NSEC5: Provably Preventing DNSSEC Zone Enumeration DNS OARC Fall 2014 Workshop, Los Angeles, October 12, 2014 Sharon Goldberg Dimitrios Papadopoulos Leonid Reyzin Sachin Vasant Moni Naor Asaf Ziv Say --- we have been looking at existing things, lets look at new things

outline How does DNSSEC deal with denial of existence? RFC 4470: Online Signing RFC 4034: NSEC RFC 5155: NSEC3 Zone enumeration in NSEC and NSEC3 attacker makes a few online queries & enumerates all names in the zone via offline dictionary attacks Demo’d by [nsec3walker; 2011],[Wander-Schwittmann-Boelmann- Weis;2014] We introduce NSEC5 NSEC5 is just like NSEC3, replacing the hash with a RSA-based “keyed hash” NSEC5 provably prevents zone enumeration. NSEC5 maintains zone integrity, even if the hash key is leaked. We hope to turn NSEC5 into an Internet Draft & want feedback!

how to deal with authenticated denial of existence? Zone File: a.com c.com z.com DNSKEY: q.com? NXDOMAIN NXDOMAIN Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes.

generic pre-signed NXDOMAIN violates integrity. Integrity: No denial-of-existence for name that exists. a.com c.com z.com DNSKEY: a.com? NXDOMAIN Violate integrity by replaying NXDOMAIN! Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. Integrity? DNS X Generic Signed NXDOMAIN Online Signing ✔ NSEC NSEC3 NSEC5

online signing for denial of existence (RFC 4470) Zone File: a.com c.com z.com DNSKEY: q.com? q.com NXDOMAIN Secret ZSK: Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. Integrity? Tolerates bad nameserver? DNS X Sign Online ✔ NSEC NSEC3 NSEC5 Trusting every 2ary nameserver with the secret ZSK can be problematic.

NSEC (RFC 4034): precomputed denial of existence Zone File: a.com c.com z.com DNSKEY: q.com? c.com z.com NSEC a.com c.com NSEC It is an attestition that there is nothing between a.com and z.com c.com z.com NSEC z.com a.com NSEC

why NSEC maintains integrity Integrity: No denial-of-existence for name that exists. a.com c.com z.com DNSKEY: a.com? No valid NSEC record to replay. ! a.com c.com NSEC Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. c.com z.com NSEC Integrity? Tolerates bad nameserver? DNS X Sign Online ✔ NSEC NSEC3 NSEC5 z.com a.com NSEC

NSEC introduces a new issue: zone enumeration (1) Zone with n names: ~n online queries enumerate all names. a.com c.com z.com DNSKEY: Names: a.com c.com b.com? a.com c.com NSEC a.com c.com NSEC c.com z.com NSEC Integrity? Tolerates bad nameserver? DNS X Sign Online ✔ NSEC NSEC3 NSEC5 z.com a.com NSEC

NSEC introduces a new issue: zone enumeration (2) Zone with n names: ~n online queries enumerate all names. a.com c.com z.com DNSKEY: Names: a.com c.com z.com d.com? c.com z.com NSEC a.com c.com NSEC (Thus, its hard for the nameserver to detect & rate limit!) make this point c.com z.com NSEC Integrity? Tolerates bad nameserver? No zone enumeration? DNS X ✔ Sign Online NSEC NSEC3 ?????? NSEC5 z.com a.com NSEC Integrity? Tolerates bad nameserver? DNS X Sign Online ✔ NSEC NSEC3 NSEC5

arguments for why zone enumeration can be issue An enumerated zone can expose private device names; toehold for other attacks is a “source of probable e-mail addresses for spam” [RFC 5155], thus compromising a registrar’s “attitude towards consumer protection” [Nominet (.uk)] can be a “key for WHOIS queries” to “reveal registrant data that many registries may have legal obligations to protect” [RFC 5155] e.g., “Germany’s Federal Data Protection Act “[DENIC] e.g., “Data protection Laws” in the UK [Nominet (.uk)] is in conflict with “the registry’s legal rights. The TLD register database is a key business asset”, “its compilation is protected in law under Database Rights in the UK and copyright in other countries.” [Nominet (.uk)] Why is this an issue? Its enough of an isue to have lead to the design & adoption of nsec3, lets run through some of the reasons that people have given NSEC3 (RFC 5155) introduced to limit zone enumeration

trusted authority for zone precomputes NSEC3 records a.com c.com z.com H(a.com) = a1bb5 H(c.com) = 23ced H(z.com) = dde45 Hash names sort 23ced.com a1bb5.com NSEC3 23ce d a1bb 5 dde4 5 Sign NSEC3 records with secret ZSK a1bb5.com dde45.com NSEC3 dde45.com 23ced.com NSEC3

Tolerates bad nameserver? NSEC3 in action H(q.com) = c987b a.com c.com z.com DNSKEY: q.com? a1bb5.com dde45.com NSEC3 23ced.com a1bb5.com NSEC3 Integrity? Tolerates bad nameserver? DNS X Sign Online ✔ NSEC NSEC3 NSEC5 Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. a1bb5.com dde45.com NSEC3 dde45.com 23ced.com NSEC3

but does NSEC3 really prevent zone enumeration? H(r.com) = 33c46 a.com c.com z.com DNSKEY: Learned: a1bb5.com dde45.com 23ced.com r.com? 23ced.com a1bb5.com NSEC3 23ced.com a1bb5.com NSEC3 Integrity? Tolerates bad nameserver? No zone enumeration? DNS X ✔ Sign Online NSEC NSEC3 ?????? NSEC5 Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. a1bb5.com dde45.com NSEC3 dde45.com 23ced.com NSEC3

zone enumeration is still possible with NSEC3! Zone with n names: ~n online queries enumerate all names. Crack them using an offline dictionary attack! Hashes learned: a1bb5.com dde45.com 23ced.com Names learned: a.com z.com c.com Offline dictionary attack 2) Hash each name NSEC3 zone enumeration has been demonstrated: [Wander, Schwittmann, Boelmann, Weis 2014] reversed 64% of NSEC3 hashes in the .com TLD over 4.5 days using a GPU. In 2011, nsec3walker guessed 234 hashes/per day on a laptop. 1) Make dictionary of plausible names a.com b.com c.com …. z.com H(a.com) = a1bb5 H(b.com) = 33333 H(c.com) = 23ced …. H(z.com) = dde45 Oversimplified! There’s one salt per zone, many hash iterations, …

why is zone enumeration possible with NSEC3? The fundamental issue : Dictionary attacks possible b/c resolvers can compute hashes offline. q.com? H(q.com) = c987b a1bb5.com dde45.com NSEC3 Offline dictionary attack to crack hashes a1bb5 , dde45 Find a matching NSEC3 record

Why NSEC5 prevents zone enumeration: introducing NSEC5 Why NSEC5 prevents zone enumeration: No more dictionary attacks b/c resolvers can’t compute hashes! Secret Non- Signing Key (NSK): q.com? H (q.com) = 7a89b 3cd91.com 8cb67.com NSEC5 Offline dictionary attack to crack hashes 3cd91 , 8cb67 X Find a matching NSEC5 record Can’t compute hashes without secret NSK!

trusted authority for zone precomputes NSEC5 records a.com c.com z.com H(RSASIG (a.com))=9ae3e H(RSASIG (c.com))=8cb67 H(RSASIG (z.com))=3cd91 “Hash” with secret NSK sort 3cd91.com 8cb67.com NSEC5 3cd9 1 8cb6 7 9ae3 e Sign NSEC5s with secret ZSK 8cb67.com 9ae3e.com NSEC5 9ae3e.com 3cd91.com NSEC5 * This is deterministic RSA (aka“Full Domain Hash”)

NSEC5 in action H(aa867a)=7a89b RSASIG (q.com)=aa867a a.com c.com PROOF aa867a RSASIG (q.com)=aa867a H(aa867a)=7a89b a.com c.com z.com q.com? 3cd91.com 8cb67.com NSEC5 PROOF aa867a Secret NSK: Public NSK: 3cd91.com 8cb67.com NSEC5 How to verify? Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. 8cb67.com 9ae3e.com NSEC5 Do NSEC5, PROOF match: 3cd19 < H(aa867a) < 8cb67 9ae3e.com 3cd91.com NSEC5 Do query, PROOF match: RSAVER (q.com, aa867a)

why does NSEC5 prevent zone enumeration? a.com c.com z.com q.com? 3cd91.com 8cb67.com NSEC5 PROOF aa867a Secret NSK: Public NSK: Offline dictionary attack to crack hashes 3cd91 , 8cb67? X Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. H(RSASIG (c.com))= 8cb67 Can’t compute hashes without secret NSK!

why does NSEC5 prevent zone enumeration? a.com c.com z.com q.com? 3cd91.com 8cb67.com NSEC5 PROOF aa867a Secret NSK: Public NSK: Offline dictionary attack to crack hashes 3cd91 , 8cb67? using RSAVER? Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. RSAVER just verifies PROOFs, not hashes! X H(RSASIG (c.com))= 8cb67 RSAVER (q.com, aa867a)

why does NSEC5 maintain integrity? Integrity: No denial-of-existence for name that exists. a.com c.com z.com a.com? 3cd91.com 8cb67.com NSEC5 PROOF 666666 Secret NSK: Public NSK: 3cd91.com 8cb67.com NSEC5 Repla y Using the word hops, explains that each hop adds and announces to the next Explain what is traffic Explain IP prefixes. Can’t compute PROOF (ie. RSASIG (a.com) ) 8cb67.com 9ae3e.com NSEC5 Resolver rejects b/c RSAVER (a.com,666666) = FALSE 9ae3e.com 3cd91.com NSEC5

X ✔ ????? summary No zone enumeration? Tolerates bad nameserver? Integrity? Tolerates bad nameserver? No zone enumeration? DNS X ✔ Sign Online NSEC NSEC3 NSEC5 ????? but what about managing the extra secret key? Secret NSK:

NSEC5 maintains integrity even if secret NSK is leaked! Integrity: No denial-of-existence for name that exists. a.com c.com z.com a.com? PROOF 556e3e Secret NSK: Public NSK: 3cd91.com 8cb67.com NSEC5 Compute PROOF RSASIG (a.com)= 556e3e 8cb67.com 9ae3e.com NSEC5 H(556e3e)=9ae3e There is no valid NSEC5 to replay! ! 9ae3e.com 3cd91.com NSEC5

Tolerates bad nameserver? summary Integrity? Tolerates bad nameserver? No zone enumeration? DNS X ✔ Sign Online NSEC NSEC3 NSEC5 NSEC5; lost secret NSK See our paper for the crypto proofs! http://eprint.iacr.org/2014/582.pdf Just like NSEC3!

Extra computational overhead in NSEC5 (vs NSEC3) Nameserver does 1 online RSA signature/query (to get PROOF) But online signing is necessary to prevent zone enumeration! Explains why hash-based schemes are vulnerable to zone enumeration. 3cd91.com 8cb67.com NSEC5 PROOF 6aeb3a Theorem [Informal]: ANY denial of existence scheme that prevents zone enumeration, and provides integrity (even against malicious slave nameservers) requires nameservers to compute a public-key signature for every negative response.

NSEC5 vs NSEC3: Key management & response size NSEC5 public non-signing key (NSK) distributed in a DNSKEY RR. Secret NSK at each nameserver; but this is not a “high security” key. Response size: NSEC5 & NSEC3 records are the same size. ~2048 bits (signature) + 2 x 256 bits (hashes) Plus PROOF sent with each NSEC5 (~2048 bits) But, using wildcard optimization, an NSEC5 response is only ~2048 bit longer than today’s unoptimized NSEC3 standard Secret NSK: Public NSK: 3cd91.com 8cb67.com NSEC5 PROOF 6aeb3a a1bb5.com dde45.com NSEC3 http://eprint.iacr.org/2013/254.pdf on .gov domain, 60% of

More details in our paper Tolerates bad nameserver? http://eprint.iacr.org/2014/582.pdf Integrity? Tolerates bad nameserver? No zone enumeration? DNS X ✔ Sign Online NSEC NSEC3 NSEC5 NSEC5, leaked NSK 3cd91.com 8cb67.com NSEC5 Public NSK: PROOF 6aeb3a