ordinary dns
play

Ordinary DNS: www.google.com A? Client's k.root-servers.net com. - PowerPoint PPT Presentation

Ordinary DNS: www.google.com A? Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net A 192.5.6.30 Ordinary DNS: www.google.com A? Client's k.root-servers.net com. NS a.gtld-servers.net Resolver


  1. Ordinary DNS: www.google.com A? Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net A 192.5.6.30 …

  2. Ordinary DNS: www.google.com A? Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net A 192.5.6.30 … www.google.com A? Client's a.gtld-servers.net google.com. NS ns1.google.com Resolver ns1.google.com A 216.239.32.10 …

  3. Ordinary DNS: www.google.com A? Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net A 192.5.6.30 … www.google.com A? Client's a.gtld-servers.net google.com. NS ns1.google.com Resolver ns1.google.com A 216.239.32.10 … www.google.com A? Client's ns1.google.com www.google.com. A 74.125.24.14 Resolver …

  4. DNSSEC (with simplifications): www.google.com A? DO � Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net. A 192.5.6.30 … com. DS description-of-com's-key com. RRSIG DS signature-of-that- DS -record-using-root's-key

  5. DNSSEC (with simplifications): www.google.com A? DO Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net. A 192.5.6.30 … com. DS description-of-com's-key com. RRSIG DS signature-of-that- DS -record-using-root's-key Delegation Signer identifies .com 's public key (name and hash)

  6. DNSSEC (with simplifications): www.google.com A? DO Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net. A 192.5.6.30 … com. DS description-of-com's-key com. RRSIG DS signature-of-that- DS -record-using-root's-key Retrieving .com 's public key is complicated (actually involves multiple keys) …

  7. DNSSEC (with simplifications): www.google.com A? DO Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net. A 192.5.6.30 … com. DS description-of-com's-key com. RRSIG DS signature-of-that- DS -record-using-root's-key Specifies signature over another RR … here, the above DS record

  8. DNSSEC (with simplifications): www.google.com A? DO Client's k.root-servers.net com. NS a.gtld-servers.net Resolver a.gtld-servers.net. A 192.5.6.30 … com. DS description-of-com's-key com. RRSIG DS signature-of-that- DS -record-using-root's-key Note: no signature over NS or A !

  9. DNSSEC (with simplifications): www.google.com A? DO Client's a.gtld-servers.net google.com. NS ns1.google.com Resolver ns1.google.com. A 216.239.32.10 … google.com. DS description-of- google.com's-key google.com. RRSIG DS signature- of-that- DS -record-using-com's-key

  10. DNSSEC (with simplifications): www.google.com A? DO Client's ns1.google.com www.google.com. A 74.125.24.14 Resolver … www.google.com. RRSIG A signature-of-the- A -records-using- google.com's-key

  11. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver

  12. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver Resolver observes that the reply didn't include a signature, rejects it as insecure

  13. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver www.google.com RRSIG A signature-of-the- A -record-using- evil.com's-key

  14. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver www.google.com RRSIG A signature-of-the- A -record-using- evil.com's-key (1) If resolver didn't receive a signature from .com for evil.com 's key, then it can't validate this signature & ignores reply since it's not properly signed …

  15. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver www.google.com RRSIG A signature-of-the- A -record-using- evil.com's-key (2) If resolver did receive a signature from .com for evil.com 's key, then it knows the key is for evil.com and not google.com … and ignores it

  16. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver www.google.com RRSIG A signature-of-the- A -record-using- google.com's-key

  17. DNSSEC - Mallory attacks! www.google.com A? DO Client's ns1.evil.com www.google.com. A 6.6.6.6 Resolver www.google.com RRSIG A signature-of-the- A -record-using- google.com's-key If signature actually comes from google.com 's key, resolver will believe it … … but no such signature should exist unless either: (1) google.com intended to sign the RR, or (2) google.com 's private key was compromised

  18. Credit: ¡www.tcpipguide.com ¡

  19. Credit: ¡Steve ¡Friedl ¡

  20. Credit: ¡Steve ¡Friedl ¡

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend