<h1 class="storytitle">PROTECT IP threatens the future of DNS security</h1>
<div class="meta"><a href="http://www.afterdawn.com/news/article.cfm/2011/08/26/protect_ip_threatens_the_future_of_dns_security">http://www.afterdawn.com/news/article.cfm/2011/08/26/protect_ip_threatens_the_future_of_dns_security</a><br>
<br>Written by <a href="http://www.afterdawn.com/news/by_author.cfm/vurbal">Rich Fiscus</a> @ 25 Aug 2011 23:46 <a href="http://www.afterdawn.com/news/article.cfm/2011/08/26/protect_ip_threatens_the_future_of_dns_security#comments" rel="nofollow" class="comments">User comments (1)</a></div>
<div class="storycontent KonaBody">
<p>
</p><div class="ingress">
<img class="alignleft" src="http://cdn3.afterdawn.fi/v3/news/justice_smaller.jpg" alt="PROTECT IP threatens the future of DNS security">
PROTECT IP is the name of a bill which is working its way through
the US Senate with a version also expected to be introduced in the
House of Representatives next month. It would require the Attorney
General's office to compile of list of domain names which DNS operators
(in the US) will be required to block.
</div><div class="maintext">
According to some critics, it threatens to undo more than a decade of Internet security development in a single stroke.
<br>
<br>To understand exactly what that means, I talked to one of those critics - <b>Paul Vixie</b> of the <b>Internet Systems Consortium</b> (<b>ISC</b>). You may not be familiar with <b>ISC</b>, but you almost certainly make use of their software every day.
<br>
<br><b>ISC</b> is a non-profit corporation which develops BIND, the most
widely used DNS server software on the planet. When you type a domain
name like AfterDawn.com into your web browser, your computer relies on a
worldwide network of DNS servers to translate it into an IP address.
<br>
<br>As part of BIND development, <b>ISC</b> has put significant
resources into making DNS more secure through the use of an extension
called DNSSEC. DNSSEC adds an encrypted signature to DNS records, making
it possible to ensure the IP address you get from a DNS server is
authentic.
<br>
<br>DNSSEC support isn't finished yet, and if PROTECT IP is implemented <b>Paul Vixie</b> says it never will be.
<br>
<br>Under PROTECT IP, DNS server operators in the US would be required
to replace the correct IP address for a blacklisted domain name with an
alternate address provided by the Attorney General's office.
<br>
<br>When I spoke with <b>Paul</b>, he talked about why this causes problems with DNSSEC:
<br>
<br><blockquote>Ultimately there are two ways to modify DNSSEC data. You
can either strip off the signatures in which case your modified
response will be ignored, or you can just drop the query and never send a
response at all. The trouble with these as lawful mandates is that
they're indistinguishable from what evildoers will do. There's nothing
in the DNSSEC protocol to say "this is a lawful insert or modification,
you should accept it."</blockquote>
<br>
<br>He then went on to explain how PROTECT IP would make it impossible to implement DNSSEC in the real world:
<br>
<br><blockquote>Say your browser, when it's trying to decide whether
some web site is or is not your bank's web site, sees the modifications
or hears no response. It has to be able to try some other mechanism like
a proxy or a VPN as a backup solution rather than just giving up (or
just accepting the modification and saying "who cares?"). Using a proxy
or VPN as a backup solution would, under PROTECT IP, break the law.
<br>
<br>I have a special concern about this since we will have to implement
backup plans in the BIND validator. which we will not do if PROTECT IP
passes. and without this kind of backup plan, DNSSEC itself will never
be commercially viable.</blockquote>
<br>
<br>In other words, if DNSSEC is going to work in the real world it
needs to be reliable. If the server doesn't have options to route around
errors, no one will use it.
<br>
<br>If it does have those options, PROTECT IP says it's illegal.
<br>
<br>Considering PROTECT IP is focused on mandating how DNS operates, you might expect its authors to have at least consulted with <b>ISC</b>. Sadly they didn't.
<br>
<br>That hasn't stopped Vixie from making his opinion known, both to legislators and the public at large.
<br>
<br>In May of this year he <a href="http://www.circleid.com/pdf/PROTECT-IP-Technical-Whitepaper-Final.pdf">co-authored a whitepaper</a>
outlining the technical problems with PROTECT IP. Then, in July, along
with the other whitepaper authors, he met with members of Congress from
both parties to explain their concerns in person.
<br>
<br>Supporters of PROTECT IP are hailing it as a magic bullet for
preventing online intellectual property infringement. The reality is it
would do more harm than good, and wouldn't even work.
<br>
<br>Bypassing DNS filtering is trivially easy. All you need to do is
configure your computer to use DNS servers outside the US which won't be
affected by the law.
<br>
<br>And ultimately that's the biggest technical problem with PROTECT IP. It can only work to the extent the public allows.
<br>
<br>Obviously whatever segment of the population is downloading
illegally doesn't want it to work at all, and they will be able to
bypass it.
</div>
</div>