2010 za con_todor_genov

DNSSEC 101 with a pinch of salt

Todor [email protected]

Sunday 17 October 2010

mailto:[email protected]

mailto:[email protected]

Who is this guy?


Who is this guy?

Unix geek/sysadmin


Who is this guy?

Unix geek/sysadmin

Works at a yellow-branded ISP


Who is this guy?

Unix geek/sysadmin

Works at a yellow-branded ISP

Does a lot of DNS as a result


What is DNSSEC?


What is DNSSEC?

DNS + public key crypto


What is DNSSEC?

DNS + public key crypto

Implemented as an extension to current DNS protocol


What is DNSSEC good for?



Authenticating response origin




Authenticating denial of existence




Authenticating denial of existence

Not much else


How it works(simplified)



Each zone has public/private key




All RRs are signed




All RRs are signed

Crypto signature and public key published in DNS alongside RR


A few new RRs


A few new RRsRRSIG - crypto signature of RR data


A few new RRs

DNSKEY - zone public keys-Key-signing key (KSK) - used to sign own ZSK

-Zone-signing key (ZSK) - used to sign all other RRs

RRSIG - crypto signature of RR data


A few new RRs




DS - delegation signer-Secure pointer to (checksum of) child KSK


A few new RRs




DS - delegation signer-Secure pointer to (checksum of) child KSK

NSEC and NSEC3 - authenticated denial of existence (NXDOMAIN)


RR set - the building block of DNSSEC

RR (A, PTR, MX, NS etc) + RRSIG (crypto signature)

RR sets


RR setsRR set - the building block of DNSSEC

RR (A, PTR, MX, NS etc)


Vanilla DNS org. 79810 IN NS d0.org.afilias-nst.org.org. 79810 IN NS c0.org.afilias-nst.info.org. 79810 IN NS a2.org.afilias-nst.info.org. 79810 IN NS b2.org.afilias-nst.org.org. 79810 IN NS a0.org.afilias-nst.info.org. 79810 IN NS b0.org.afilias-nst.org.




DNSSECorg. 79810 IN NS d0.org.afilias-nst.org.org. 79810 IN NS c0.org.afilias-nst.info.org. 79810 IN NS a2.org.afilias-nst.info.org. 79810 IN NS b2.org.afilias-nst.org.org. 79810 IN NS a0.org.afilias-nst.info.org. 79810 IN NS b0.org.afilias-nst.org.org. 79810 IN RRSIG NS 7 1 86400 20101015154542 20101001144542 245 org. Uy6dZ09BwvRmQHbzlK8gbflhQT1TVkEEYqrpff7W+uHn5Sz1jwqpNpIH LIgs5M6sHgURvzzdEn8C




Query validation


Query validation

Query result - A,MX,NS,PTR etc


Query validation


Cryptographic signature - RRSIG


Query validation



Public key - DNSKEY


Query validation



Public key - DNSKEY <- Why should I trust you?


Trust anchor

A DNSKEY that we trust to be correct

Confirmed from sources other than DNS

Enables us to validate data in a specific zone


Chain of trust

Starts at a trust anchor


Chain of trust

Starts at a trust anchor

Can be delegated to child zones- Name server delegation with NS records (NS RR set)

- Trust delegation with DS records (DS RR set)


Trust anchor


Trust anchor

ROOT

.COM .ORG

google.com insecure.org

.ZA


Trust anchor

ROOT

.COM .ORG


.ZA

.CO

.google


Trust anchor

.COM .ORG


.ZA

.CO

.google

ROOT


Chain of trust


As of July 2010 a trust anchor exists for the ROOT KSK

Chain of trust



Chain of trust

. 84500INDNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=. 84500INDNSKEY 256 3 8 AwEAAcAPhPM4CQHqg6hZ49y2P3IdKZuF44QNCc50vjATD7W+je4va6dj Y5JpnNP0pIohKNYiCFap/b4Y9jjJGSOkOfkfBR8neI7X5LisMEGUjwRc rG8J9UYP1S1unTNqRcWyDYFH2q3KnIO08zImh5DiFt8yfCdKoqZUN1du p5hy0UWz



Chain of trust

. 84500INDNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=. 84500INDNSKEY 256 3 8 AwEAAcAPhPM4CQHqg6hZ49y2P3IdKZuF44QNCc50vjATD7W+je4va6dj Y5JpnNP0pIohKNYiCFap/b4Y9jjJGSOkOfkfBR8neI7X5LisMEGUjwRc rG8J9UYP1S1unTNqRcWyDYFH2q3KnIO08zImh5DiFt8yfCdKoqZUN1du p5hy0UWz

Less than 20 signed TLDs


DS.org

tld.org

tld.org NS ns1.tld.orgtld.org DS checksum(KSK)

tld.org NS ns1.tld.orgtld.org DNSKEY KSK


Chain of trust


Chain of trustDelegating tld. to ns1.tld


Chain of trust. IN DNSKEY ROOT-KSK-key (trust anchor)

ROOT zone

Delegating tld. to ns1.tld



ROOT zone

. IN DNSKEY ROOT-ZSK-KEY

. IN RRSIG DNSKEY (ROOT-KSK-KEY signature)




ROOT zone




(trusted)



ROOT zone

tld. IN NS ns1.tld.tld. IN RRSIG NS (ROOT-KSK-key signature)




(trusted)



ROOT zone




ns1.tld. IN A 10.10.10.5ns1.tld. IN RRSIG A (ROOT-ZSK-key signature)


(trusted)



ROOT zone


tld. IN DS crypto_hash(tld-KSK)tld. IN RRSIG DS (ROOT-ZSK-key signature)





(trusted)



tld. IN DNSKEY tld-KSK tld. IN RRSIG DNSKEY (tld-KSK-self-signed-signature)

ROOT zone

tld zone (ns1.tld - 10.10.10.5)







(trusted)




ROOT zone

tld zone (ns1.tld - 10.10.10.5)







(trusted)

(trusted from DS in ROOT)




ROOT zone

tld zone (ns1.tld - 10.10.10.5)







(trusted)

tld. IN DNSKEY tld-ZSKtld. IN RRSIG DNSKEY (tld-KSK-signature)





ROOT zone

tld zone (ns1.tld - 10.10.10.5)







(trusted)

tld. IN DNSKEY tld-ZSKtld. IN RRSIG DNSKEY (tld-KSK-signature)


(trusted)


Caching DNS servers


Caching DNS serversValidating cache

- Performs crypto number-crunching on behalf of DNS client

- Affirms authenticity of data by setting AD bit in response

- Client session susceptible to spoofing (fake AD bit)


Caching DNS serversValidating cache

- Performs crypto number-crunching on behalf of DNS client

- Affirms authenticity of data by setting AD bit in response

- Client session susceptible to spoofing (fake AD bit)

Non-validating cache- Merely returns RR sets

- To ensure authenticity client must perform its own validation


Denial of existenceNSEC



NSEC record creates a chain of non-existence between RRs in a zone



NSEC record creates a chain of non-existence between RRs in a zoneC-3PO.com. IN A 10.10.10.1C-3PO.com. IN RRSIG jDDoe/x3r#

luke.com. IN A 10.10.10.2luke.com. IN RRSIG d<edNcd#?d

r2d2.com. IN A 10.10.10.3r2d2.com. IN RRSIG zDsc>\dybhDe



NSEC record creates a chain of non-existence between RRs in a zoneC-3PO.com. IN A 10.10.10.1C-3PO.com. IN RRSIG jDDoe/x3r#

luke.com. IN A 10.10.10.2luke.com. IN RRSIG d<edNcd#?d

r2d2.com. IN A 10.10.10.3r2d2.com. IN RRSIG zDsc>\dybhDe

C-3PO.com IN NSEC to luke.com.

luke.com. IN NSEC to r2d2.com.



dig doesnotexist.se NS



dig doesnotexist.se NSdoesithurt.se. 7200INNSECdof.se. NS RRSIG NSECdoesithurt.se. 7200INRRSIGNSEC 5 2 7200 20101007045252 20100930031234 26215 se. XH6itihRj7u/XJDNV0uaDfS72Ak8NL6A8xg1fa1vuOG8wrYLYf+iNO




eg. there is nothing between doesithurt.se and dof.se




eg. there is nothing between doesithurt.se and dof.se

Bad idea?


Denial of existenceNSEC3

NSEC3 creates a chain of non-existence between hashes of RRs in a zone03450ad8d88fa9bc8f22d9063328c08f52c0fa03 (hash of C-3PO.com.)

bc6ec803d77136128483bb220e449353a6a432a8 (hash of luke.com.)

f545de7360c432fcbfcfc1d80fa9b142cd359b79 (hash of r2d2.com.)

hash-of-C-3PO.com IN NSEC3 to hash-of-luke.com.

hash-of-luke.com. IN NSEC3 to hash-of-r2d2.com

NSEC3 response returns hash salt and number of iterations used



dig idontexist.org NS Yrp8N36uMZUgWRLUi9xVMq2GylslnLD6ehEoRVecDnWxPumIPt8iXi8i oj1XrQ5k8Dg9RINp19rcuaRcecmEUedtmfIdPvGtwWSUsoWP5XiGF/nx 2/Y=d78ice6u9jvfjqtfsesaoek3rg81fshn.org. 833 IN RRSIG NSEC3 7 2 86400 20101015154542 20101001144542 245 org. Zaq/jsAGv/GxG/wPWgpjczhzeTdwIFLykxbxzap3lWRK16+Q64d4F31Z ady60BSEyErddv2oafewi+eE6IG7zX6QvLrXZlAE5KYD2P1SswfFf/n+ IenKtXyCfFv7q9FeOr7Ex6aqUShIPg2asL8mAWWWPxn4knRsmR9hoz/C udo=d78ice6u9jvfjqtfsesaoek3rg81fshn.org. 833 IN NSEC3 1 1 1 D399EAAB D7DM84D9Q90H2UV918MF4BGDUKR4S5NNh9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 833 IN RRSIG NSEC3 7 2 86400 20101016052757 20101002042757 245 org. IZESTR/sqJI/ZDega0df557XQ6JhK42TaAhYyeR7RI3f9XD7nyULE8nk WTZv38Um/wzVFu6haBmSb4iz5TmShL1pUqlwZbQzZ7mpbxaY4iPwVfZ6 9JSSCnwaTWpg/pS17dyP+MiB4/yffaJnXiAVlTp6FNO7IFz735mD717C 4yU=h9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 833 IN NSEC3 1 1 1 D399EAAB H9RSFB7FPF2L8HG35CMPC765TDK23RP6 NS SOA RRSIG DNSKEY NSEC3PARAMvagq7rk03g3to127qkkhkn3vfmeivgpf.org. 833 IN RRSIG NSEC3 7 2 86400 20101015154542 20101001144542 245 org. 7KbiYKaNPtNIbTpDTAu+qcdiRrOn73qZztjEWL5/wc4HvCtp+ziIG9P1 nZ0fgBj7VFETp0P6V1+QVkjy5SoAennzEN9201v7f7e4iCPrqf/1q/k8 8cNNGvTk5/+/Me7qWEIYRUU3Dyy61rGaYZES8zAoR9TUhmubj8mIGzR+ MOE=vagq7rk03g3to127qkkhkn3vfmeivgpf.org. 833 IN NSEC3 1 1 1 D399EAAB VAPM2EIMJPEU2R3SNRILHGU61CHOC96A NS DS RRSIG



NSEC3 adds additional workload on authoritative AND caching DNS servers

- Authoritative: Calculating NSEC3 hash of QUERY in order to return correct answer

- Caching: Calculating NSEC3 hash of QUERY in order to compare to authoritative answer


Pitfalls of DNSSEC


Pitfalls of DNSSECZone files no longer human-modifiable

-Abstraction/automation required to publish data in DNS




ZSK and KSK lifetime expiration - ZSK (30 days default)

- KSK (12 months default)




ZSK and KSK lifetime expiration - ZSK (30 days default)

- KSK (12 months default)

Requires parent (registrar) capable of DNSSEC

- zaDNA is not one of them and will not be within next 18 months

- Neither is Uniforum


Lookaside validation(DLV)



DNSSEC Lookaside Validation (DLV) is a mechanism for publishing DNS Security (DNSSEC) trust anchors outside of the DNS delegation chain. It allows validating resolvers to validate DNSSEC-signed data from zones whose ancestors either aren't signed or don't publish Delegation Signer (DS) records for their children.

RFC5074


http://www.dnssec.net/


http://www.bind9.net/rfc









DNSSEC Lookaside Validation (DLV) is a mechanism for publishing DNS Security (DNSSEC) trust anchors outside of the DNS delegation chain. It allows validating resolvers to validate DNSSEC-signed data from zones whose ancestors either aren't signed or don't publish Delegation Signer (DS) records for their children.

RFC5074

Requires manual DLV trust-anchor config on resolvers












https://dlv.isc.org

Useful cludge for early adopters

Already configured on at least one large ZA ISP’s caches

Workaround for zaDNA’s lack of DNSSEC


https://dlv.isc.org

https://dlv.isc.org

Questions?


2010 za con_todor_genov

Documents

rrsig ns

key zsk

key ksk

publicprivate key

dns public key crypto

rr sets rr set

building block of dnssec

dnssec good