0

It doesn't happen often that a root name server changes, but when it does sometimes it takes months for OS vendors to provide patches and in the mean time there is a security risk.

So:

How to get named.cache (or named.root/db.cache from the same directory - the files are identical) in a secure way from http://www.internic.net/zones/ or ftp://ftp.internic.net/domain/ or http://www.internic.net/domain/?

The server behind those URLs does not support https. But there are md5 and sig files in these directories for every data file available.

As md5 isn't that secure, could the sig files be used?

If so, how?

(Note I'm not asking this on unix.stackexchange.com or superuser.com as I'm interested in the security aspect of this in a platform neutral way).

  • These md5's are there for to checksum conparison. – Ayesh K May 31 '15 at 14:41
1

The .sig file provided for each zone allows for an method of verification using the signature located at the bottom of the INTERNIC_ROOT_ZONE.signatures.asc file.

Using PGP you can then do the following for verification (see PGP key here):

$ gpg --keyserver --recv-key 0x0BD07395
$ gpg --verify zone.sig zone
|improve this answer|||||
  • So how do I know internic.net/zones/INTERNIC_ROOT_ZONE.signatures.asc is secure? – Jeroen Wiert Pluimers May 31 '15 at 14:56
  • With 100% certainty; you don't nor will you ever unless you are the one holding the private key used to derive the public key embedded within that file. So essentially there is a level of trust that the individual that is signing those packages is doing their due diligence in protecting the private keys associated with the signatures of the packages listed. Seeing as how these are indeed root level DNS servers there is a level of security that is employed that should allow you trust it. – jas- May 31 '15 at 15:00
  • 1
    To be honest I am not certain where their public key is for verification. You may have to contact them for it. Usually that is public domain but I couldn't find it in their site. – jas- May 31 '15 at 15:46
  • 1
    Found it (yes, I know about youtube.com/watch?v=ibF36Yyeehw): gpg --keyserver keys.gnupg.net --recv-key 0BD07395 which means I trust keys.gnupg.net, the way gpg communicates with keys.gnupg.net and the way Internic has communicated their public key to keys.gnupg.net. – Jeroen Wiert Pluimers May 31 '15 at 16:05
  • 1
    Note I needed this one: pgp.mit.edu:11371/pks/lookup?op=get&search=0x0BD07395 – Jeroen Wiert Pluimers May 31 '15 at 18:58
0

Without SSL an attacker can potentially modify the data files and the md5 signature files to match. So they provide little security. Md5 checksums should be provided over SSL to secure them tho this isn't frequently done. The sig files don't need SSL to be secure provided that you securely get the public key.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.