U.S. Misses DNS Security Deadline

Network World — The federal government missed its first deadline for rolling out DNS security mechanisms on its .gov top-level domain.

Federal officials now say they will cryptographically sign .gov by the end of February, one month behind their original schedule.

Federal agencies were required to deploy DNS Security Extensions (DNSSEC) on the .gov top-level domain by January 2009 and on all sub-domains by December 2009 under an Office of Management and Budget (OMB) mandate issued last year.  

DNSSEC prevents hackers from hijacking Web traffic and redirecting it to bogus sites. The Internet standard prevents spoofing attacks by allowing Web sites to verify their domain names and corresponding IP addresses using digital signatures and public-key encryption.

DNSSEC is the only foolproof way to prevent cache poisoning attacks, where a hacker redirects traffic from a legitimate Web site to a fake one without the user knowing. These attacks are a result of a significant DNS flaw known as the Kaminsky Bug, which was discovered this summer.

The U.S. General Services Administration (GSA) said Monday that it will deploy DNSSEC on .gov by the end of February.

"Careful and precise acceptance testing on this software was performed and reviewed by a team from OMB, GSA, [National Institutes of Standards and Technology] and [Department of Homeland Security]," the statement said. "During these reviews, it was determined by the team that this software would benefit from a change to improve functionality, which has caused a one-month delay in the implementation schedule."

The U.S. federal government's delay may be a sign that DNSSEC is harder to deploy than previously thought.

In the decade since the Internet standards was created, DNSSEC has been deployed by only a handful of countries, including Sweden, Puerto Rico, Bulgaria, Brazil and the Czech Republic.  

DNSSEC expert Olaf Kolkman, CEO of NLnet Labs and chair of the Internet Architecture Board, says he doesn't think the delay in signing .gov is significant.

"The train is on steam," Kolkman says of the U.S. government's DNSSEC deployment plan.  

In other DNSSEC news, NIST has purchased software from Secure64 called DNS Signer for use in its DNSSEC testing lab.  

"This is an important deal obviously because NIST is a pretty important client within the federal government space," says Mark Beckett, vice president of marketing for Secure64. "We are talking to and engaged with many agencies because the mandate is for them to deploy DNSSEC by the end of 2009. Many agencies are looking at our software, but NIST is the first actual customers within that space."

Scott Rose, a computer scientist with NIST's Information Technology Laboratory, says DNS Signer was one of several DNSSEC products that NIST has purchased for its testbed.

"NIST has obtained several products for use with the Secure Naming Infrastructure Pilot," Rose says. "The goal of SNIP is to provide a testbed for various network solutions and to assist U.S. federal agency DNS operators [to] learn and develop DNSSEC operational experience before deployment on their production zones. The SNIP team is willing to work with all providers in testing and experimentation."