DNSSEC and DANE Deployment: Trends, Tools and Challenges
1 like2,178 views
The document discusses the deployment trends, tools, and challenges related to DNSSEC (Domain Name System Security Extensions) and DANE (DNS-based Authentication of Named Entities). It emphasizes the need for better awareness and support for these protocols to enhance security on the Internet and highlights the importance of engagement from registrars, DNS hosting providers, organizations, and consumers. It also provides resources for understanding and implementing these technologies effectively.
DNSSEC and DANE Deployment: Trends, Tools and Challenges
- 1. www.internetsociety.org/deploy360/ DNSSEC and DANE Deployment Trends, Tools And Challenges Dan York, Senior Content Strategist Internet Society ENOG 6, Kiev, Ukraine October 2, 2013
- 2. www.internetsociety.org/deploy360/ About Deploy360 The Challenge: – The IETF creates protocols based on open standards, but some are not widely known or deployed – People seeking to implement these protocols are confused by a lack of clear, concise deployment information The Deploy360 Solution: – Provide hands-on information on IPv6, DNSSEC and routing resiliency/security to advance real-world deployment – Work with first adopters to collect and create technical resources and distribute these resources to fast following networks
- 3. www.internetsociety.org/deploy360/ Web Portal (Online Knowledge Repository) • Technical documents • Audience-specific information • Blogs & social media Social Media (Constant Audience Engagement) • Twitter • Facebook • Google+ • YouTube • RSS Feeds Speaking Engagements (Come Meet Us or Invite Us to Speak) • Consumer Electronics Show • IPv6 Summits • Interop • Network Operators’ Groups ION Conferences (Hands-on Educational Events) • Slovenia • India • USA • Canada • Argentina Deploy360 Components
- 4. www.internetsociety.org A Quick Overview of DNSSEC 10/1/13
- 5. www.internetsociety.org/deploy360/ A Normal DNS Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4 example.com NS .com NS example.com?
- 6. www.internetsociety.org/deploy360/ Attacking DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 192.168.2.2 4 Attacking DNS Svr example.com 192.168.2.2 example.com NS .com NS example.com?
- 7. www.internetsociety.org/deploy360/ A Poisoned Cache Web Server Web Browser https://example.com/ web page DNS Resolver1 2 3 4 192.168.2.2 Resolver cache now has wrong data: example.com 192.168.2.2 This stays in the cache until the Time-To-Live (TTL) expires! example.com?
- 8. www.internetsociety.org/deploy360/ A DNSSEC Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4 example.com NS DS .com NS DS example.com?
- 9. www.internetsociety.org/deploy360/ Attempting to Spoof DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 SERVFAIL 4 Attacking DNS Svr example.com 192.168.2.2 DNSKEY RRSIGs example.com NS DS .com NS DS example.com?
- 10. www.internetsociety.org/deploy360/ The Two Parts of DNSSEC Signing Validating ISPs Enterprises Applications DNS Hosting Registrars Registries
- 11. www.internetsociety.org/deploy360/ DNSSEC Signing - The Individual Steps Registry Registrar DNS Hosting Provider Domain Name Registrant • Signs TLD • Accepts DS records • Publishes/signs records • Accepts DS records • Sends DS to registry • Provides UI for mgmt • Signs zones • Publishes all records • Provides UI for mgmt • Enables DNSSEC (unless automatic)
- 12. www.internetsociety.org/deploy360/ DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrar also provides DNS hosting services
- 13. www.internetsociety.org/deploy360/ DNSSEC Signing - The Players Registries Registrars DNS Hosting Providers Domain Name Registrants Registrant hosts own DNS
- 14. www.internetsociety.org A Quick Overview of DANE 10/1/13
- 15. www.internetsociety.org/deploy360/ The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver example.com? 10.1.1.1231 2 5 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4
- 16. www.internetsociety.org/deploy360/ The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver 10.1.1.1231 2 5 6 DNS Svr example.com DNS Svr .com DNS Svr root 3 10.1.1.123 4 Is this encrypted with the CORRECT certificate? example.com?
- 17. www.internetsociety.org/deploy360/ Problems? Web Server Web Browser https://www.example.com/ TLS-encrypted web page with CORRECT certificate DNS Server www.example.com? 1.2.3.4 1 2 Firewall https://www.example.com/ TLS-encrypted web page with NEW certificate (re-signed by firewall)
- 18. www.internetsociety.org/deploy360/ DANE Web Server Web Browser w/DANE https://example.com/ TLS-encrypted web page with CORRECT certificate DNS Server 10.1.1.123 DNSKEY RRSIGs TLSA 1 2 Firewall (or attacker) https://example.com/ TLS-encrypted web page with NEW certificate (re-signed by firewall)Log files or other servers DANE-equipped browser compares TLS certificate with what DNS / DNSSEC says it should be. example.com?
- 19. www.internetsociety.org/deploy360/ DNS-Based Authentication of Named Entities (DANE) • Q: How do you know if the TLS (SSL) certificate is the correct one the site wants you to use? • A: Store the certificate (or fingerprint) in DNS (new TLSA record) and sign them with DNSSEC. A browser that understand DNSSEC and DANE will then know when the required certificate is NOT being used. Certificate stored in DNS is controlled by the domain name holder. It could be a certificate signed by a CA – or a self- signed certificate.
- 20. www.internetsociety.org/deploy360/ DANE – Not Just For The Web • DANE defines protocol for storing TLS certificates in DNS • Securing Web transactions is the obvious use case • Other uses also possible: • Email via S/MIME • VoIP • Jabber/XMPP • PGP • ? 10/1/13
- 21. www.internetsociety.org/deploy360/ DANE Resources DANE and email: • http://tools.ietf.org/html/draft-ietf-dane-smtp • http://tools.ietf.org/html/draft-ietf-dane-smime DANE Operational Guidance: • http://tools.ietf.org/id/draft-dukhovni-dane-ops-01.txt DANE and SIP (VoIP): • http://tools.ietf.org/id/draft-johansson-dane-sip-00.txt Other uses: • http://tools.ietf.org/id/draft-wouters-dane-openpgp-00.txt • http://tools.ietf.org/id/draft-wouters-dane-otrfp-00.txt
- 22. www.internetsociety.org DNSSEC Deployment Trends - Signing 10/1/13
- 23. www.internetsociety.org/deploy360/ DNSSEC Deployment – Top-Level Domains Source: http://www.internetsociety.org/deploy360/dnssec/maps/
- 24. www.internetsociety.org/deploy360/ DNSSEC Deployment – Top-Level Domains Source: http://www.internetsociety.org/deploy360/dnssec/maps/
- 25. www.internetsociety.org/deploy360/ DNSSEC Deployment – Second-Level Domains Source: https://xs.powerdns.com/dnssec-nl-graph/
- 26. www.internetsociety.org/deploy360/ DNSSEC Deployment – .COM Source: http://scoreboard.verisignlabs.com/count-trace.png
- 27. www.internetsociety.org/deploy360/ DNSSEC Deployment – .GOV Source: http://fedv6-deployment.antd.nist.gov/snap-all.html
- 28. www.internetsociety.org/deploy360/ DNSSEC Deployment – Fortune 1000 and U.S. Alexa Top 100 Sites Source: http://fedv6-deployment.antd.nist.gov/snap-all.html
- 29. www.internetsociety.org/deploy360/ DNSSEC Deployment – New Statistics Site Source: http://www.statdns.com/
- 30. www.internetsociety.org DNSSEC Deployment Trends - Validation 10/1/13
- 31. www.internetsociety.org/deploy360/ Availability of DNSSEC-Validating Resolvers Consumers need easy availability of DNSSEC-validating DNS resolvers. Examples: • Google's Public DNS now performing DNSSEC validation by default • Comcast in North America rolled out DNSSEC-validating resolvers to 18+ million customers • Almost all ISPs in Sweden provide DNSSEC-validating resolvers
- 32. www.internetsociety.org/deploy360/ Impact of Google Public DNS Geoff Huston's measurements of DNSSEC validation: § "Since March 2013 we've seen the proportion of end users who use DNSSEC resolvers that perform DNSSEC validation rise from 3.3% to 8.1%, or a rise of some 4.7%." § http://www.circleid.com/posts/20130717_dns_dnssec_and_googles_public_dns_service/ § July 2013
- 33. www.internetsociety.org/deploy360/ Geoff Huston's Measurements – July 2013 Source: http://iepg.org/2013-07-ietf87/2013-07-28-dnssec.pdf
- 34. www.internetsociety.org/deploy360/ SURFnet Validating Server Whitepaper • http://bit.ly/sn-dnssec-vali • Steps through cost/benefit, requirements, planning • Provides instructions for: • BIND 9.x • Unbound • Windows Server 2012 10/1/13
- 36. www.internetsociety.org/deploy360/ Key Questions • What needs to be done to get more domains signed with DNSSEC? • How can DNSSEC validation be more widely deployed? • Are there technical issues or are the issues more of communication and awareness? • How can we as a community address these challenges to increase the usage and availability of DNSSEC?
- 37. www.internetsociety.org/deploy360/ Opportunities to Accelerate Deployment 1. Registrar / DNS hosting provider engagement • Encouraging more registrars to provide DNSSEC and making it easier for domain name holders. 2. Validating name servers • Expanding the deployment of DNSSEC-validating name servers at multiple levels, including ISPs, operating systems and applications. 3. Enterprise signing of domains • Helping enterprises and other large organizations understand the added security value they can achieve with DNSSEC, particularly with the new capabilities of DANE. 4. Government activity with DNSSEC • Encouraging governments to expand their promotion and usage of DNSSEC
- 38. www.internetsociety.org/deploy360/ Registrars and DNSSEC - RAA • New ICANN Registrar Accreditation Agreement (RAA) will have section on DNSSEC • Specifically the "Additional Registrar Operations Specification" • http://www.icann.org/en/news/public-comment/proposed-raa-22apr13- en.htm • Impact will be that any registrars wishing to continue their ICANN accreditation will need to learn about DNSSEC and accept records • Must be implemented by January 1, 2014
- 39. www.internetsociety.org/deploy360/ Registrars and DNSSEC - RAA New specification states: 1. DNSSEC Registrar must allow its customers to use DNSSEC upon request by relaying orders to add, remove or change public key material (e.g., DNSKEY or DS resource records) on behalf of customers to the Registries that support DNSSEC. Such requests shall be accepted and processed in a secure manner and according to industry best practices. Registrars shall accept any public key algorithm and digest type that is supported by the TLD of interest and appears in the registries posted at: <http://www.iana.org/assignments/ dns-sec-alg-numbers/dns-sec-alg-numbers.xml> and <http://www.iana.org/ assignments/ds-rr-types/ds-rr-types.xml>. All such requests shall be transmitted to registries using the EPP extensions specified in RFC 5910 or its successors. Specification also covers IPv6 and IDNs.
- 40. www.internetsociety.org/deploy360/ Helping Accelerate DNSSEC Deployment https://elists.isoc.org/mailman/listinfo/dnssec-coord Public mailing list, “dnssec-coord”, available and open to all: Focus is on better coordinating promotion / advocacy / marketing activities related to DNSSEC deployment. Monthly conference calls and informal meetings at ICANN and IETF events.
- 42. www.internetsociety.org/deploy360/ DNSSEC Workshop at ICANN 48 • November 20, 2013 Buenos Aires, Argentina • Topics to be discussed include: • Automation of DNSSEC • Root key rollover • Guidance for registrars in supporting DNSSEC • Interfaces between registrars and registries • Regional activities • Will be streamed live over the Internet
- 43. www.internetsociety.org/deploy360/ Resources To learn more about DNSSEC and how to get started: http://www.internetsociety.org/deploy360/dnssec/basics/ http://www.internetsociety.org/deploy360/resources/dane/ Specific resources that may be of interest: • SURFnet whitepaper about deploying validating servers • DNSSEC HOWTO • NIST "Secure DNS Deployment Guide"
- 44. www.internetsociety.org/deploy360/ Comcast Case Study • Presentation at October 2012 DNSSEC Deployment Workshop at ICANN 45 • Slides and audio for workshop: • toronto45.icann.org/node/34375 • Comcast presentation: • Customer interaction • Lessons learned • Next steps 10/1/13
- 45. www.internetsociety.org/deploy360/ Increased Number Of DNSSEC Tools Lists of tools: http://www.internetsociety.org/deploy360/dnssec/tools/ http://www.internetsociety.org/deploy360/blog/tag/tools/ DNSSEC Tools Project http://www.dnssec-tools.org/
- 46. www.internetsociety.org/deploy360/ DANE Resources DANE Overview and Resources: • http://www.internetsociety.org/deploy360/resources/dane/ IETF Journal article explaining DANE: • http://bit.ly/dane-dnssec RFC 6394 - DANE Use Cases: • http://tools.ietf.org/html/rfc6394 RFC 6698 – DANE Protocol: • http://tools.ietf.org/html/rfc6698
- 47. www.internetsociety.org/deploy360/ Three Requests For Network Operators 1. Deploy DNSSEC-validating DNS resolvers 2. Sign your own domains where possible 3. Help promote support of DANE protocol • Allow usage of TLSA record. Let browser vendors and others know you want to use DANE. Help raise awareness of how DANE and DNSSEC can make the Internet more secure.
- 48. www.internetsociety.org/deploy360/ Internet Society Deploy360 Programme Can You Help Us With: • Case Studies? • Tutorials? • Videos? How Can We Help You? 10/1/13 www.internetsociety.org/deploy360/
- 49. www.internetsociety.org/deploy360/ york@isoc.org http://www.internetsociety.org/deploy360/ Dan York Senior Content Strategist Internet Society Thank You!