Securing the last mile of DNS with CGA-TSIG Marc Buijsman Master - PowerPoint PPT Presentation

Securing the last mile of DNS with CGA-TSIG Marc Buijsman Master System & Network Engineering 19 December 2013

Problem statement � “last mile” not secured internet authoritative name server client recursive authoritative last mile (stub resolver) name server name server authoritative name server 1 / 23

Problem statement � do local resolution � requires local server � DNSSEC � requires root key � validating stub � DNSCurve � not widely deployed � needs server support � TSIG � DNS message authentication � shared key � not scalable 2 / 23

Problem statement � new proposal: CGA-TSIG � research question: Is CGA-TSIG an adequate solution to the last mile problem? � Does CGA-TSIG provide the necessary security? � Is the CGA-TSIG specification correct? specification verification model implementation 3 / 23

TSIG Transaction Signature 4 / 23

TSIG resource record Name Type Class TTL RdLen Algorithm Name Time Signed Fudge MAC Size RDATA MAC Original ID Error Other Len Other Data 5 / 23

TSIG resource record Name used for key ID Type Class TTL RdLen Algorithm Name Time Signed Fudge MAC Size RDATA MAC Original ID Error Other Len Other Data 5 / 23

TSIG resource record Name used for key ID Type "TSIG" Class TTL RdLen Algorithm Name Time Signed Fudge MAC Size RDATA MAC Original ID Error Other Len Other Data 5 / 23

TSIG resource record Name used for key ID Type "TSIG" Class TTL RdLen Algorithm Name "HMAC-MD5" Time Signed Fudge MAC Size RDATA MAC Original ID Error Other Len Other Data 5 / 23

TSIG resource record Name used for key ID Type "TSIG" Class TTL RdLen Algorithm Name "HMAC-MD5" Time Signed Fudge MAC Size RDATA MAC signature Original ID Error Other Len Other Data 5 / 23

TSIG variables Name Type Class TTL RdLen Algorithm Name TSIG variables Time Signed Fudge MAC Size RDATA MAC Original ID Error Other Len Other Data 5 / 23

TSIG signature Name Type Class TTL RdLen DNS message Algorithm Name TSIG variables Time Signed Fudge MAC Size RDATA MAC HMAC shared key Original ID Error Other Len MAC / signature Other Data 5 / 23

CGA Cryptographically Generated Addresses 6 / 23

CGA � public key authentication � binds public key to IPv6 address � comes signed message from that address? � anyone can claim address 7 / 23

modifier rand() CGA generation subnet prefix 0 collision count 0 public key K extension fields E start SHA-1 (112 bits) SHA-1 (64 bits) hash2 hash1 modifier++ 16*sec ~ 0 subnet prefix = P false true sec {0-7} "ID" ID collision count++ "CGA" P yes finish duplicate? P ID no 012 ... 67 subnet prefix sec interface identifier 00 � �� �� �� � 64 bits 64 bits 8 / 23

CGA-TSIG 9 / 23

CGA-TSIG � TSIG’s individual message authentication... � ...but with public-key crypto � scalable � CGA to authenticate public key � recursive name server accepts anonymous queries � clients do not need CGA � authenticated key/address changes � initial address verification? � DHCP configuration maybe spoofed 10 / 23

CGA-TSIG resource record CGA-TSIG Len Name Algorithm Type Type Type Class IP Tag TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len Name Algorithm Type Type Type Class IP Tag TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len "RSA" Name Algorithm Type Type Type Class IP Tag TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len "RSA" Name Algorithm Type Type Type "CGA" Class IP Tag TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len "RSA" Name Algorithm Type Type Type "CGA" Class IP Tag old IP TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len "RSA" Name Algorithm Type Type Type "CGA" Class IP Tag old IP TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature instead of MAC Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

CGA-TSIG resource record CGA-TSIG Len "RSA" Name Algorithm Type Type Type "CGA" Class IP Tag old IP TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix "CGA-TSIG" Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature instead of MAC Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 11 / 23

Proof of concept 12 / 23

Proof of concept � ldns library from NLnet Labs � written in C � already supports TSIG � extended to support CGA-TSIG � CGA verification � public key signature generation/verification � CGA generation tool � uses Scapy6 � written in Python 13 / 23

Results 14 / 23

Results � time signed is digested... � ...but fudge is not CGA-TSIG Len Name Algorithm Type � replay attacks Type Type Class IP Tag � nor other fields in red TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix � blue fields in arbitrary order Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields � does not adhere to TSIG MAC Signature Len RDATA Original ID Signature Error Old Public Key Len � signature fields left out Other Len Old Public Key Other Data Old Signature Len Old Signature 15 / 23

Results � signature in new field � MAC field left unused CGA-TSIG Len Name Algorithm Type Type Type � could save space if used Class IP Tag TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 16 / 23

Results � one-sided authentication � unlike TSIG � for last mile CGA-TSIG Len Name Algorithm Type Type Type � how to request CGA-TSIG? Class IP Tag � set algorithm name TTL Parameters Len RdLen Modifier � algorithm type too? Algorithm Name Subnet Prefix Time Signed Collision Count Param. � time signed to 0 Fudge Public Key MAC Size Extension Fields � query is not signed MAC Signature Len RDATA Original ID Signature Error Old Public Key Len Other Len Old Public Key Other Data Old Signature Len Old Signature 17 / 23

Results � no CGA type tag defined � related protocol attacks CGA-TSIG Len Name Algorithm Type � what do do with name field? Type Type Class IP Tag � 1-octet length fields TTL Parameters Len RdLen Modifier Algorithm Name Subnet Prefix � parameters length fields? Time Signed Collision Count Param. Fudge Public Key MAC Size Extension Fields � other time signed check MAC Signature Len RDATA Original ID Signature � new CGA for server Error Old Public Key Len Other Len Old Public Key � how will clients know? Other Data Old Signature Len Old Signature � old public key format not specified 18 / 23

Conclusion 19 / 23

Conclusion � CGA-TSIG draft needs improvements � can use any public key size � CGA bit-strength up to 2 171 � only useful in IPv6 � TSIG implementations easy to extend � even though additions required � clients still need to verify CGA somehow... Is CGA-TSIG an adequate solution to the last mile problem? 20 / 23