のコピー

Size: px

Start display at page:

Download "のコピー"

ゆああいしま
5 years ago
Views:

1 DNSSEC Masakazu NISOC 1

2 What? DNS SECurity extensions. DNS Resource Record(RR), RR. (Validator) RR. RR. 2

3 Why? Thread Analysis of the Domain Name System(RFC3833): Packet Interception ID Guessing and Query Prediction Name Chaining Betrayal By Trusted Server Denial of Service Authenticated Denial of Domain Name Wildcards 3

4 The Kaminsky DNS Vulnerability (1) Root Server ns.badguy.com ISP's Recursive Server DNS Client 4

5 The Kaminsky DNS Vulnerability (2) Root Server ns.victim.com ISP's Recursive Server ns.badguy.com DNS Client 5

6 4 New RRs DNSKEY: RR. RRSIG: RR. NSEC: RR. DS: RR. 6

7 DNSKEY example.org. DNSKEY AwEAAZbg..n7psoP8= The Flags Field: 8bit (256) Zone Key. 16bit (1) Secure Entry Point(SEP) ( ). 0. The Protocol Field: 3. The Algorithm Field: 1=RSA/MD5, 2=Diffie-Helman, 3=DSA/SHA-1, 4=Elliptic Curve, 5=RSA/SHA-1(MANDATORY). The Public Key Field: Base64. 7

8 RRSIG RRSIG A ( example.org. ifsp..yg== ) The Type Covered Field: RRSIG. The Algorithm Number Field: DNSKEY Algorithm Number Field. The Labels Field: ( www, example, org 3 3). Original TTL Field: RR TTL. Signature Expiration and Inception Fields:. The Key Tag Field:. The Signer s Name Field:. The Signature Field: Base64. 8

9 NSEC example.org. NSEC mail.example.org. ( NS SOA MX RRSIG NSEC DNSKEY ) The Next Domain Name Field: ( example.org.) ( mail.example.org.).. The Type Bit Maps Field:. 9

10 DS example.org.!! IN DS C9A8675E..E4A283F9 The Key Tag Field:. The Algorithm Field: DNSKEY Algorithm Number Field. The Digest Type Field: 0=Reserved, 1=SHA-1(MANDATORY), 2-255=Unassigned. The Digest Feild: DNSKEY DNSKEY RDATA. 10

11 example.org. IN SOA ns1.example.org. info.example.org. ( ; serial Key Tag = ; refresh (8 hours) 7200 ; retry (2 hours) ; expire (1 week) ; minimum (1 day) ) RRSIG SOA example.org. XNck..dQ== Key Tag = 7083 NS ns1.example.org. NS ns2.example.org. RRSIG NS example.org. MRQp..oJ== MX 10 mail.example.org. RRSIG MX example.org. TDvE..9w== NSEC mail.example.org. NS SOA MX RRSIG NSEC DNSKEY Key Tag = 7083 RRSIG NSEC example.org. ggbs..sg== DNSKEY AwEAAZbg..n7psoP8= ; key id = 7083 DNSKEY AwEAAdMd..ZaDMP40= ; key id = Key Tag = RRSIG DNSKEY example.org. YckV..Lw== RRSIG DNSKEY example.org. HE+Q..jg== mail.example.org. IN A RRSIG A example.org. ifsp..yg== NSEC ns1.example.org. A RRSIG NSEC RRSIG NSEC example.org. DPQP..+A== ns1.example.org. IN A RRSIG A example.org. MoXm..jQ== NSEC ns2.example.org. A RRSIG NSEC RRSIG NSEC example.org. WPGK..Yw== ns2.example.org. IN A RRSIG A example.org. TS7A..Eg== NSEC A RRSIG NSEC RRSIG NSEC example.org. DgM5..0g== IN A RRSIG A example.org. OTme..kQ== NSEC example.org. A RRSIG NSEC RRSIG NSEC example.org. LUDU..GA== 11

12 RRSIG DNSKEY DS,. root jp DNSSEC root DNSSEC, root DNSKEY. DNSKEY (Trust Anchor) (Island of Security). 12

13 NSEC RR RR : example.org. foo.example.org. A RR example.org. NSEC mail.example.org..... NSEC foo.example.org. example.org. mail.example.org. example.org. mail.example.org.. RR : CNAME RR NSEC example.org. A RRSIG NSEC CNAME. 13

14 .. DS. (KSK):. Secure Entry Point(SEP) On... (ZSK):. Secure Entry Point(SEP) Off... 14

15 DO, AD and CD DNSSEC 3. DO: DNSSEC OK. DNSSEC, DNSSEC RR. AD: Authenticated Data.. DNSSEC. CD: Checking Disabled. DNSSEC. 15

16 How? Step 1) KSK/ZSK. Step 2). Step 3) KSK DS RR. Step 4) ZSK, ZSK. 16

17 When? root...on the goal of an operationally Signed Root Zone as soon as feasible in ICANN to Work with United States Government and VeriSign on Interim Solution to Core Internet Security Issue - jp JP. JP DNSSEC

18 References DNS Security Introduction and Requirements - Resource Records for the DNS Security Extensions - Protocol Modifications for the DNS Security Extensions - Threat Analysis of the Domain Name System (DNS) - An Illustrated Guide to the Kaminsky DNS Vulnerability

DNS DNS 2002/12/19 Internet Week 2002/DNS DAY 2

DNS 2002 12 19 2003 1 16 Internet Week 2002/DNS DAY ( ) (JPRS) DNS DNS 2002/12/19 Internet Week 2002/DNS DAY 2 DNS SOA SOA TTL $TTL NS MX CNAME 2002/12/19 Internet Week 2002/DNS DAY