implementation in the .gov domain. Following disclosure last year of a serious vulnerability in the DNS protocols, however, the Office of Management and Budget mandated that the .gov top-level domain be signed early this year, and that agencies sign their secondary domains by the end of the year.
The Public Interest Registry, which operates the .org registry, digitally signed that zone in June, making it the largest zone to be signed to date with more than 7.5 million domains registered in it. The largest zone, .com, is not expected to be signed until 2011. VeriSign has proposed signing the Internet’s root zone next year.
Signing various zones create islands of trust in which DNSSEC can work. Making it work between these islands requires establishing chains of trust for handling the cryptographic signing keys. The larger the zone being signed, the larger the island of trust the fewer the chains of trust needed to ensure authentication of DNS data.
“We are pleased that DNSSEC has been implemented in the .US domain, which complements work already under way to implement DNSSEC at the root zone level in the near future,” said Lawrence Strickling, assistant secretary for communications and information at the Commerce Department.
VeriSign, in outlining its plans for signing the root zone, the most basic zone in the Internet hierarchy, advised caution.
“The root should be signed without undue delay, but we recognize that this operation is a significant undertaking, requiring the coordination of several parties, and will therefore take time,” VeriSign wrote in its proposal to Commerce's National Telecommunications and Information Administration. “Further[more], the root zone is the most important zone in DNS and also one of the most queried zones. Its stability is vital. Signing the root cannot disrupt root operations, nor especially can signing the root disrupt DNS resolution throughout the Internet. Proper testing in advance of signing the production root is therefore important to gauge the impact. Any decision to sign must include a review of the testing results to determine what actions, if any, may be needed to ease any harmful effects of signing the root before proceeding.”
NEXT STORY: Air Force acknowledges stealth UAV