ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
|
|
|
- Briana Fowler
- 6 years ago
- Views:
Transcription
1 ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN
2 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them exist.
3 3 DNSSEC Domain Name System Security Extensions Took a while to implement - Design work started in 1993 at IETF 28. The root zone signed: July 15th, 2010.
4 4 DNSSEC Designed to verify data integrity and authenticity. Does not prevent data snooping. Generally, that first point outweighs these others.
5 5 DNSSEC DNSSEC is an overlay on top of DNS, not a replacement. Uses public key cryptography and a chain of trust similar to X.509 certificates.
6 6 DNSSEC Adds six new RR types and extension mechanisms for DNS (EDNS). DNSKEY DS RRSIG NSEC NSEC3 NSEC3PARM
7 7 DNSSEC DNSKEY: The public keys. Either a Key Signing Key (KSK) or Zone Signing Key (ZSK). DS: Delegation Signer. Hashes and identifies the KSK of a signed, delegated child zone.
8 8 DNSSEC RRSIG: Resource Record Signature. Every RRset for each name has a single RRSIG. There are two exceptions: NS records at delegation points. Glue records. DNSKEY RRSIGs are signed by the KSK, all others by ZSK.
9 9 DNSSEC NSEC/NSEC3: Next Secure Record / Next Secure Record version 3. Used to prove the non-existence of a resource record.
10 10 DNSSEC A simple example of securing a zone. mail SOA [SOA STUFF]! NS ns! MX 10 mail! A ! AAAA 2001:db8::100! A ! AAAA 2001:db8::10! NS ns.sub! A ! AAAA 2001:db8:10::10! ns sub ns.sub!
11 11 DNSSEC Throw in the keys... mail ns sub ns.sub SOA [SOA STUFF]! NS ns! MX 10 mail! DNSKEY 256 [DNSKEY STUFF]; ZSK! DNSKEY 257 [DNSKEY STUFF]; KSK! A ! AAAA 2001:db8::100! A ! AAAA 2001:db8::10! NS ns.sub! A ! AAAA 2001:db8:10::10!
12 12 DNSSEC Add the NSEC records so that all gaps are accounted for... mail. mail. mail. ns. ns. ns. sub. sub. ns.sub. ns.sub. SOA [SOA STUFF]! NS ns! MX 10 mail! DNSKEY 256 [DNSKEY STUFF]; ZSK! DNSKEY 257 [DNSKEY STUFF]; KSK! NSEC mail. SOA NS MX DNSKEY NSEC! A ! AAAA 2001:db8::100! NSEC ns. A AAAA NSEC! A ! AAAA 2001:db8::10! NSEC sub. A AAAA NSEC! NS ns.sub! NSEC NS NSEC! A ! AAAA 2001:db8:10::10! NSEC doesn t do glue. Zone enumeration? That s where NSEC3 comes in.
13 DNSSEC Sign each label s RRset and update NSECs... mail. mail. mail. mail. mail. mail. ns. ns. ns. ns. ns. ns. sub. sub. sub. ns.sub. ns.sub. SOA [SOA STUFF]! RRSIG SOA [RRSIG STUFF]! NS ns! RRSIG NS [RRSIG STUFF]! MX 10 mail! RRSIG MX [RRSIG STUFF]! DNSKEY 256 [DNSKEY STUFF]; ZSK! DNSKEY 257 [DNSKEY STUFF]; KSK! RRSIG DNSKEY [RRSIG STUFF]! NSEC mail. SOA NS MX DNSKEY NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! RRSIG A [RRSIG STUFF]! AAAA 2001:db8::100! RRSIG AAAA [RRSIG STUFF]! NSEC ns. A AAAA NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! RRSIG A [RRSIG STUFF]! AAAA 2001:db8::10! RRSIG AAAA [RRSIGSTUFF]! NSEC sub. A AAAA NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! NS ns.sub! NSEC NS NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! AAAA 2001:db8:10::10! 13
14 DNSSEC 14 Signed delegations. Add DS records and update NSEC and RRSIGs. mail. mail. mail. mail. mail. mail. ns. ns. ns. ns. ns. ns. sub. sub. sub. sub. sub. ns.sub. ns.sub. SOA [SOA STUFF]! RRSIG SOA [RRSIG STUFF]! NS ns! RRSIG NS [RRSIG STUFF]! MX 10 mail! RRSIG MX [RRSIG STUFF]! DNSKEY 256 [DNSKEY STUFF]; ZSK! DNSKEY 257 [DNSKEY STUFF]; KSK! RRSIG DNSKEY [RRSIG STUFF]! NSEC mail. SOA NS MX DNSKEY NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! RRSIG A [RRSIG STUFF]! AAAA 2001:db8::100! RRSIG AAAA [RRSIG STUFF]! NSEC ns. A AAAA NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! RRSIG A [RRSIG STUFF]! AAAA 2001:db8::10! RRSIG AAAA [RRSIG STUFF]! NSEC sub. A AAAA NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! NS ns.sub! DS [Hash of sub s KSK]! RRSIG DS [RRSIG STUFF]! NSEC NS DS NSEC RRSIG! RRSIG NSEC [RRSIG STUFF]! A ! AAAA 2001:db8:10::10!
15 15 DNSSEC What to do with all this extra data? Publishing the signed data is only half the battle. The authoritative DNS responses need to be validated.
16 16 DNSSEC Response validation involves following a chain of trust from the trust anchor to the answer received. Typically, the root zone s KSK == Trust Anchor
17 17 DNSSEC The backbone of the chain of trust is the DS, DNSKEY, RRSIG interaction. Trust travels from the parent zone down to the child zone. Repeat until the target zone is found. Start at the trust anchor s zone.
18 18 DNSSEC RRSIG! Parent Zone KSK DNSKEY! ZSK DNSKEY! RRSIG!...! DS! RRSIG! Child Zone KSK DNSKEY! ZSK DNSKEY! RRSIG!...! DS!
19 19 DNSSEC Once the target child zone is found, the ZSK is used the verify the appropriate RRSIG. If the question cannot be answered, the ZSK can be used to verify the appropriate NSEC/NSEC3 RRSIG. If the answer can t be verified, then NXDOMAIN status is returned.
20 20 DNSSEC From a DNS publisher s point of view, DNSSEC can greatly expand the size of zones. On average, responses are larger. Management of the keys can be tricky. Protects the data, not the headers. Does nothing to protect the stub resolver to recursive resolver communication.
21 21 DNSSEC At ARIN, we currently sign our v4 /8s and v6 /12 and /24s. ARIN Online allows members to add DS records to the zones their resources are delegated from.
22 22 DNSSEC DNSSEC Analyzer: DNSViz: ldns / Drill: DNSSEC Validator: (FF Plugin) Other Tools: index.php/tools_and_resources
23 23
24 24 The inter-domain routing protocol BGP was created when the Internet environment had not yet reached the present, contentious state. Consequently, the BGP design did not include protections against deliberate or accidental errors that could cause disruptions of routing behavior. Intro to RFC 4272 BGP Security Vulnerabilities Analysis January 2006
25 25 This is the basic problem... Send a packet to I have /17
26 AS100 AS200 AS300
27 AS100 AS200 AS300 AS
28 28 April 1997 AS 7007 announced paths for all of the internet to themselves. Feb. 24, 2008 Pakistan Telecom announced a part of YouTube s address blocks. April China Telecom mis-originated about 15% of Internet address blocks affecting I-root. Nov Google was unavailable some places via route leak from Moratel.
29 AS100 AS200 Phase 2: Path Validation (still in draft phase) AS300 Phase 1: Origin Validation (requires )
30 30 Resource Public Key Infrastructure attaches ASNs and IP address blocks to X.509 v3 certs. These resource certs are signed by the resource parent.
31 31 Resource Allocation Hierarchy IANA! AFRINIC! APNIC! ARIN! ISP 1! ISP 3! ISP 2! ISP! ISP! LACNIC! ISP 4! ISP! RIPE NCC!
32 32 Certificates issued to match allocations. IANA! AFRINIC! APNIC! ARIN! ISP 1! ISP 3! ISP 2! ISP! ISP! LACNIC! ISP 4! ISP! RIPE NCC! Issuer: ARIN! Subject: ARIN! Resources: /8! Key Info: <arin-key-pub>! Signed: <arin-key-priv>!
33 33 Certificates issued to match allocations. IANA! AFRINIC! Issuer: ARIN! Subject: ISP1! Resources: /16! Key Info: <isp1-key-pub>! Signed: <arin-key-priv>! APNIC! ARIN! ISP 1! ISP 3! ISP 2! ISP! ISP! LACNIC! ISP 4! ISP! RIPE NCC! Issuer: ARIN! Subject: ARIN! Resources: /8! Key Info: <arin-key-pub>! Signed: <arin-key-priv>!
34 34 Certificates issued to match allocations. IANA! AFRINIC! Issuer: ARIN! Subject: ISP1! Resources: /16! Key Info: <isp1-key-pub>! Signed: <arin-key-priv>! Issuer: ISP1! Subject: ISP3! Resources: /24! Key Info: <isp3-key-pub>! Signed: <isp1-key-priv>! APNIC! ARIN! ISP 1! ISP 3! ISP 2! ISP! ISP! LACNIC! ISP 4! ISP! RIPE NCC! Issuer: ARIN! Subject: ARIN! Resources: /8! Key Info: <arin-key-pub>! Signed: <arin-key-priv>!
35 35 Address holders issue Route Origin Authorizations (ROAs).
36 36 Certificates issued to match allocations. IANA! AFRINIC! Issuer: ARIN! Subject: ISP1! Resources: /16! Key Info: <isp1-key-pub>! Signed: <arin-key-priv>! Issuer: ISP1! Subject: ISP3! Resources: /24! Key Info: <isp3-key-pub>! Signed: <isp1-key-priv>! APNIC! ARIN! ISP 1! ISP 3! ISP 2! ISP! ISP! LACNIC! ISP 4! ISP! RIPE NCC! Issuer: ARIN! Subject: ARIN! Resources: /8! Key Info: <arin-key-pub>! Signed: <arin-key-priv>!
37 37 Certificates issued to match allocations. IANA! AFRINIC! Issuer: ARIN! Subject: ISP1! Resources: /16! Key Info: <isp1-key-pub>! Signed: <arin-key-priv>! Issuer: ISP1! Subject: ISP3! Resources: /24! Key Info: <isp3-key-pub>! Signed: <isp1-key-priv>! APNIC! ARIN! ISP 1! ISP 3! ISP 2! Issuer: ISP3! Subject: ISP3-EE! Resources: /24! Key Info: <isp3ee-key-pub>! Signed: <isp3-key-priv>! ISP! ISP! LACNIC! ISP 4! RIPE NCC! Issuer: ARIN! Subject: ARIN! Resources: /8! Key Info: <arin-key-pub>! Signed: <arin-key-priv>! ISP! ROA: ISP 3 permits ASN 123 to originate its /24 network space.!!!! ß Attached! Signed, <isp3ee-key-priv>!
38 38 Two implementation types: Delegated: Each participating node becomes a CA and runs their own repository, delegated to by the parent CA. Hosted: The RIR runs the CA functionality for interested participants.
39 39 For most participants, running a CA would be an insurmountable obstacle to the implementation of. This is why the hosted option exists.
40 40 Regardless of the method used, the repositories are published. TAL: Trust Anchor Locator Points to the rsync entry point of that repo. Includes that repo s public key.
41 41 Reliant third parties would gather all relevant TALs. Get all of the repos. Validate, validate, validate.
42 42 Once we have validated ROAs and the backing resource hierarchy, what do we do?
43 43 Once we have validated ROAs and the backing resource hierarchy, what do we do? Use ROAs to weight BGP path announcements as they re received.
44 AS100 AS200 AS300 AS
45 AS100 AS200 AS300
46 46 Only AS 300 can originate /24 network space.! AS100 AS200 AS300
47 47 Only AS 300 can originate my /24 network space.! AS100 AS200 AS300 AS
48 48 Only AS 300 can originate my /24 network space.! AS100 AS200 AS300 AS
49 49 Border routers use the with the /Router protocol. Implemented on Cisco IOS and Quagga. JunOS recently added.
50 50 Offload validation and origin evaluation to some other box. Valid, Invalid, Unknown What s done with these values is up to the local policy.
51 51 As with DNSSEC, the more buy in, the better the security. Be a good netizen: certify your resources. Even better: publish ROAs. Be the best happy shiny: validate route origins as support allows.
52 ARIN Only hosted model is currently implemented. The delegated model will be released in the not-too-distant future. Non-repudiation requirement. Third parties need to sign a RPA before getting the TAL.
53 53 Future of Single TAL. Inter-RIR transfers. Integrated with a path validation system.
54 54 Questions
ISP 1 AS 1 Prefix P peer ISP 2 AS 2 Route leak (P) propagates Prefix P update Route update P Route leak (P) to upstream 2 AS 3 Customer BGP Update messages Route update A ISP A Prefix A ISP B B leaks
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN. Mark Kosters CTO
Securing Internet Infrastructure: Route Origin Security using RPKI at ARIN Mark Kosters CTO What is RPKI? Resource Public Key Infrastructure Attaches digital certificates to network resources AS Numbers
RPKI Trust Anchor. Geoff Huston APNIC
RPKI Trust Anchor Geoff Huston APNIC Public Keys How can you trust a digital signature?? What if you have never met the signer and have no knowledge of them or their keys? One approach is transitive trust
Securing Routing: RPKI Overview. Mark Kosters Chief Technology Officer
Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer Why are DNSSEC and RPKI important? Two of the most critical resources DNS Routing Hard to tell when resource is compromised Focus of
Problem. BGP is a rumour mill.
Problem BGP is a rumour mill. We want to give it a bit more authorita We think we have a model AusNOG-03 2009 IP ADDRESS AND ASN CERTIFICATION TO IMPROVE ROUTING SECURITY George Michaelson APNIC R&D ggm@apnic.net
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Madison, Wisconsin 9 September14
1 Madison, Wisconsin 9 September14 2 Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN Engineering 3 Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Update on Resource Certification. Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008
Update on Resource Certification Geoff Huston, APNIC Mark Kosters, ARIN IEPG, March 2008 Address and Routing Security What we have had for many years is a relatively insecure interdomain routing system
RPKI. Resource Pubic Key Infrastructure
RPKI Resource Pubic Key Infrastructure Purpose of RPKI RPKI replaces IRR or lives side by side? Side by side: different advantages Security, almost real time, simple interface: RPKI Purpose of RPKI Is
Life After IPv4 Depletion
1 Life After IPv4 Depletion Jon Worley Analyst Securing Core Internet Functions Resource Certification, RPKI Mark Kosters Chief Technology Officer 2 Core Internet Functions: Routing & DNS The Internet
DNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
RPKI Introduction. APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By:
RPKI Introduction APNIC Technical Workshop July 5-6, 2018 in Beijing, China. Hosted By: 1 Content Why do we need RPKI What is RPKI How to deploy RPKI Configuration case Misdirection / Hijacking Incidents
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC
Resource Public Key Infrastructure (RPKI) Nurul Islam Roman, APNIC Target Audience Knowledge of Internet Routing(specially BGP) Fair idea on Routing Policy No need to know Cryptography Basic knowledge
Resource PKI. NetSec Tutorial. NZNOG Queenstown. 24 Jan 2018
Resource PKI NetSec Tutorial NZNOG2018 - Queenstown 24 Jan 2018 1 Fat-finger/Hijacks/Leaks Bharti (AS9498) originates 103.0.0.0/10 Dec 2017 (~ 2 days) No damage more than 8K specific routes! Google brings
RPKI deployment at AFRINIC Status Update. Alain P. AINA RPKI Project Manager
RPKI deployment at AFRINIC Status Update Alain P. AINA RPKI Project Manager What is Resource Certifcation? Resource Certifcation is a security framework for verifying the association between resource holders
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
Table of Contents. DNS security. Alternative DNS security mechanism. DNSSEC specification. The long (and winding) road to the DNSSEC specification
Table of Contents DNS security Karst Koymans Informatics Institute University of Amsterdam (version 1.19, 2011/09/27 14:18:11) Friday, September 23, 2011 The long (and winding) road to the DNSSEC specification
Secure Routing with RPKI. APNIC44 Security Workshop
Secure Routing with RPKI APNIC44 Security Workshop Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
Deploying RPKI An Intro to the RPKI Infrastructure
Deploying RPKI An Intro to the RPKI Infrastructure VNIX-NOG 24 November 2016 Hanoi, Vietnam Issue Date: Revision: Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours)
Securing Core Internet Functions Resource Certification, RPKI. Mark Kosters ARIN CTO
Securing Core Internet Functions Resource Certification, RPKI Mark Kosters ARIN CTO Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to
Facilitating Secure Internet Infrastructure
Facilitating Secure Internet Infrastructure RIPE NCC http://www.ripe.net About the RIPE NCC RIPE Network Coordination Centre Bottom-up, self-regulated, membership association, notfor-profit Regional Internet
Toward Unspoofable Network Identifiers. CS 585 Fall 2009
Toward Unspoofable Network Identifiers CS 585 Fall 2009 The Problem DNS Spoofing Attacks (e.g., Kaminsky) At link (Ethernet) and IP layers, either: Software sets the source address in the packet, or Software
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
Misdirection / Hijacking Incidents
Security Tutorial @ TWNOG SECURE ROUTING WITH RPKI 1 Misdirection / Hijacking Incidents YouTube Incident Occurred 24 Feb 2008 (for about 2 hours) Pakistan Telecom announced YT block Google (AS15169) services
Assessing and Improving the Quality of DNSSEC
Assessing and Improving the Quality of DNSSEC Deployment Casey Deccio, Ph.D. Sandia National Laboratories AIMS-4 CAIDA, SDSC, San Diego, CA Feb 9, 2012 Sandia is a multiprogram laboratory operated by Sandia
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil!
Internet Resource Certification and Inter- Domain Routing Security! Eric Osterweil! Who is allowed to do what?! BGP (the Internet s inter-domain routing protocol) runs by rumor Participants assert reachability
Introducción al RPKI (Resource Public Key Infrastructure)
Introducción al RPKI (Resource Public Key Infrastructure) Roque Gagliano rogaglia@cisco.com 4 Septiembre 2013 Quito, Equator 2011 Cisco and/or its affiliates. All rights reserved. 1 Review of problem to
Shifting Sands. PLNOG March Andrzej Wolski Training Department
Shifting Sands PLNOG March 2014 Andrzej Wolski Training Department RIPE NCC 2 Began operating in 1992 Not-for-profit membership organisation 10,000 members (Local Internet Registries) Neutral, Impartial,
DNS security. Karst Koymans & Niels Sijm. Tuesday, September 18, Informatics Institute University of Amsterdam
DNS security Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Tuesday, September 18, 2012 Karst Koymans & Niels Sijm (UvA) DNS security Tuesday, September 18, 2012 1 / 38 1 Chain
Securing BGP - RPKI. ThaiNOG Bangkok. 21 May Tashi Phuntsho
Securing BGP - RPKI ThaiNOG2018 - Bangkok 21 May 2018 Tashi Phuntsho (tashi@apnic.net) 1 Fat-finger/Hijacks/Leaks Amazon (AS16509) Route53 hijack April2018 AS10279 (enet) announced/originated more specifics
Resource Public Key Infrastructure
Resource Public Key Infrastructure A pilot for the Internet2 Community to secure the global route table Andrew Gallo The Basics The Internet is a self organizing network of networks. How do you find your
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies
Overview of the Resource PKI (RPKI) Dr. Stephen Kent VP & Chief Scientist BBN Technologies Presentation Outline The BGP security problem RPKI overiew Address & AS number allocation system Certificates
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
Table of Contents. DNS security basics. What DNSSEC has to offer. In what sense is DNS insecure? Why DNS needs to be secured.
Table of Contents DNS security basics The basics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.3, 2013/09/13 11:46:36) Tuesday, Sep 17, 2013 Why DNS needs to
BGP Origin Validation
BGP Origin Validation ISP Workshops These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/) Last updated
Scott Rose, NIST Winter JointTechs Meeting Jan 30, 2011 Clemson University
Scott Rose, NIST scottr@nist.gov 2011 Winter JointTechs Meeting Jan 30, 2011 Clemson University Special Thanks to RIPE NCC who provided the base slides for this tutorial. DNS is not secure Known vulnerabilities
Robust Inter-Domain Routing
Establishing the Technical Basis for Trustworthy Networking Robust Inter-Domain Routing Addressing Systemic Vulnerabilities in BGP Doug Montgomery (dougm@nist.gov) Manager, Internet and Scalable Systems
Some DNSSEC thoughts. DNSOPS.JP BOF Interop Japan Geoff Huston Chief Scientist, APNIC June 2007
Some DNSSEC thoughts DNSOPS.JP BOF Interop Japan 2007 Geoff Huston Chief Scientist, APNIC June 2007 The DNS is a miracle! You send out a question into the net And an answer comes back! Somehow But WHO
Expires: June 16, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003
DNS Extensions Internet-Draft Expires: June 16, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003 Protocol Modifications for the DNS
Decentralized Internet Resource Trust Infrastructure
Decentralized Internet Resource Trust Infrastructure Bingyang Liu, Fei Yang, Marcelo Bagnulo, Zhiwei Yan, and Qiong Sun Huawei UC3M CNNIC China Telecom 1 Critical Internet Trust Infrastructures are Centralized
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI MENOG 3 / Salmiya 2008.04.15 Randy Bush http://rip.psg.com/~randy/080415.menog-v4-trad-rpki.pdf 2008.04.15 MENOG v4 Trade RPKI 2 Internet Initiative
DNSSEC. Lutz Donnerhacke. db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec e164.arpa. naptr
DNSSEC Lutz Donnerhacke db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec 1.6.5.3.7.5.1.4.6.3.9.4.e164.arpa. naptr 1 A protocol from better times An ancient protocol People were friendly and
The RPKI & Origin Validation
The RPKI & Origin Validation RIPE / Praha 2010.05.03 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2010.05.03 RIPE RPKI
Resource Certification. Alex Band, Product Manager DENIC Technical Meeting
Resource Certification Alex Band, Product Manager DENIC Technical Meeting Internet Routing Routing is non-hierarchical, open and free Freedom comes at a price: - You can announce any address block on your
Using Resource Certificates Progress Report on the Trial of Resource Certification
Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston APNIC From the RIPE Address Policy Mail List 22 25 Sept 06, address-policy-wg@lists.ripe.net
RPKI and Routing Security
Presentation September 2015 Yerevan Regional Meeting Routing Security 2 Routing Registry route objects RPKI (Resource Public Key Infrastructure) ROAs (Route Origin Authorisation) What is the Purpose of
A Security Evaluation of DNSSEC with NSEC Review
A Security Evaluation of DNSSEC with NSEC Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
IPv4 Run-Out, Trading, and the RPKI
IPv4 Run-Out, Trading, and the RPKI RIPE 56 / Berlin 2008.05.07 Randy Bush http://rip.psg.com/~randy/080507.ripe-v4-trad-rpki.pdf 2008.05.07 RIPE v4 Trade RPKI 2 Internet Initiative Japan
APNIC s role in stability and security. Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013
APNIC s role in stability and security Adam Gosling Senior Policy Specialist, APNIC 4th APT Cybersecurity Forum, 3-5 December 2013 Overview Introducing APNIC Working with LEAs The APNIC Whois Database
MAGPI: Advanced Services IPv6, Multicast, DNSSEC
MAGPI: Advanced Services IPv6, Multicast, DNSSEC Shumon Huque MAGPI GigaPoP & Univ. of Pennsylvania MAGPI Technical Meeting April 19th 2006, Philadelphia, PA 1 Outline A description of advanced services
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Recap DNS originally not designed with
Expires: November 15, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004
DNS Extensions Internet-Draft Expires: November 15, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004 Protocol Modifications for the DNS
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
APNIC DNSSEC APNIC DNSSEC. Policy and Practice Statement. DNSSEC Policy and Practice Statement Page 1 of 12
APNIC DNSSEC Policy and Practice Statement DNSSEC Policy and Practice Statement Page 1 of 12 Table of Contents Overview 4 Document name and identification 4 Community and applicability 4 Specification
PKI-An Operational Perspective. NANOG 38 ARIN XVIII October 10, 2006
PKI-An Operational Perspective NANOG 38 ARIN XVIII October 10, 2006 Briefing Contents PKI Usage Benefits Constituency Acceptance Specific Discussion of Requirements Certificate Policy Certificate Policy
Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution
SYSADMIN DNSSEC Sergey Ilin, Fotolia Trusted name resolution with DNSSEC CHAIN OF TRUST Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution service.
RIPE NCC DNS Update. Wolfgang Nagele DNS Services Manager
RIPE NCC DNS Update Wolfgang Nagele DNS Services Manager DNS Department Services Reverse DNS for RIPE NCC zones Secondary for other RIRs K-root F-reverse (in-addr.arpa & ip6.arpa) Secondary DNS for cctlds
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
DNSSEC deployment. Phil Regnauld Hervey Allen
DNSSEC deployment Phil Regnauld Hervey Allen Overview We will talk about: the problems that DNSSEC addresses the protocol and implementations the practical problems tied to real-world deployment We will
Documentation. Name Server Predelegation Check
Name Server Predelegation Check Doc. version: 1.4.1 Doc. status: Final Doc. date: 01.12.2015 Doc. name: Name Server Predelegation Check- -DNS Services-V1.4.1-2015-12-01 Copyright 2015 DENIC eg Imprint
IETF81 Secure IDR Rollup TREX Workshop David Freedman, Claranet
IETF81 Secure IDR Rollup TREX Workshop 2011 David Freedman, Claranet Introduction to Secure IDR (SIDR) You are in a darkened room at the IETF. You are surrounded by vendors. A lone operator stands quietly
Root Zone DNSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 51 51 KSK Rollover: An Overview ICANN is in the process of performing a Root Zone DNS Security Extensions (DNSSEC) Key Signing Key (KSK) rollover The Root Zone DNSSEC Key
Using Resource Certificates Progress Report on the Trial of Resource Certification
Using Resource Certificates Progress Report on the Trial of Resource Certification October 2006 Geoff Huston APNIC Sound Familiar? 4:30 pm Mail: Geoff, mate, I ve been dealing with your phone people and
DNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
Network Working Group
Network Working Group R. Arends Request for Comments: 4035 Telematica Instituut Obsoletes: 2535, 3008, 3090, 3445, 3655, 3658, R. Austein 3755, 3757, 3845 ISC Updates: 1034, 1035, 2136, 2181, 2308, 3225,
Just give me a button!
Just give me a button! The challenges of routing security RIPE NCC Members organisation founded in 1992 Manages IP and ASN allocations in Europe, Middle East and former Soviet Union - Ensure unique holdership
BGP Origin Validation (RPKI)
University of Amsterdam System & Network Engineering BGP Origin Validation (RPKI) July 5, 2013 Authors: Remy de Boer Javy de Koning Supervisors: Jac Kloots
DNSSEC Overview. NANOG 54 Tutorial" Matt Larson! Vice President, DNS Research" Verisign Labs" Version: "
DNSSEC Overview NANOG 54 Tutorial" Matt Larson! Vice President, DNS Research" Verisign Labs" Version: 2012-02-05" DNS Security! DNS has no security One UDP packet for query, one UDP packet for response
Secure Inter-domain Routing with RPKI
Secure Inter-domain Routing with RPKI Srinivas (Sunny) Chendi VNIX-NOG 2018, Da Nang sunny@apnic.net Xin chào và chào buổi sáng 1 3 4 What is the fundamental Problem? An underlying problem in routing
Hands-on DNSSEC with DNSViz. Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016
Hands-on DNSSEC with DNSViz Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016 Preparation Demo and exercises available at: http://dnsviz.net/demo/ Includes links to the following: VirtualBox
3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
APNIC RPKI Report. George Michaelson
APNIC RPKI Report George Michaelson APNIC RPKI Current Activities The RPKI TA Framework APNIC s TA Changes Provisioning Protocol Services The RPKI TA Framework The RPKI TA Framework Managing TAs is an
An Operational ISP & RIR PKI
An Operational ISP & RIR PKI ARIN / Montreal 2006.04.10 Randy Bush Quicksand Unknown quality of whois data Unknown quality of IRR data No formal
Understanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
DNSSEC Validators Requirements
DNSSEC Validators Requirements draft-mglt-dnsop-dnssec-validator-requirements-05 Migault, Lewis, York IETF99 ToC Time Requirements Trust Anchor Requirements Bootstrapping / configuration TA Datastore Interaction
The RPKI and BGP Origin Validation
The RPKI and BGP Origin Validation APRICOT / New Delhi 2012.02.27 Randy Bush Rob Austein Steve Bellovin And a cast of thousands! Well, dozens :) 2012.02.27
Algorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net Olaf M. Kolkman Question What would be the immediate and initial effect on memory, CPU and bandwidth resources if we were to deploy DNSSEC
DNS SECurity Extensions technical overview
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research developed by EURid in cooperation with industry experts
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
FIRMS: a Future InteRnet Mapping System
Institute of Computer Science Department of Distributed Systems Prof. Dr.-Ing. P. Tran-Gia FIRMS: a Future InteRnet Mapping System Michael Menth, Matthias Hartmann, Michael Höfling Overview The FIRMS architecture
Resource Certification
Resource Certification CISSP, science group manager RIPE NCC robert@ripe.net 1 Contents Motivation for Resource Certification (RPKI) Architecture overview Participating in RPKI Most importantly: use cases
The RPKI & Origin Validation
The RPKI & Origin Validation NANOG / Denver 2011.06.12 Randy Bush Rob Austein Steve Bellovin Michael Elkins And a cast of thousands!
GDS Resource Record: Generalization of the Delegation Signer Model
GDS Resource Record: Generalization of the Delegation Signer Model Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, France {gilles.guette, bernard.cousin, david.fort}@irisa.fr
I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist?
RRSIG: I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist? NSEC: I certify that there are no DNS records (of type X) whose record
RPKI Deployment Considerations: Problem Analysis and Alternative Solutions. 95 SIDR meeting
RPKI Deployment Considerations: Problem Analysis and Alternative Solutions draft-lee-sidr-rpki-deployment-01 @IETF 95 SIDR meeting fuyu@cnnic.cn Background RPKI in China CNNIC deploy a platform to provide
SecSpider: Distributed DNSSEC Monitoring and Key Learning
SecSpider: Distributed DNSSEC Monitoring and Key Learning Eric Osterweil UCLA Joint work with Dan Massey and Lixia Zhang Colorado State University & UCLA 1 Who is Deploying DNSSEC? Monitoring Started From
RPKI and Internet Routing Security ~ The regional ISP operator view ~
RPKI and Internet Routing Security ~ The regional ISP operator view ~ APNIC 29/APRICOT 2010 NEC BIGLOBE, Ltd. (AS2518) Seiichi Kawamura 1 Agenda Routing practices of the regional ISP today How this may
DENIC DNSSEC Testbed Software support for DNSSEC Ralf Weber
DENIC DNSSEC Testbed Software support for DNSSEC Ralf Weber (ralf.weber@nominum.com) Who is Nominum? Mission Product Leadership Industry Expertise Deliver the Trusted Internet Experience Strategic Partners:
Attacks on routing: IP hijacks
Attacks on routing: IP hijacks How Internet number resources are managed IANA ARIN LACNIC APNIC RIPE NCC AfriNIC ISP NIC.br NIC.MX ISP #1 LIRs/ISPs LIRs/ISPs End users ISP mx How Internet number resources