Embed Size (px)
Citation preview
DNS Root Zone DNSSEC Operations - KSK Ed Lewis| FIRST-TC Auckland, NZ | February 21, 2016 [email protected]
MyMo%va%on
• ICANNistaskedwithchangingacrucialconfigura%onparameterofDNSsecurity– Weneedtodevelopaplan(workingonit)– Wedon'thaveafixeddateforthechange
• Inprepara%onforthetask– Weareengagingwithvariousgroupswhomightbeimpactedbytheworkand/ormighthelpusimproveuponourplanningwork
2
Agenda
• BackgroundonDomainNameSystem(DNS)andDNSSecurityExtensions(DNSSEC)
• InternetCorpora%onforAssignedNamesandNumbers(ICANN)roleinDNSSEC
• TheprocessofDNSSECValida%on• ManagingTrustAnchors-ImpactofaKeyRoll
3
ForEngineersWhoDon'tLikeProtocols
4
WhatistheIPv4addressforwww.nic.tld.?
TheIPv4addressforwww.nic.tld.isW.X.Y.Z
Informa%onSource
Informa%onSource
Informa%onSource
Informa%onSource
IntermediaryIntermediaryIntermediary
WhyisthereDNSSEC?
• DNSisnot"client-server"– Noend-to-endsessiontoprotect
5
RelyingClient Intermediary Informa%on
Source
• SeeksandAggregatesInforma%on
• HighlyGullible
DNSSECDesignApproach
• DigitalSignatures– Acryptographicallyencryptedchecksumissentalongsidethedata
– Asystemofpublickeysisusedtoverify
6
DNSSECforThoseWhoDon'tLikeProtocols
WhatistheIPv4addressforwww.nic.tld.?
TheIPv4addressforwww.nic.tld.isW.X.Y.Z
Digitalsignaturebynic.tldcoveringanswer
7
Crypto-checkingaSignature
TheIPv4addressforwww.nic.tld.isW.X.Y.Z
Digitalsignaturebynic.tldcoveringanswer
nic.tldKEYZSK
?✔
✖OR
8
HowthisWorks(DNS)
TheRoot
TLDOtherTLDs
NIC.TLDOthers.TLD
9
TopLevelDomain
HowthisWorks(Scaling)
TheRoot
TLDOtherTLDs
NIC.TLDOthers.TLD
10
KeySet
KeySet
KeySet
HowthisWorks(DNSSEC)
TheRoot
TLDOtherTLDs
NIC.TLDOthers.TLD
nic.tldKEYZSKnic.tldKEYKSK
nic.tldDStldKEYZSKtldKEYKSK
tldDSrootKEYZSKrootKEYKSK
11
RolesofDNSSECKeys
• KSK–key-signingkey,signsinternallymanagedkeys– Internalreferstowhatanadministratormanages
• ZSK–zone-signingkey,signsotherinternallymanageddata
• DS–hashofexternalKSK"onelayerdown"– Externalreferstowhomtheadministratordelegatesauthority
12
ChainofTrustinOpera%ons
• TheInternet'sDNSsystemhasaDNSSECsignedRootZone– Since2010– TheKSKsignstheZSK,ZSKsignsDSforTLDs– KSKandZSKoperatorsareseparateorganiza%ons
• Trustisamagerfortheconsumers,notproducers,todefine– GoalistoreducereliancetojustoneKSK(set)– Iftheconsumerwantsto"trustjustone"
13
RootZoneKSKandZSKOperators
• ICANNperformsthemanagementoftheRootZoneKSKaspartoffulfillingtheIANAFunc%onsContract– ThatcontractismanagedbytheUSDepartmentofCommerce'sNa%onalTelecommunica%onsandInforma%onAdministra%on(NTIA)
• VerisignperformsthemanagementoftheRootZoneZSKaspartoftheirroleastheRootZoneMaintainer
14
ICANN'srole,inbrief
• ICANNmanagestheKSKlifecycle– CreatetheKSK(hashappenedonce)– SignwiththeKSK(quarterly)– ProtecttheKSK(constantly)– DisposeoftheKSK(hasn'thappenedyet)– andPublicizetheKSK(constantly)
• Objec%ve:operateinamannertoenabletrust– SOC3/SysTrust,auditedbythird-party– (US)FIPS140-2level4cryptographicdevices(HSM)
15
ReturningFocustoDNSSEC
• WithinDNSSECthereis– SigningtheData
• Addingdigitalsignatures• Cryptographickeylife%memanagement• Thisisnotthesubjectofthistalk
– Valida%ngtheData• Protec%ngtheconsumeroftheanswer• Assemblingthechainoftrust• Managing"whoistrusted"
16
WhatisValida%on?
• Whenaresponseisreceived– Checkthedigitalsignature,cryptographicandotherwise(%me,authority,andsoon)
– Checkallsignatures"upthechain"– Onceananswerisvalidated,itcanbecached,used,forwarded
• Whatisneeded– Atrustanchorisneeded,a"pinned"KSK
17
Informa%onSource
Informa%onSource
Informa%onSource
Informa%onSource
IntermediaryIntermediaryIntermediary
WhereisValida%onDone?
• DNSisnot"client-server"– Noend-to-endsessiontoprotect
18
RelyingClient
Inter-mediary
Informa%onSource
• SeeksandAggregatesInforma%on
• Validates
Validator
• MightValidate
Validator
Whyandwhodoes?
• Whyvalidate?– Lessensthegullibilityoftheintermediaryelements
– Providesatrustablebaseforopera%ons• Whynot?
– Valida%onimposessomecostonopera%ng– Valida%oncouldraisefalsealarms
• Haveoperatorsturnedonvalida%on?– Somehave,a"significantminority"
19
TrustAnchorManagement
• Func%onofthevalida%onengine– Keysthatare"pinned"– RootZoneKSKoughttobeoneofthem– TheremaybeotherKSKsets
• Theremayalsobe"nega%vetrustanchors"– ExperiencesayssomeDNSoperatorsbotchKSKmanagement
20
GelngtheRootZoneKSK
• ThereareafewwaystogetacopyoftheRootZoneKSK– ViaDNS– ViaWeb– ViaDistributedCode– Viaanythingelse–T-shirts,talks,askingsomeone
21
GelngtheRootZoneKSKfromDNS
• '[email protected]'andpulloutthekeywithflags=257
• Asanonlymethod,thisisn'tverysecure– Convenientbutnotsecure
22
AutomatedUpdatesviaDNS
• "AutomatedSecureUpdatesofDNSSECTrustAnchors"(RFC5011)– Describesaseriesofopera%onalstepstohaveonetrustanchorsafelyintroducethenext
– Lacksneededmanagementhooks
• Butifconfigura%onsarepushedbyaconfigura%onmanagementtool,thisapproachwon'twork
23
GelngtheRootZoneKSKfromWeb
• Fromhgps://www.iana.org/dnssec– hgps://data.iana.org/root-anchors/root-anchors.xml– OpenPGPsignatureandPKCS7signature
• Validateviaappropriatepublickeysonthatsite• Inplacesince2010
– Examiningwaystoimprovewhat'sthere(whilemaintainingbackwardscompa%bility)
24
FutureConsidera%ons
• Anopenworkitem–– What'sthebestwaytopublicizeakeytoawideaudience?
• Wearerevisi%ngourapproachtopublica%ontoenabletrusttobebuiltonthekey
25
RootZoneKSKinToolDistribu%ons
• Sopwaremaycomewithacopyofthekeyembedded– Configura%onfile
• ICANNisworkingwithsopwaredevelopersanddistributorstomakesurethisisreliable
• S%ll,cau%onthatembeddedkeysmaybe"stale"oncekeysarerolled
26
Formoreinforma%on
• Jointhemailinglist– hgps://mm.icann.org/mailman/lis%nfo/root-dnssec-announce
• FollowonTwiger– Hashtag:#KeyRollover– Follow@ICANNtechforthemostuptodatenews
27
