measuring ksk roll readiness - apnic · 2017. 11. 11. · user-side dns measurement multiple...
TRANSCRIPT
MeasuringKSKRollReadiness
Geoff HustonAPNIC Labs
TheDNSmaylooksimple
FortheDNSlooksareverydeceiving
WhatwewouldliketheDNStobe
Client DNS Resolver DNS Server
WhatwesuspectismoreliketheDNS
Client DNS Resolver DNS Server
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS ResolverDNS
ResolverDNS ResolverDNS
ResolverDNS ResolverDNS
Resolver
SignallingviaQueries
Client DNS Resolver Server
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS ResolverDNS
ResolverDNS ResolverDNS
ResolverDNS ResolverDNS
Resolver
ThequerycontainsinformationwhichpassesinwardintheDNStowardstheauthoritativeserver(s)
SignallingviaResponses
Client DNS Resolver Server
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS Resolver
DNS ResolverDNS
ResolverDNS ResolverDNS
ResolverDNS ResolverDNS
Resolver
TheresponsecontainsinformationwhichpassesbackwardintheDNStowardstheoriginalquerier
KSKRollMeasurementObjective
WhatnumberofusersareatriskofbeingimpactedbytheKSKRoll?
• Therearetworiskelementsforresolvers:• Unabletoreceivea1,414octetUDPresponsefromtherootservers(queryforDNSKEYRRfromtherootzone)• FailuretofollowRFC5011keyintroductionprocedure
• Ineithercasetheresolveroutcomeisthesame:Notloadingtheincomingtrustkeyintothelocaltrustedkeystore• Andiftheuserpassesqueriesonly totheseaffectedresolversthantherollwillcausealossofDNSservice
MeasuringResolversviaRFC8145SignalingGettingresolverstoreportontheirlocaltrustedkeystate• ResolversthatsupporttheRFC8145signalmechanismperiodicallyincludethekeytagoftheirlocallytrustedkeysintoaquerydirectedtowardstherootservers
Whatdidweseeat(some)roots?
DuaneWessels VeriSignRFC8145Signaling TrustAnchorKnowledgeInDNSSecurityExtensionsPresentationtoDNSSECWorkshop@ICANN60– 1Nov2017https://schd.ws/hosted_files/icann60abudhabi2017/ea/Duane%20Wessels-VeriSign-RFC%208145-Signaling%20Trust%20Anchor%20Knowledge%20in%20DNS%20Security%20Extensions.pdf
Whatisthissaying?
• ItsclearthatthereissomeresidualsetofresolversthataresignallingthattheyhavenotyetlearnedtotrustthenewKSKkey• Butitsnotclearif:• Thisisanaccuratesignalaboutthestateofthisresolver• Thisisanaccuratesignalabouttheidentityofthisresolver• Howmanyuserssit‘behind’thisresolver• Whethertheseusesrelysolelyonthisresolver,oriftheyalsohavealternateresolversthattheycanuse• Whatproportionofallusersareaffected
Why?
• BecausetheDNSdoesnotdisclosetheantecedentsofaquery• IfAforwardsaquerytoB,whoqueriesaRootServerthenifthequerycontainsanimplicitsignal(asinthiscase)thenitappearsthatBisquerying,notA• Atnotimeistheusermadevisibleinthereferredquery
• Becausecaching• IfAandBbothforwardtheirqueriesviaC,thenitmaybethatoneorbothofthesequeriesmaybeansweredfromC’scache• Inthiscasethesignalisbeingsuppressed
• Becauseitsactuallymeasuringacause,nottheoutcome• Itsmeasuringresolvers’uptakeofthenewKSK,butisnotabletomeasuretheuserimpactofthis
User-SideMeasurement
CanwedeviseaDNSquerythatcouldrevealthestateofthetrustedkeysoftheresolversbacktotheuser?
• NotwithinthecurrentparametersofDNSSECand/orresolverbehaviour
User-SideMeasurement
CanwedeviseaDNSquerythatcouldrevealthestateofthetrustedkeysoftheresolversbacktotheuser?• Whatifwecouldchangeresolverbehaviour?
• JustasRFC8145requiredachangeinresolverbehaviour• Whataboutachangetotheresolver’sreportingofvalidationoutcomedependingontheresolver’slocaltrustedkeystate?• Ifaquerycontainsthelabel“_is-ta-<key-tag>”thenavalidatingresolverwillreportvalidationfailureifthekeyisNOTinthelocaltrustedkeystore• Ifaquerycontainsthelabel“_not-ta-<key-tag>” thenavalidatingresolverwillreportvalidationfailureifthekeyISinthelocaltrustedkeystore
User-SideResolverMeasurement
ThreeDNSqueries:1. _is-ta-4066.<some.signed.domain>2. _not-ta-4066.<some.signed.domain>3. <badly-signed>.<some.signed.domain>
SingleResolverAnalysis:
ResolverBehaviour TypeLoadedNewKSK
NOTloadedNewKSKMechanismnotsupported
Notvalidating
Query1Query2Query3ASERVFAILSERVFAIL
SERVFAILASERVFAILAASERVFAILAAA
User-SideDNSMeasurement
MultipleResolverAnalysisASERVFAILresponsewillcausetheusetorepeattheyquerytootherconfiguredresolvers.Inamulti-resolverscenario,andwhereforwardersareusedwecanstilldetermineiftheuserwillbeimpactedbytheKSKroll
UserImpactOK
NOTOK
Query1Query2Query3ASERVFAILSERVFAIL
SERVFAILASERVFAILAASERVFAIL
SERVFAILSERVFAILSERVFAIL
AAA
UNKNOWN
NOTImpacted
MeasuringUserImpact
• Createthesetestsinascriptedwebpageandallowuserstotestthestateoftheirresolvers• Loadthesetestsintoanonlineadcampaignandusetheadtopassthetesttomillionsofusers• IftheusercanresolveQuery1,andSERVFAILsonQuery2andQuery3thentheuserisabletovalidateusingthenominatedkeyasatrustedkey• IftheuserSERVFAILSonQuery1,resolvesQuery2andSERVFAILsonQuery3thentheuserisunabletovalidateusingthenominatedkeyasatrustedkeys• OtherwiseiftheuserSERVFAILSonQuery3thentheresultisindeterminate
PrivacyandSecurityConsiderations
• Thistestitselfdoesnotrevealwhichresolversareusedbyendusersinresolvingnames• Thequeryitselfneednotcontainanyenduseridentifyingmaterial• Themethodologyneverchanges“insecure”to”authenticated”– itwillonlychange“authenticated”to“insecure”dependingontheresolver’slocaltrustedkeystatewhenresolvingcertainlabels• AnyonecansetupatestconditionwithintheirdelegatedpartoftheDNS• Theresultsofthetestarepassedbackonlytotheuserintheformofaresolutionoutcome
ADescriptionoftheMechanism
draft-huston-kskroll-sentinel
Thanks!