Securing DNSSEC Keys via Threshold ECDSA From Generic MPC Kris - - PowerPoint PPT Presentation

▶
securing dnssec keys via threshold ecdsa from generic mpc
SMART_READER_LITE
LIVE PREVIEW

Securing DNSSEC Keys via Threshold ECDSA From Generic MPC Kris - - PowerPoint PPT Presentation

Aug 03, 2023 144 likes •778 views

Securing DNSSEC Keys via Threshold ECDSA From Generic MPC Kris Shrishak TU Darmstadt, Germany November 6, 2020 NIST Workshop on Multi-Party Threshold Schemes 2020 Based on work published at ESORICS20 with Anders Dalskov, Marcel Keller,

slide-1
SLIDE 1

Securing DNSSEC Keys via Threshold ECDSA From Generic MPC

Kris Shrishak

TU Darmstadt, Germany

November 6, 2020 NIST Workshop on Multi-Party Threshold Schemes 2020

Based on work published at ESORICS’20 with Anders Dalskov, Marcel Keller, Claudio Orlandi and Haya Shulman

slide-2
SLIDE 2

This work

Threshold ECDSA for DNS zone signing

1 / 20

slide-3
SLIDE 3

This work

Threshold ECDSA for DNS zone signing

  • Key security for DNSSEC
  • Generic way of doing threshold ECDSA (signing and key gen)
  • Support for lots of different threat models
  • As fast, or faster, than previous work

1 / 20

slide-4
SLIDE 4

Outline

DNS and DNSSEC Threshold signatures for DNSSEC

slide-5
SLIDE 5

Outline

DNS and DNSSEC Threshold signatures for DNSSEC

slide-6
SLIDE 6

DNS

DNS is a protocol for mapping names to addresses

Client DNS Server https://ducks.de 198.51.100.43 “Where is ducks.de.?” “It’s at 198.51.100.43” HTTP GET / Host: ducks.de

2 / 20

slide-7
SLIDE 7

DNS

DNS is a protocol for mapping names to addresses

Client DNS Server https://ducks.de 198.51.100.43 “Where is ducks.de.?” “It’s at 198.51.100.43” HTTP GET / Host: ducks.de

2 / 20

slide-8
SLIDE 8

DNS

DNS is a protocol for mapping names to addresses

Client DNS Server https://ducks.de 198.51.100.43 “Where is ducks.de.?” “It’s at 198.51.100.43” HTTP GET / Host: ducks.de

2 / 20

slide-9
SLIDE 9

DNS

DNS is a protocol for mapping names to addresses

Client DNS Server https://ducks.de 198.51.100.43 “Where is ducks.de.?” “It’s at 198.51.100.43” HTTP GET / Host: ducks.de

2 / 20

slide-10
SLIDE 10

DNS Insecurity

Poisoning/Spoofing is possible

3 / 20

slide-11
SLIDE 11

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

3 / 20

slide-12
SLIDE 12

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

Client ISP DNS Server https://ducks.de 198.51.100.43 Adversary 198.51.100.123 ducks.de.? ducks.de.? 198.51.100.123 HTTP GET / Host: ducks.de

3 / 20

slide-13
SLIDE 13

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

Client ISP DNS Server https://ducks.de 198.51.100.43 Adversary 198.51.100.123 ducks.de.? ducks.de.? 198.51.100.123 HTTP GET / Host: ducks.de

3 / 20

slide-14
SLIDE 14

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

Client ISP DNS Server https://ducks.de 198.51.100.43 Adversary 198.51.100.123 ducks.de.? ducks.de.? 198.51.100.123 HTTP GET / Host: ducks.de

3 / 20

slide-15
SLIDE 15

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

Client ISP DNS Server https://ducks.de 198.51.100.43 Adversary 198.51.100.123 ducks.de.? ducks.de.? 198.51.100.123 HTTP GET / Host: ducks.de

3 / 20

slide-16
SLIDE 16

DNS Insecurity

Poisoning/Spoofing is possible First answer is accepted

Client ISP DNS Server https://ducks.de 198.51.100.43 Adversary 198.51.100.123 ducks.de.? ducks.de.? 198.51.100.123 HTTP GET / Host: ducks.de

3 / 20

slide-17
SLIDE 17

DNSSEC

DNSSEC fixes this problem

  • Data integrity: data was not changed in transit
  • Origin authentication: data originated from the owner

4 / 20

slide-18
SLIDE 18

DNS in practice

Azure DNS Cloudflare UltraDNS ducks.de cuteswans.de DNS Operators Domains

5 / 20

slide-19
SLIDE 19

DNSSEC deployment issues

Studies 12 have found that

  • Some operators use the same key for all domains
  • E.g., one key shared by > 132 000 domains

1A Longitudinal, End-to-End View of the DNSSEC Ecosystem (USENIX ’17) 2One Key to Sign Them All Considered Vulnurable: Evaluation of DNSSEC in the Internet (NSDI ’17) 6 / 20

slide-20
SLIDE 20

DNSSEC deployment issues

Studies 12 have found that

  • Some operators use the same key for all domains
  • E.g., one key shared by > 132 000 domains

1A Longitudinal, End-to-End View of the DNSSEC Ecosystem (USENIX ’17) 2One Key to Sign Them All Considered Vulnurable: Evaluation of DNSSEC in the Internet (NSDI ’17) 6 / 20

slide-21
SLIDE 21

DNSSEC deployment issues

Studies 12 have found that

  • Some operators use the same key for all domains
  • E.g., one key shared by > 132 000 domains
  • Default is 1024-bit RSA
  • Most keys 1024-bit, with ∼10K domains use 512-bit RSA
  • The majority of keys were not rotated in a 21-month period
  • Some providers use different keys but share the modulus

1A Longitudinal, End-to-End View of the DNSSEC Ecosystem (USENIX ’17) 2One Key to Sign Them All Considered Vulnurable: Evaluation of DNSSEC in the Internet (NSDI ’17) 6 / 20

slide-22
SLIDE 22

DNSSEC in practice

DNSSEC

  • Should use ECDSA instead of RSA
  • Shorter signatures reduce the chance of packet fragmentation 1

1RFC 6781 recommends 1024-bit RSA for this reason 2See 2016 Dyn attacks 3RFC 8901: Multi-Signer DNSSEC Models 7 / 20

slide-23
SLIDE 23

DNSSEC in practice

DNSSEC

  • Should use ECDSA instead of RSA
  • Shorter signatures reduce the chance of packet fragmentation 1
  • Support multiple name servers
  • better availability and DDoS protection 2
  • new standard 3 requires zone owner interaction while relinquishing key control

1RFC 6781 recommends 1024-bit RSA for this reason 2See 2016 Dyn attacks 3RFC 8901: Multi-Signer DNSSEC Models 7 / 20

slide-24
SLIDE 24

Outline

DNS and DNSSEC Threshold signatures for DNSSEC

slide-25
SLIDE 25

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

8 / 20

slide-26
SLIDE 26

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

ISP [sk] [sk] [sk] DNS Operators ducks.de.? MPC 1.2.3.4 Sigsk(1.2.3.4||ducks.de)

8 / 20

slide-27
SLIDE 27

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

ISP [sk] [sk] [sk] DNS Operators ducks.de.? MPC 1.2.3.4 Sigsk(1.2.3.4||ducks.de)

8 / 20

slide-28
SLIDE 28

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

ISP [sk] [sk] [sk] DNS Operators ducks.de.? MPC 1.2.3.4 Sigsk(1.2.3.4||ducks.de)

8 / 20

slide-29
SLIDE 29

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

ISP [sk] [sk] [sk] DNS Operators ducks.de.? MPC 1.2.3.4 Sigsk(1.2.3.4||ducks.de)

8 / 20

slide-30
SLIDE 30

Threshold signatures for DNSSEC

Zone signing with Threshold ECDSA [sk] ← Share(sk)

ISP [sk] [sk] [sk] DNS Operators ducks.de.? MPC 1.2.3.4 Sigsk(1.2.3.4||ducks.de)

Threshold signing should not be much more expensive than regular DNSSEC

8 / 20

slide-31
SLIDE 31

ECDSA

s = k−1(H(M) + sk · rx)

9 / 20

slide-32
SLIDE 32

ECDSA

s = k−1(H(M) + sk · rx)

9 / 20

slide-33
SLIDE 33

Threshold ECDSA

s = H(M)[k−1] + [sk · k−1] · rx

10 / 20

slide-34
SLIDE 34

Threshold ECDSA signing in 3 phases s = H(M)[k−1] + [sk · k−1] · rx

Preprocessing: Key independent Preprocessing: Key independent Message independent Online phase DNS Operators MPC [k−1] [sk′] = [sk · k−1] s, rx

11 / 20

slide-35
SLIDE 35

Threshold ECDSA signing in 3 phases s = H(M)[k−1] + [sk · k−1] · rx

Preprocessing: Key independent Preprocessing: Key independent Message independent Online phase DNS Operators MPC [k−1] [sk′] = [sk · k−1] s, rx

11 / 20

slide-36
SLIDE 36

Threshold ECDSA signing in 3 phases s = H(M)[k−1] + [sk · k−1] · rx

[k−1] [k−1] [k−1] Preprocessing: Key independent Preprocessing: Key independent Message independent Online phase DNS Operators MPC [k−1] [sk′] = [sk · k−1] s, rx

11 / 20

slide-37
SLIDE 37

Threshold ECDSA signing in 3 phases s = H(M)[k−1] + [sk · k−1] · rx

[k−1], [sk−1] [k−1], [sk−1] [k−1], [sk−1] Preprocessing: Key independent Preprocessing: Key independent Message independent Online phase DNS Operators MPC [k−1] [sk′] = [sk · k−1] s, rx

11 / 20

slide-38
SLIDE 38

Threshold ECDSA signing in 3 phases s = H(M)[k−1] + [sk · k−1] · rx

[k−1], [sk−1], M [k−1], [sk−1], M [k−1], [sk−1], M Preprocessing: Key independent Preprocessing: Key independent Message independent Online phase DNS Operators MPC [k−1] [sk′] = [sk · k−1] s, rx

11 / 20

slide-39
SLIDE 39

Threshold ECDSA signing s = H(M)[k−1] + [sk · k−1] · rx Problems: How do we compute

  • 1. [k−1]
  • 2. rx

12 / 20

slide-40
SLIDE 40

Threshold ECDSA signing

Need to compute s = [k−1](H(M) + [sk] · rx)

13 / 20

slide-41
SLIDE 41

Threshold ECDSA signing

Need to compute s = [k−1](H(M) + [sk] · rx) Problem how do we compute [k−1]? Main difficulty with threshold ECDSA

13 / 20

slide-42
SLIDE 42

Threshold ECDSA signing

From [k] to [k−1] using a trick due to Bar-Ilan and Beaver4

4Non-cryptographic fault-tolerant computing in constant number of rounds of interaction (PODC ’89) 14 / 20

slide-43
SLIDE 43

Threshold ECDSA signing

From [k] to [k−1] using a trick due to Bar-Ilan and Beaver4

  • 1. Suppose we have ([k], [b], [c]) with c = k · b

4Non-cryptographic fault-tolerant computing in constant number of rounds of interaction (PODC ’89) 14 / 20

slide-44
SLIDE 44

Threshold ECDSA signing

From [k] to [k−1] using a trick due to Bar-Ilan and Beaver4

  • 1. Suppose we have ([k], [b], [c]) with c = k · b
  • 2. Open [c]

4Non-cryptographic fault-tolerant computing in constant number of rounds of interaction (PODC ’89) 14 / 20

slide-45
SLIDE 45

Threshold ECDSA signing

From [k] to [k−1] using a trick due to Bar-Ilan and Beaver4

  • 1. Suppose we have ([k], [b], [c]) with c = k · b
  • 2. Open [c]
  • 3. Compute c−1[b] = [(k · b)−1b] = [k−1]

4Non-cryptographic fault-tolerant computing in constant number of rounds of interaction (PODC ’89) 14 / 20

slide-46
SLIDE 46

Threshold ECDSA signing

From [k] to [k−1] using a trick due to Bar-Ilan and Beaver4

  • 1. Suppose we have ([k], [b], [c]) with c = k · b
  • 2. Open [c]
  • 3. Compute c−1[b] = [(k · b)−1b] = [k−1]

Computing [k−1] is the most expensive part of signing

4Non-cryptographic fault-tolerant computing in constant number of rounds of interaction (PODC ’89) 14 / 20

slide-47
SLIDE 47

Secure Computation over Elliptic Curves

Need to compute s = [k−1](H(M) + [sk] · rx)

15 / 20

slide-48
SLIDE 48

Secure Computation over Elliptic Curves

Need to compute s = [k−1](H(M) + [sk] · rx) Problem how do we compute rx?

15 / 20

slide-49
SLIDE 49

Secure Computation over Elliptic Curves

Need to compute s = [k−1](H(M) + [sk] · rx) Problem how do we compute rx? where (rx, ry) = R = k · G

15 / 20

slide-50
SLIDE 50

Secure Computation over Elliptic Curves

Need to compute s = [k−1](H(M) + [sk] · rx) Problem how do we compute rx? where (rx, ry) = R = k · G

15 / 20

slide-51
SLIDE 51

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G.

[k] k k R = k · G local conversion Open(k)

16 / 20

slide-52
SLIDE 52

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G.

[k] k k R = k · G local conversion Open(k)

16 / 20

slide-53
SLIDE 53

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G.

[k] k k R = k · G local conversion Open(k)

16 / 20

slide-54
SLIDE 54

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G.

[k] k k R = k · G local conversion Open(k)

16 / 20

slide-55
SLIDE 55

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G.

[k] k k R = k · G local conversion Open(k)

16 / 20

slide-56
SLIDE 56

Secure Computation over Elliptic Curves

Let [k] denote an additive sharing of k over Zp Let k denote a sharing of k · G. Supports all the usual suspects

  • Addition/constant addition
  • Constant scalar mult: a · x = a · x
  • Constant point mult: [a] · X = a · x, where X = x · G (note that x may be

unknown).

17 / 20

slide-57
SLIDE 57

Threshold ECDSA signing in 3 phases

Key independent pre-processing

  • 1. Use triples ([k], [b], [c]) to compute [k−1]
  • 2. k = cnv([k])

18 / 20

slide-58
SLIDE 58

Threshold ECDSA signing in 3 phases

Key independent pre-processing

  • 1. Use triples ([k], [b], [c]) to compute [k−1]
  • 2. k = cnv([k])

Message independent pre-processing

  • 1. [sk′] = [sk · k−1] = [sk] · [k−1]

18 / 20

slide-59
SLIDE 59

Threshold ECDSA signing in 3 phases

Key independent pre-processing

  • 1. Use triples ([k], [b], [c]) to compute [k−1]
  • 2. k = cnv([k])

Message independent pre-processing

  • 1. [sk′] = [sk · k−1] = [sk] · [k−1]

Signing (input is (k, [sk′], M))

  • 1. (rx, ry) = R = Open(k)
  • 2. [s] = H(M) · [k−1] + rx · [sk′]
  • 3. s = Open([s]), output (rx, s)

18 / 20

slide-60
SLIDE 60

Threshold ECDSA signing in 3 phases

Key independent pre-processing

  • 1. Use triples ([k], [b], [c]) to compute [k−1]
  • 2. k = cnv([k])

Message independent pre-processing

  • 1. [sk′] = [sk · k−1] = [sk] · [k−1]

Signing (input is (k, [sk′], M))

  • 1. (rx, ry) = R = Open(k)
  • 2. [s] = H(M) · [k−1] + rx · [sk′]
  • 3. s = Open([s]), output (rx, s)

18 / 20

slide-61
SLIDE 61

Threshold ECDSA signing in 3 phases

Key independent pre-processing

  • 1. Use triples ([k], [b], [c]) to compute [k−1]
  • 2. k = cnv([k])

Message independent pre-processing

  • 1. [sk′] = [sk · k−1] = [sk] · [k−1]

Signing (input is (k, [sk′], M))

  • 1. (rx, ry) = R = Open(k)
  • 2. [s] = H(M) · [k−1] + rx · [sk′]
  • 3. s = Open([s]), output (rx, s)

Key generation just generate random [x] and pk = Open(cnv([x]))

18 / 20

slide-62
SLIDE 62

Benchmarks

Comparison with prior work

LAN WAN n Sign(ms) KeyGen(ms) Sign(ms) KeyGen(ms) Rep3 3 2.78 1.45 367.87 291.32 Shamir 3 3.02 1.39 1140.09 486.82

  • Mal. Rep3

3 3.45 1.57 1128.01 429.47

  • Mal. Shamir

3 4.43 1.89 2340.53 485.11 MASCOT 2 6.56 4.32 2688.92 2632.07 MASCOT– 2 3.61 4.41 729.08 2654.59 DKLS 2 3.58 43.73 234.37 1002.97 Unbound 2 11.33 315.96 490.73 1010.98 Kzen † 2 310.71 153.87 14441.83 7237.93

†: Implementation of [GG18] Fast Multiparty Threshold ECDSA with Fast Trustless Setup (CCS ’18)

19 / 20

slide-63
SLIDE 63

Benchmarks

Throughput

LAN WAN Tuples per sec. Sign (ms) Tuples per sec. Sign (ms) Rep3 922.27 2.49 715.54 247.13 Shamir 1829.69 2.37 402.88 271.80

  • Mal. Rep3

914.65 2.52 309.76 245.14

  • Mal. Shamir

1792.30 2.91 172.87 416.60 MASCOT 380.19 4.82 31.98 756.34 MASCOT– 700.94 2.75 68.31 258.85

20 / 20