Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DNSSEC KSK rollover breaks DNS resolution for .nz domains

status.internetnz.nz

Post reply on HN
Print view View original

91–100 of 181 posts

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#91

Post by nickf »

matthew9219 wrote: post #84
tptacek wrote: post #83

Earlier quoted context omitted.

That's not how any of this works. Clients don't download the CT logs.

Clients get pre certificates (which are portions of the log) as claims in certificates. It's correct that they never download the whole log - I'm simplifying for clarity, not out of lack of understanding. The fact remains - an adversary with a CA private key that can mitm all of the internet connections for a device can forge a fake CT log and go undetected, if that clients never uses a non-mitm network again.

Clients do not get pre-certs. Those are generated by the CA, and submitted to the log in return for an SCT. Forging a ‘fake CT log’ isn’t possible, either. Nor do clients talk to CT logs, at all.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#92

Post by toast0 »

matthew9219 wrote: post #66
insanitybit wrote: post #65

Earlier quoted context omitted.

Let's say the US wanted to perform an attack that DNSSEC would have prevented, what does that attack look like?

The US seizes the cryptographic material for a US based root, issues keys and certificates for the domains it wants to compromise and intercepts and modifies the traffic for targeted users. There's some additional asterisks around not getting caught and certificate transparency logs and browser reporting structure, but for many classes of devices, it will suffice to simply also hijack the domains used for requesting…

If the US is going to seize cryptographic material from CAs, they've probably got no problem ordering US based domain registries to do their bidding either. If it's Verisign registry, they can use the Verisign CA too, and it's only one company to compel.

If all else fails, ICANN runs the root servers more or less, and is based in the US, and subject to being compelled to make bad signatues of tld glue records.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#93

Post by matthew9219 »

nickf wrote: post #91
matthew9219 wrote: post #84

Earlier quoted context omitted.

Clients get pre certificates (which are portions of the log) as claims in certificates. It's correct that they never download the whole log - I'm simplifying for clarity, not out of lack of understanding. The fact remains - an adversary with a CA private key that can mitm all of the internet connections for a device can forge a fake CT log and go undetected, if that clients never uses a non-mitm network again.

Clients do not get pre-certs. Those are generated by the CA, and submitted to the log in return for an SCT. Forging a ‘fake CT log’ isn’t possible, either. Nor do clients talk to CT logs, at all.

> Forging a ‘fake CT log’ isn’t possible, either

Why do you think this isn't possible?

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#94

Post by matthew9219 »

mjg59 wrote: post #87
matthew9219 wrote: post #84

Earlier quoted context omitted.

Clients get pre certificates (which are portions of the log) as claims in certificates. It's correct that they never download the whole log - I'm simplifying for clarity, not out of lack of understanding. The fact remains - an adversary with a CA private key that can mitm all of the internet connections for a device can forge a fake CT log and go undetected, if that clients never uses a non-mitm network again.

No, because the presented certificate won't have any SCT entries (which are embedded in the certificate), and you can't fake the SCT entries without having access to the CT private keys.

> you can't fake the SCT entries without having access to the CT private keys.

So... Governments like the US and China can fake the entries by using their police forces to seize the private keys?

SCT has the same set of problems as TLS - any log will do, not just logs from countries you trust.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#95

Post by realusername »

matthew9219 wrote: post #64

It seems like some folks are missing the motivation for DNSSec and suggesting TLS instead. If your threat model includes global adversaries, you have can't rely on TLS because governments can trivially compromise TLS providers and TLS exposes users to the lowest common denominator TLS. The lowest common denominator TLS (ACME DNS-1) and the mitigation to the TLS provider problem (CAA records) are both based on DNS. So…

The alternative is secure and decentralized DNS like 'unstoppable domains", DNSSec is too clunky and centralized to help here.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#96

Post by mjg59 »

matthew9219 wrote: post #93
nickf wrote: post #91

Earlier quoted context omitted.

Clients do not get pre-certs. Those are generated by the CA, and submitted to the log in return for an SCT. Forging a ‘fake CT log’ isn’t possible, either. Nor do clients talk to CT logs, at all.

> Forging a ‘fake CT log’ isn’t possible, either Why do you think this isn't possible?

Because they don't have access to the private key material owned by the CT logs that the browsers trust when validating SCT data in the certificate.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#97

Post by tptacek »

matthew9219 wrote: post #86
tptacek wrote: post #85

Earlier quoted context omitted.

I don't think you're providing clarity at all, because that attack doesn't work.

If you wanted to use your words to explain why you think that, that might be more constructive. I could well respond "yes, it does work" but that wouldn't be useful. I know you're an expert in the space and might appreciate learning from you, but this is not that.

I'm sorry, but I'm declining to do that, because I recognize the message board conversational pattern where all the information you have about the subject is coming from comments rebutting you (this is apparent from things you've said already that fundamentally misapprehend how CT works), and, rather than acknowledging any of that information, you just use it as vocabulary for new misapprehensions.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#98

Post by mjg59 »

matthew9219 wrote: post #94
mjg59 wrote: post #87

Earlier quoted context omitted.

No, because the presented certificate won't have any SCT entries (which are embedded in the certificate), and you can't fake the SCT entries without having access to the CT private keys.

> you can't fake the SCT entries without having access to the CT private keys. So... Governments like the US and China can fake the entries by using their police forces to seize the private keys? SCT has the same set of problems as TLS - any log will do, not just logs from countries you trust.

This is why multiple SCT entries are required. Could you subvert all of this with enough effort? Yes, and the same is true of dnssec. Any form of cryptographic validation is only as secure as the control of its private keys, but modern TLS is designed to require you to compromise at least 3 independent parties in the TLS ecosystem to provide a plausible fake. And at that point why not just get the browser vendor to push a fake update to the user that disables TLS validation entirely? You're either doing all validation yourself, or you're trusting someone. Modern TLS avoids you needing to place trust in any one organisation from the TLS perspective, which makes attacks on other infrastructure components much more appealing.

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#99

Post by matthew9219 »

mjg59 wrote: post #88
matthew9219 wrote: post #79

Earlier quoted context omitted.

In the attack DNSSec prevents, a client is compromised by a cert that doesn't appear in the CT logs, so infrastructure monitoring is irrelevant.

Most browsers will reject such a certificate. See https://googlechrome.github.io/CertificateTransparency/ct_po... for the policy Chrome imposes - my understanding is that Safari is broadly similar. Right now I don't think Firefox performs this validation, so this is possible if you know in advance that your target runs Firefox.

That page explains that Chrome (which is best in class here - most IOT devices don't do any of this stuff) fails open:

> If the installed version of Chrome has not applied security updates and has been unable to obtain an updated CT log list from the Component Updater for 70 days or more, then CT enforcement will be disabled.

That means a global adversary need merely block the update channel to targeted devices and wait. How will a Smart TV behave?

Re: DNSSEC KSK rollover breaks DNS resolution for .nz domains

#100

Post by matthew9219 »

toast0 wrote: post #92
matthew9219 wrote: post #66

Earlier quoted context omitted.

The US seizes the cryptographic material for a US based root, issues keys and certificates for the domains it wants to compromise and intercepts and modifies the traffic for targeted users. There's some additional asterisks around not getting caught and certificate transparency logs and browser reporting structure, but for many classes of devices, it will suffice to simply also hijack the domains used for requesting…

If the US is going to seize cryptographic material from CAs, they've probably got no problem ordering US based domain registries to do their bidding either. If it's Verisign registry, they can use the Verisign CA too, and it's only one company to compel. If all else fails, ICANN runs the root servers more or less, and is based in the US, and subject to being compelled to make bad signatues of tld glue records.

Admittedly, the US is a bit of a special case because of ICANN. Better examples are probably Saudi Arabia, Israel, Australia, Russia, etc.
Post reply on HN