Masters of the domain

Like so many of the technical underpinnings of the Internet, the Domain Name System that translates names into IP addresses was not designed with adequate security. The DNS Security Extensions (DNSsec) for digitally signing and authenticating information has been developed to help fix that problem, and its use in government is likely to become more common.In late 2006, new federal information security requirements called for agencies to use DNSsec signatures on DNS servers that are classified as moderate- or high-impact information systems. However, to date there has been little implementation of DNSsec in the .gov domain, said Doug Montgomery, manager of the Internet technical research group for the National Institute of Standards and Technology.'It depends on how you classify the impact level of your system,' Montgomery said.Most DNS servers are classified as low impact and do not fall under the requirement for digital signatures. However, it's likely that the Federal Information Security Management Act, which is up for review this year, will expand the DNSsec requirement for agencies, Montgomery said.NIST provides workshops to give administrators hands-on experience with the security extensions. 'We do that in a day and a half,' Montgomery said. 'It's not an insurmountable learning curve.'But that does not mean implementing DNSsec is painless. 'It isn't that tough, but it does change how DNS is managed,' said Scott Rose, a computer scientist at NIST.What has been a matter primarily of editing text files now requires managing cryptographic keys and digital signatures that are valid only for a month.'You now are dealing with actual calendar time,' Rose said. 'Now there is a lot of management. That has to be practiced.'You can't get that practice in a one- or two-day workshop, so NIST has established the Secure Naming Infrastructure Pilot (SNIP) to give administrators experience with managing a signed DNS zone on a live network.'As opposed to a one-shot workshop or demo, it provides an ongoing, persistent test bed and training infrastructure,' said Montgomery, the SNIP project manager.SNIP is a joint project of NIST, the Homeland Security Department and Sparta.That company is a Defense Department and intelligence contractor that provides, among other things, network operations.SNIP provides a test domain on which participants can mirror their current DNS operations and learn what effect DNSsec will have on those operations and on the performance of DNS servers themselves.For a test bed, NIST maintains a SNIP domain, www.dnsops.gov, to provide signed DNS zones for government users.Contractors that want to participate but do not qualify for the .gov domain can use a separate SNIP domain maintained at www.dnsops.biz. The domains are hosted on the same servers, which have standard IPv4 connectivity and an IPv6-enabled connection to the Internet2 research and education network so that signed zones can be reached through either version of the Internet protocols. DNS is 25 years old this year, and has been unquestionably successful.'Certainly, DNS has scaled beyond its designers' wildest dreams,' said Cricket Liu, vice president of infrastructure at Infoblox.The scheme has gone from an Internet with tens of thousands of hosts to tens of millions of hosts in a form not substantially different from its original version.'There aren't any inherent limits to DNS scalability.'DNS is a distributed, hierarchical scheme that lets everyone see into it to find addresses without having to maintain a separate copy. The Internet's 13 root name servers are the authoritative DNS source, but most queries do not reach this level as data is propagated through the system.The number of available IP addresses will explode with the implementation of IPv6, but that should not pose a threat to DNS, Liu said.'The roll-out of IPv6 will test its scalability even further, but I would not predict any catastrophic failure because of it,' he said.However, there are security concerns. Infoblox does an annual survey of the Internet infrastructure, looking at the configuration of an estimated 12 million name servers providing DNS services.'An awful lot of these servers will offer recursion to anybody,' Liu said. Recursion is when a DNS server that has received a request queries another DNS server to resolve a name. The process is faster than passing the request up the hierarchy for an authoritative answer, but it also can make cache poisoning easier and expose the server to other exploits.'All modern name servers will allow you to restrict recursive queries,' Liu said. 'The number of recursive servers seems to be getting smaller,' but about half still accept recursive queries.Many servers also are running older versions of software. The Berkeley Internet Name Domain (BIND) server probably is the most commonly used DNS software.The latest version, BIND 9, was rewritten to support DNSsec. BIND 8 is obsolete, but about 14 percent of servers scanned were still running it a year ago, Liu said. That figure now is down to about 6 percent, probably due to attrition, but 'that still is an awful lot of name servers running an obsolete version. And the older versions of BIND have some nasty vulnerabilities.''We have had some pretty bad attacks against the DNS infrastructure,' Liu said, including one that took the National Security Administration offline in May. But the attacks get little public attention compared with more widely publicized data breaches. 'DNS is an arcane technology to most people.'NIST has said the DNSsec specification is complete and ready for deployment, but adoption so far is in the early stages, largely because of management concerns.SNIP went online in March 2007, but it is 'still on the ramping-up side of things in terms of participation,' Montgomery said.Montgomery said he expects interest in it to increase as FISMA requirements for DNSsec deployment expand. The test bed will be needed until the security extensions are fully deployed as part of the .gov infrastructure.'When it's time to ramp down the pilot, it will be a good thing,' he said.