The Impact of DNSSEC - uni-due.de · 19-06-2015 · GOST R 34.10-2001 30 Signature verify failure...

The Impact of DNSSEC on the Internet Landscape

Matthäus Wander <matthaeus.wander@uni-due.de>

Duisburg, June 19, 2015

Outline

∙ Domain Name System

∘ Security problems

∘ Attacks in practice

∙ DNS Security Extensions (DNSSEC)

∘ Protection and new problems

∘ Adoption in practice

Universität Duisburg-Essen Verteilte Systeme

Matthäus Wander 2

DOMAIN NAME SYSTEM

Matthäus Wander 3

Domain Name System (DNS)

∙ Distributed Database

∙ Hierarchical Namespace

∙ Resolve domain names to data (e.g. IP address)

∘ Data sets: resource records

Matthäus Wander 4

Stub Resolver Recursive Resolver Recursive Resolver

Authoritative

Name Servers

DNS Spoofing Attacks

∙ Attacker Goals:

∘ Divert application to another server

∘ Deny service

Matthäus Wander 5

Authoritative

Name Servers

DNS Spoofing Attacks

∙ On-path attacker:

∘ Sees query, spoofs response (e.g. public WiFi)

∙ Off-path attacker:

∘ Predicts query, spoofs response (anywhere in the Internet)

Matthäus Wander 6

Authoritative

Name Servers

Man-in-the-Middle Attack

∙ Man-in-the-middle (MITM) attacker:

∘ Sees query, spoofs response

∙ Filtering of resolver users

Matthäus Wander 7

Authoritative

Name Servers

∙ Man-in-the-middle (MITM) attacker:

∘ Sees query, spoofs response

∙ Filtering of resolver users

Matthäus Wander 8

Stub Resolver Recursive Resolver

Authoritative

Name Servers

∙ MITM attack on IP router:

∘ Deep Packet Inspection of DNS traffic

∘ Router sees query, spoofs response

∙ Effective filtering of all DNS queries in network

Matthäus Wander 9

Stub Resolver ISP Router Recursive Resolver

Authoritative

Name Servers

Probing for DNS Injectors

Matthäus Wander 10

Vantage

Round-trip time [s]

Responses for „facebook.com“

Published in:

IEEE Access, 2014

Published in:

IEEE Access, 2014 DNS Injection over Time

Matthäus Wander 11

Responses for „facebook.com“

Impact Assessment on Third Parties

Matthäus Wander 12

Unrelated third party routed

through censored country

Published in:

IEEE Access, 2014

Open Resolver Measurement

∙ Worldwide impact of Chinese DNS injection

∙ Top-level domains

∘ 1144 name servers

∙ Multiple vantage points

∘ 255k open resolvers worldwide

Matthäus Wander 13

Sender Open

Resolver

Destination:

TLD server www.minghui.org.s1.verteiltesysteme.net. IN A ?

Published in:

IEEE Access, 2014

Open Resolver Results

∙ 15k resolvers (6%) affected by Chinese DNS injection

∙ 14k affected when contacting „e.dns.kr“

Matthäus Wander 14 Country

Destination name server

Published in:

IEEE Access, 2014

.kr Top-Level Domain Servers

Matthäus Wander 15

Published in:

IEEE Access, 2014

Impact Assessment on Third Parties

Matthäus Wander 16

Unrelated third party routed

through censored country

Published in:

IEEE Access, 2014

DNSSEC

Matthäus Wander 17

Concept

∙ Security goals: data integrity and authenticity

∙ Signatures pre-generated over DNS data sets

∙ End-to-end security between validator and signer

Matthäus Wander 18

Authoritative

Name Server

Resolver

Recursive

Resolver

DNS zone

Recursive

Resolver

Public Key Distribution

Matthäus Wander 19

Public key

net: key fingerprint

Public key

verteiltesysteme.net: key fingerprint

verteiltesysteme.net.

Public key

Signed resource records

Resolver has copy

of root public key

Trust Model

∙ Authority limited to subnamespace

∙ Powerful root authority

Matthäus Wander 20

Root Zone

Top-level

2nd level

DNSSEC

Cache Lock-in

Matthäus Wander 21

DNS zone

Stub Resolver Recursive Resolver Recursive Resolver Authoritative Name Server

CD=1 CD=1

∙ End-to-end security: validation on end host

∘ Independent of validation failures on intermediate resolvers

∙ Request response without DNSSEC validation

∘ Problem: cache lock-in

Cache Cache Cache

Cache Lock-in

Matthäus Wander 22

DNS zone

Stub Resolver Recursive Resolver Recursive Resolver Authoritative Name Server

CD=1 CD=1

∙ Omit intermediate resolvers

∙ Effectiveness of intermediate caching?

Cache Cache Cache

Trace-driven Simulation of Cache Effectiveness

∙ Cache models:

∘ Shared cache in front of 10k clients

∘ 10k independent caches

Matthäus Wander 23

Clients Recursive

Resolver Authoritative

Name Servers collection point

Bandwidth Overhead

External traffic:

∙ Shared cache:

2.44 GBytes

∙ 10k caches:

7.55 GBytes

Matthäus Wander 24

17 Sep 19 Sep 21 Sep 23 Sep 25 Sep 27 Sep 29 Sep

Internal

External (shared)

Internal

External (shared)

External (10k)

Latency Overhead

Matthäus Wander 25

Latency Overhead

Matthäus Wander 26

+11 ms Q0,5

+24 ms

+74 ms

Utilize intermediate DNS caches

Fall back to autonomous resolution on failure

Privacy and Confidentiality

∙ Client: no privacy improvement

∘ Cleartext DNSSEC messages

∙ Server: discloses hash values of zone contents

∘ Server proves non-existence

∘ Hashing supposed to hide names

∙ Break NSEC3 hash values with GPU-based attacks

∘ One GPU reveals 65% .com hash values in 5 days

Matthäus Wander 27

DNS zone

Client queries Server database

78a1 NSEC3 8e5d

h(„test“)=80a1

Published in:

IEEE NCA, 2014

ADOPTION OF DNSSEC

Matthäus Wander 28

Signed Top-Level Domains

Matthäus Wander 29

Signed Second-Level Domains

Matthäus Wander 30

TLD Domains

1. nl 2,279,702

2. br 566,694

3. cz 448,984

4. com 426,182

5. se 349,514

6. eu 320,311

7. fr 205,662

DNS zone

Server database

Total: 5,146,705 signed domains

8. no 119,759

9. be 92,385

10. net 81,391

11. org 46,382

12. ovh 29,372

13. nu 21,126

14. de 20,004

Algorithms and Key Sizes

Matthäus Wander 31

Algorithm Domains

RSA/MD5 0

DSA/SHA-1 2,176

RSA/SHA-1 1,547,782

RSA/SHA-256 1,869,157

RSA/SHA-512 1,100

GOST R 34.10-2001 30

ECDSA P-256/SHA-256 29

ECDSA P-384/SHA-384 19

RSA Key Size Domains

512 13,674

768 25

1024 3,152,420

1032 535

1152 108

1280 185,825

1304 105

1536 106

2048 59,907

2560 1

3072 3

4096 5,135

Result Domains

No DNSKEY (dangling DS) 17,751

No trusted DNSKEY

(dangling DS)

No RRSIG for trusted DNSKEY 238

Signature expired 2,138

Signature verify failure 5

Validation failure 21,198

Validation success 3,416,700

0,6% domains fail validation >99% use RSA

Shortest RSA key per domain Survey of

3.4M domains

Measuring Validating Clients

32 Universität Duisburg-Essen Verteilte Systeme

Matthäus Wander

https://SigOk.verteiltesysteme.net/a.png

Recursive Resolver

https://SigFail.verteiltesysteme.net/b.png

SigFail

DNSKEY

Authoritative Name Server

Invisible 1px images

Published in:

LNCS PAM, 2013

DNSSEC Validation

Matthäus Wander 33

∙ 841k test results from 557k distinct IP addresses

Published in:

LNCS PAM, 2013

DNSSEC Validation per Country

Matthäus Wander 34

2012–2013

Median per country: 1%

Published in:

LNCS PAM, 2013

DNSSEC Validation per Country

Matthäus Wander 35

2014–2015

Median per country: 20%

Conclusions (1/2)

∙ DNS spoofing used for Internet filtering

∘ 6% resolvers worldwide affected by Chinese DNS injection

∘ Evidence of router-based DNS injection in Iran

∘ Political changes in DNS filtering observable from outside

∙ DNS caching causes lock-in on bogus data

∘ Trace-driven simulation shows moderate benefit of caching

∘ Suggestion: omit DNS caches on DNSSEC validation failure

Matthäus Wander 36

Conclusions (2/2)

∙ DNSSEC secures data integrity and authenticity

∘ Hashing is ineffective for protecting the DNS database

∙ First-time survey of all DNSSEC signed domains

∘ 5M signed domains: >99% use RSA, 0.6% are broken

∙ 3-year measurement of validating clients

∘ Worldwide increase of DNSSEC adoption

∘ Varies by country (median 20%)

Matthäus Wander 37

Referenced Publications

∙ M. Wander, T. Weis:

Measuring Occurrence of DNSSEC Validation, Passive and Active Measurement (PAM), LNCS Springer, 2013.

∙ M. Wander, C. Boelmann, L. Schwittmann, T. Weis:

Measurement of Globally Visible DNS Injection, IEEE Access, 2014.

∙ M. Wander, L. Schwittmann, C. Boelmann, T. Weis:

GPU-based NSEC3 Hash Breaking, IEEE NCA, 2014. Awarded best student paper.

Matthäus Wander 38

The Impact of DNSSEC - uni-due.de · 19-06-2015 · GOST R 34.10-2001 30 Signature verify failure...

Documents

DB암호화 - · PDF fileKCDSA(전자서명용) RSAES-OAEP RSAES-PKCS1 등 일방향 암호 알고리즘 SHA-224/256/384/512 Whirlpool

CCNSO MEMBERS MEETING IANA Names Function Update · GOST R 34.11-94 SHA-384 RSA/SHA-256 RSA/SHA-512 GOST R 34.10-2001 ECDSA P-256 SHA-256 ECDSA P-384 SHA-384 EdDSA 25519 EdDSA 448

Survey of Cryptanalysis on Hash Functions Survey of... · Earlier cryptanalysis on hash functions ... SHA-1, FIPS-180-1, 1995 SHA-2 (SHA-256/384/512), FIPS-180-2, 2002. Dedicated

Algorithmes de hachage - Montefiore Institute...Revised Secure Hash Standard Le NIST a publié une révision : FIPS 180-2 Ajout de 3 algorithmes additionnels de hachage Sha-256, Sha-384,

NetScaler Secure Web Gateway 12 - Citrix Docs...AES-GCM(Example TLS1.2-AES128-GCM-SHA256) 12.1 12.1 SHA-2Ciphers(Example TLS1.2-AES-128-SHA256) 12.1 12.1 ECDSA(ExampleTLS1-ECDHE-ECDSA-AES256-SHA)

A Multiparty Computation Approach to Threshold ECDSA€¦ · Threshold ECDSA • Limited schemes based on Paillier encryption: [MacKenzie Reiter 04], [Gennaro Goldfeder Narayanan

Passwords are better with salt - kdb+ John Ludlow · In this article, password hashing via MD5, SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512 will be looked at. The need for salting

ECDSA Key Extraction from Mobile Devices via Nonintrusive ...tromer/mobilesc/mobilesc.pdf · ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels ∗ Daniel

Towards ANN-based Scalable Hashing Algorithm for Secure ... · 256, SHA-384, SHA-512, SHA-512/224, SHA-512/256. There is no possibility of obtaining output length that is in between

Mobile Application Protection · Calculate Digests MD5, SHA-1/224/256/384/512 Key Derivation Large variety of key manipulation routines iterated SHA-1, SHA-256, SHA-384, byte reversing,

IPv6 Ready LogoSupport Authentication Algorithm HMAC-SHA-256 in RFC 4868 (Using HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512 with Ipsec) (Section 5.2.8, and 6.2.8) Added the description

The Elliptic Curve Digital Signature Algorithm (ECDSA)

National Institute of Standards and Technology ... · (because of per message secret #) Sig Ver SHA ECDSA Signature Generation Component ... Regeneration Key Pair SHA RNG or DRBG

Sha sha sha sha sha sha OH YEAH! :))

“SHA-1 y la rotación de algoritmo en DNSSEC”...RSA DSA GOST ECDSA Se necesitan firmas MD5 SHA1, SHA256, SHA384, SHA512 2 ¿Por qué es necesario rotar? (rollover) Los algoritmos

Turbo SHA-2Turbo SHA-224/256 may be used to hash a message, M, having a length of l bits, where 0 • l < 264, while Turbo SHA-384/512 may be used to hash a message, M, having a length

Yashvanth-Kondi-12-MAC-KEYNOTE Threshold ECDSA

Descriptions of SHA-256, SHA-384, and SHA-512 from NIST

and x509 An introduction to TLS, PKI2016 05 09 - #PyCon.SE ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384: ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA

Northrop Grumman M5 Network Security SCS Linux · PDF fileCopyright © 2014 Northrop Grumman M5 Network Security. All rights reserved. SHA-1 SHA-224, SHA-256, SHA-384, SHA-512 crypto_free_hash