Securing the last mile of DNS with CGA-TSIG Marc Buijsman Master - - PowerPoint PPT Presentation
Securing the last mile of DNS with CGA-TSIG Marc Buijsman Master System & Network Engineering 19 December 2013 Problem statement last mile not secured internet authoritative name server client recursive authoritative last
Securing the last mile of DNS with CGA-TSIG
Marc Buijsman
Master System & Network Engineering
19 December 2013
Problem statement
“last mile” not secured
internet
client (stub resolver) recursive name server
last mile
authoritative name server authoritative name server authoritative name server
1 / 23
Problem statement
do local resolution requires local server DNSSEC requires root key validating stub DNSCurve not widely deployed needs server support TSIG DNS message authentication shared key not scalable 2 / 23
Problem statement
new proposal: CGA-TSIG research question:
Is CGA-TSIG an adequate solution to the last mile problem?
Does CGA-TSIG provide the necessary security? Is the CGA-TSIG specification correct?
specification model implementation
verification
3 / 23
Transaction Signature
4 / 23
TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data
5 / 23
TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data
used for key ID
5 / 23
TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data
used for key ID "TSIG"
5 / 23
TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data
used for key ID "TSIG" "HMAC-MD5"
5 / 23
TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data
used for key ID "TSIG" "HMAC-MD5" signature
5 / 23
TSIG variables
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data TSIG variables
5 / 23
TSIG signature
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data DNS message TSIG variables HMAC
MAC / signature
shared key
5 / 23
Cryptographically Generated Addresses
6 / 23
CGA
public key authentication binds public key to IPv6 address comes signed message from that address? anyone can claim address 7 / 23
CGA generation
start SHA-1 modifier
rand()
subnet prefix collision count public key
K
extension fields
E
modifier++
(112 bits)
hash2 finish
duplicate?
no
16*sec ~ 0
SHA-1 false sec {0-7} subnet prefix = P true collision count++ yes P
(64 bits)
hash1 "ID" ID "CGA" P ID 012 ... 67
subnet prefix sec
00
interface identifier
64 bits
8 / 23
9 / 23
CGA-TSIG
TSIG’s individual message authentication... ...but with public-key crypto scalable CGA to authenticate public key recursive name server accepts anonymous queries clients do not need CGA authenticated key/address changes initial address verification? DHCP configuration maybe spoofed 10 / 23
CGA-TSIG resource record
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
"RSA" 11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
"RSA" "CGA" 11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
"RSA" "CGA"
11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
"RSA" "CGA"
instead of MAC 11 / 23
CGA-TSIG resource record
"CGA-TSIG"
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
"RSA" "CGA"
instead of MAC 11 / 23
12 / 23
Proof of concept
ldns library from NLnet Labs written in C already supports TSIG extended to support CGA-TSIG CGA verification public key signature generation/verification CGA generation tool uses Scapy6 written in Python 13 / 23
14 / 23
Results
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
time signed is digested... ...but fudge is not replay attacks nor other fields in red blue fields in arbitrary order does not adhere to TSIG signature fields left out 15 / 23
Results
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
signature in new field MAC field left unused could save space if used 16 / 23
Results
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
unlike TSIG for last mile how to request CGA-TSIG? set algorithm name algorithm type too? time signed to 0 query is not signed 17 / 23
Results
Name Type Class TTL RdLen
RDATA
Algorithm Name Time Signed Fudge MAC Size MAC Original ID Error Other Len Other Data CGA-TSIG Len Algorithm Type Type IP Tag Parameters Len Modifier
Param.
Subnet Prefix Collision Count Public Key Extension Fields Signature Len Signature Old Public Key Len Old Public Key Old Signature Len Old Signature
no CGA type tag defined related protocol attacks what do do with name field? 1-octet length fields parameters length fields?
new CGA for server how will clients know?
18 / 23
19 / 23
Conclusion
CGA-TSIG draft needs improvements can use any public key size CGA bit-strength up to 2171
TSIG implementations easy to extend even though additions required clients still need to verify CGA somehow...
Is CGA-TSIG an adequate solution to the last mile problem?
20 / 23
CGA security
cost to find hash1 collision: O(259) sec increases bit-strength by factor 216×sec to find hash2 collision total cost: O(259+16×sec) sec cannot be spoofed 21 / 23
Demo
22 / 23
Q&A
23 / 23
Demo
Demo
Demo
Demo