Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
DNSSEC and DANE ION Tokyo November 17, 2014 Dan York Senior Content Strategist Internet Society york@isoc.org
Overview of DNS Security Extensions (DNSSEC)
A Normal DNS Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr examp...
Attacking DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 2 5 6 DNS Svr example.com DNS...
A Poisoned Cache Web Server Web Browser https://example.com/ web page DNS Resolver 1 2 3 4 192.168.2.2 Resolver cache now ...
A DNSSEC Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS...
Attempting to Spoof DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 ...
DNSSEC Is Not Just For The Web DNSSEC protects ALL information coming from DNS Significant deployments of DNSSEC (and DANE...
Email Hijacking – A Current Threat • CERT-CC researchers have identified that someone is hijacking email by using DNS cach...
The Two Parts of DNSSEC 11/17/2014
The Two Parts of DNSSEC Signing Validating ISPs Enterprises Applications DNS Hosting Registrars Registries
DNSSEC Signing - The Individual Steps Registry Registrar DNS Hosting Provider Domain Name Registrant • Signs TLD • Accepts...
DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrar also provides D...
DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrant hosts own DNS
DNSSEC Deployment Metrics 11/17/2014
DNSSEC Deployment Maps • DNSSEC deployment maps: • http://www.internetsociety.org/deploy360/dnssec/maps/ • Mailing list to...
DNSSEC Deployment Maps
Signed TLDs (both ccTLDs and gTLDs) https://rick.eng.br/dnssecstat/
DNSSEC Validation – Worldwide Trend http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0
DNSSEC Deployment – Second-level domains Links from http://www.internetsociety.org/deploy360/dnssec/statistics/
A Quick Overview of DANE 11/17/2014
The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver exam...
The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver 10.1...
Problems? Web Server Web Browser https://www.example.com/ TLS-encrypted web page with CORRECT certificate DNS Server www.e...
DANE Web Server Web Browser w/DANE https://example.com/ TLS-encrypted web page with CORRECT certificate DNS Server 10.1.1....
DNS-Based Authentication of Named Entities (DANE) • Q: How do you know if the TLS (SSL) certificate is the correct one the...
DANE – Different operation modes ("certificate usage" field) • 0 – CA specification • The TLSA record specifies the Certif...
DANE – Not Just For The Web •DANE defines protocol for storing TLS certificates in DNS •Securing Web transactions is an ob...
DANE Success Stories SMTP  360+ SMTP servers with TLSA records  http://www.tlsa.info/ XMPP (Jabber)  229 servers  clie...
Why Deploy DNSSEC and DANE? 11/17/2014
Business Reasons For Deploying DNSSEC • TRUST – You can be sure your customers are reaching your sites – and that you are ...
Resources 11/17/2014
DANE Resources DANE Overview and Resources: • http://www.internetsociety.org/deploy360/resources/dane/ IETF Journal articl...
DANE Resources DANE and email: • https://tools.ietf.org/html/draft-ietf-dane-smtp-with-dane • http://tools.ietf.org/html/d...
Start Here Page http://www.internetsociety.org/deploy360/start/ Easy method of finding resources for specific audiences, i...
https://twitter.com/deploy360 https://www.facebook.com/Deploy360 http://gplus.to/deploy360 http://www.youtube.com/user/Dep...
Thank You! Dan York Senior Content Strategist york@isoc.org
Upcoming SlideShare
Loading in …5
×

ION Tokyo: The Business Case for DNSSEC and DANE, Dan York

1,667 views

Published on

ION Tokyo slides for "The Business Case for Implementing DNSSEC" by Dan York (Internet Society).

DNSSEC helps prevent attackers from subverting and modifying DNS messages and sending users to wrong (and potentially malicious) sites. So what needs to be done for DNSSEC to be deployed on a large scale? We’ll discuss the business reasons for, and financial implications of, deploying DNSSEC, from staying ahead of the technological curve, to staying ahead of your competition, to keeping your customers satisfied and secure on the Internet. We’ll also examine some of the challenges operators have faced and the opportunities to address those challenges and move deployment forward.

Published in: Technology
no profile picture user

  • Be the first to comment

ION Tokyo: The Business Case for DNSSEC and DANE, Dan York

  1. 1. DNSSEC and DANE ION Tokyo November 17, 2014 Dan York Senior Content Strategist Internet Society york@isoc.org
  2. 2. Overview of DNS Security Extensions (DNSSEC)
  3. 3. A Normal DNS Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4 example.com NS .com NS example.com?
  4. 4. Attacking DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 2 5 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 192.168.2.2 4 Attacking DNS Svr example.co m 192.168.2.2 example.com NS .com NS example.com? False Site example.co m
  5. 5. A Poisoned Cache Web Server Web Browser https://example.com/ web page DNS Resolver 1 2 3 4 192.168.2.2 Resolver cache now has wrong data: example.com 192.168.2.2 This stays in the cache until the Time-To-Live (TTL) expires! example.com? False Site example.co m
  6. 6. A DNSSEC Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4 example.com NS DS .com NS DS example.com?
  7. 7. Attempting to Spoof DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 SERVFAIL 4 Attacking DNS Svr example.co m 192.168.2.2 DNSKEY RRSIGs example.com NS DS .com NS DS example.com?
  8. 8. DNSSEC Is Not Just For The Web DNSSEC protects ALL information coming from DNS Significant deployments of DNSSEC (and DANE) in: • Email (SMTP) • Instant messaging (XMPP/Jabber) Other potential uses: • Voice over IP (VoIP) • Any application that communicates over the Internet
  9. 9. Email Hijacking – A Current Threat • CERT-CC researchers have identified that someone is hijacking email by using DNS cache poisoning of MX records • Could be prevented by DNSSEC deployment • CERT-CC (Sept 10, 2014): – https://www.cert.org/blogs/certcc/post.cfm?EntryID=206 • Deploy360 blog post (Sept 12, 2014): • http://wp.me/p4eijv-5jI
  10. 10. The Two Parts of DNSSEC 11/17/2014
  11. 11. The Two Parts of DNSSEC Signing Validating ISPs Enterprises Applications DNS Hosting Registrars Registries
  12. 12. DNSSEC Signing - The Individual Steps Registry Registrar DNS Hosting Provider Domain Name Registrant • Signs TLD • Accepts DS records • Publishes/signs records • Accepts DS records • Sends DS to registry • Provides UI for mgmt • Signs zones • Publishes all records • Provides UI for mgmt • Enables DNSSEC (unless automatic)
  13. 13. DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrar also provides DNS hosting services
  14. 14. DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrant hosts own DNS
  15. 15. DNSSEC Deployment Metrics 11/17/2014
  16. 16. DNSSEC Deployment Maps • DNSSEC deployment maps: • http://www.internetsociety.org/deploy360/dnssec/maps/ • Mailing list to receive weekly maps: • https://elists.isoc.org/mailman/listinfo/dnssec-maps
  17. 17. DNSSEC Deployment Maps
  18. 18. Signed TLDs (both ccTLDs and gTLDs) https://rick.eng.br/dnssecstat/
  19. 19. DNSSEC Validation – Worldwide Trend http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=1&w=7&g=0
  20. 20. DNSSEC Deployment – Second-level domains Links from http://www.internetsociety.org/deploy360/dnssec/statistics/
  21. 21. A Quick Overview of DANE 11/17/2014
  22. 22. The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver example.com? 10.1.1.1231 2 5 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 10.1.1.123 4
  23. 23. The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver 10.1.1.1231 2 5 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 10.1.1.123 4 Is this encrypted with the CORRECT certificate? example.com?
  24. 24. Problems? Web Server Web Browser https://www.example.com/ TLS-encrypted web page with CORRECT certificate DNS Server www.example.com? 1.2.3.4 1 2 Firewall https://www.example.com/ TLS-encrypted web page with NEW certificate (re-signed by firewall)
  25. 25. DANE Web Server Web Browser w/DANE https://example.com/ TLS-encrypted web page with CORRECT certificate DNS Server 10.1.1.123 DNSKEY RRSIGs TLSA 1 2 Firewall (or attacker) https://example.com/ TLS-encrypted web page with NEW certificate (re-signed by firewall) Log files or other servers DANE-equipped browser compares TLS certificate with what DNS / DNSSEC says it should be. example.com?
  26. 26. DNS-Based Authentication of Named Entities (DANE) • Q: How do you know if the TLS (SSL) certificate is the correct one the site wants you to use? • A: Store the certificate (or fingerprint) in DNS (new TLSA record) and sign them with DNSSEC. An application that understand DNSSEC and DANE will then know when the required certificate is NOT being used. Certificate stored in DNS is controlled by the domain name holder. It could be a certificate signed by a CA – or a self- signed certificate.
  27. 27. DANE – Different operation modes ("certificate usage" field) • 0 – CA specification • The TLSA record specifies the Certificate Authority (CA) who will provide TLS certificates for the domain. Must be a valid CA included in browser/app. • 1 – Specific TLS certificate • The TLSA record specifies the exact TLS certificate that should be used for the domain. Note that this TLS certificate must be one that is issued by a valid CA. • 2 – Trust anchor assertion • The TLSA record specifies the “trust anchor” to be used for validating the TLS certificates for the domain. Allows for the use of a CA not included in application. • 3 – Domain-issued certificate • The TLS record specifies the exact TLS certificate that should be used for the domain, BUT, in contrast to usage #1, the TLS certificate does not need to be signed by a valid CA. This allows for the use of self-signed certificates.
  28. 28. DANE – Not Just For The Web •DANE defines protocol for storing TLS certificates in DNS •Securing Web transactions is an obvious use case •Other uses also possible: • Email • VoIP • Jabber/XMPP • PGP • ?
  29. 29. DANE Success Stories SMTP  360+ SMTP servers with TLSA records  http://www.tlsa.info/ XMPP (Jabber)  229 servers  client-to-server & server-to-server  https://xmpp.net/reports.php#dnssecdane Advertisements!
  30. 30. Why Deploy DNSSEC and DANE? 11/17/2014
  31. 31. Business Reasons For Deploying DNSSEC • TRUST – You can be sure your customers are reaching your sites – and that you are communicating with their servers. • SECURITY – You can be sure you are communicating with the correct sites and not sharing business information with attackers, ex. email hijacking. • INNOVATION – Services such as DANE built on top of DNSSEC enable innovative uses of TLS certificates • CONFIDENTIALITY – DANE enables easier use of encryption for applications and services that communicate across the Internet
  32. 32. Resources 11/17/2014
  33. 33. DANE Resources DANE Overview and Resources: • http://www.internetsociety.org/deploy360/resources/dane/ IETF Journal article explaining DANE: • http://bit.ly/dane-dnssec RFC 6394 - DANE Use Cases: • http://tools.ietf.org/html/rfc6394 RFC 6698 – DANE Protocol: • http://tools.ietf.org/html/rfc6698
  34. 34. DANE Resources DANE and email: • https://tools.ietf.org/html/draft-ietf-dane-smtp-with-dane • http://tools.ietf.org/html/draft-ietf-dane-smime DANE Operational Guidance: • https://tools.ietf.org/html/draft-ietf-dane-ops DANE and SIP (VoIP): • http://tools.ietf.org/html/draft-johansson-dispatch-dane-sip • https://tools.ietf.org/html/draft-ietf-dane-srv Other uses: • https://tools.ietf.org/html/draft-ietf-dane-openpgpkey • https://tools.ietf.org/html/draft-ietf-dane-rawkeys
  35. 35. Start Here Page http://www.internetsociety.org/deploy360/start/ Easy method of finding resources for specific audiences, including: • Network operators • Content providers (ex. web site owners) • Developers • Governments • Consumer electronics vendors • Enterprises and campus networks • Registrars • Internet exchange points (IXPs)
  36. 36. https://twitter.com/deploy360 https://www.facebook.com/Deploy360 http://gplus.to/deploy360 http://www.youtube.com/user/Deploy360 http://www.internetsociety.org/deploy360/feed/ http://soundcloud.com/deploy360/ Social Media Channels
  37. 37. Thank You! Dan York Senior Content Strategist york@isoc.org

×