[Acme] Validation Vulnerabilities

[moparisthebest <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello all,

These vulnerabilities would allow an attacker who doesn't control a
domain to get a certificate for that domain, and are basically due to
problems with DNS.

Basically I noticed a comment here:
https://github.com/letsencrypt/boulder/issues/11#issuecomment-103897922
which says letsencrypt won't support DNS validation at the start
because of vulnerabilities, but the problem is all other forms of auth
(DVSNI/Simple HTTPS) also rely on the same DNS to look up the domain
name to connect to, and are therefore subject to the same vulnerabilitie
s.

The *correct* and only perfect solution to this is only allowing
DNSSEC signed responses for any of the above validation tests.  This
means that if a response is properly covered by DNSSEC, none of the
following hacks need to be applied.  But since we don't live in a
perfect world, I'll propose some things that attempt to work around
the issues without DNSSEC:

1. Only allowing DNS over TCP instead of UDP would prevent a
non-man-in-the-middle attacker from sending a well-timed UDP response
with a fake DNS record in it.
2. A man-in-the-middle could hijack DNS queries and send back whatever
responses they want, this could be at the datacenter, bandwidth
provider, or even a nation-state style attacker.  Here are some crazy
ideas to attempt to prevent this:

    a. Have the validator perform DNS queries from 2 different
providers in 2 different geographic locations with 2 different
backbones (via a secure channel between servers, ssh/vpn etc), and
fail if the response is not the same.  For example a server in china
and the usa would likely not have the same man-in-the-middle able to
forge both responses.
    b. Have the validator perform the DNS queries from the server
directly then over TOR, or maybe over TOR multiple times requesting a
different exit node each time, and if the same response isn't returned
each time then fail.
    c. Query different DNS providers over a secure protocol like
DNSCurve or something, and fail if responses are different, OpenDNS is
the only one I know of that supports this right now.

The catch with methods a-c though are they fail with a load-balanced,
geographic-specific, or round-robin DNS, but then maybe fancy large
setups like that don't need automatic certificates?  Or maybe instead
of failing if the IPs were different, you just perform whatever test
you were doing on each of the IPs and verify that it passes against
all IPs.

I don't know if these implementation details should be mentioned in
the ACME spec per-say, or if they should just be
implementation-specific like in boulder, but I feel the
vulnerabilities should be mentioned at the least if not work-around idea
s.

I cross-posted this from
https://github.com/letsencrypt/acme-spec/issues/131

Thanks,
moparisthebest
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQQcBAEBCgAGBQJVcZ1ZAAoJEOy5uMuqxowDmlcgAJ01jiuTiMPKXdF5nFPOc4y/
yaBAVwKsBwx18kDfCO8wjDRoPKh5Y/srzMlwv6FDqlxs6ZbjKLHNbV6dFEn9+dNu
8Dd5c1073B2tv1Ln1Ml/H249Ma1s+mlu5nN2xdAY18as793jpyXvhBa7pERw3H7H
kOhyEMi8FBl3OXDQnXv1b9gkl2LUG2rJGiTAKRw9YDf3sssxNM7BI+ghYCqtpedW
hqFQrX3opNwVsQrXlDDxe4j3YhRe2R25OtGFgJtzhifP1Isr3k2GgkshQi7QI+o2
T3KMBpTCFuaVsY8i4N8fu1FQRVsnUoWtfRcZjAtZa4qmWLWndnvIFTVwBrnhqp7m
3qOynRYB2rQ06RPGM8y04ORW8g0KjYx22QX8mbPjku7PrBQE6y3oTWN3TbILqy3L
5KNVAoBIaDiZ4eAYi7Uol9CPqI8rvlyR5smazSizsFZDHx9FzEthtL9Q2doWyTWM
YGQKRpNjC85QY83etx4tuGkGNduxr6HeZxyhLGIePTiJixq8VNyKIy+YfqKuaBDK
tWJcm7kJoFexbqJJqrHTGe0dv23UwUJs9TyJAK5JMOUjG2CC5emc9menmcftyrzo
2yMTaSjXEYTZU9vqaDN/0+vzkszPPd71X1feJOB/blWV9WMeVq8gXK0kQfIAnZdq
kT4me9KGU80nbMbMLfqYg2HXuUxT2zpwA6smjsaOt0cde/drIReJVpBmWhz/qiPg
uKfCoS7wO5Eb+H9SOpPBoKFoskNufd3vvDCT0MNomEJTUsYMNf7GnrOuDsCzyc9V
FT6tHX3WxqfD8WEtHgQWdLqzDi6oEblQY5/uVhvifWmGb7WcMn7+6Iw56G4OVFmh
RJU1HohF+NJ+9+NNmjH7qYbxz5f6zqc87saY2iQBA4P+mfH7LbkHz+midozEyjhd
844g5CPoR/qIcPeEAVBG0rS9qptDpAvLDQcI+y28Ww5iiM5almxv3jQD/+SSNanI
w8lng+WehHcs53fBIqix/ObB39LzJDK9hC0OX4N/OZvcx5juMJm2AKmRpV0uMPBK
tQFaxXL52B4oqwBf+AW9QiD/2bAmT/dH2ccNrWvCGZ3v3+tAzc5MCPBvEj3OgD6y
qSEYCzXMo99RcRmst/EdlTXt761dShkwZkrruDj/8O260Pnhu4ln1TR1+q+SDyZ3
DdDA2z+k55rNq3SJT8JN0hDDOyNLvCYJLeLKt35QILpuUYZFCS/4xPzYDno6U3fP
XbJnyjAs/6IWO4TBMFmOx4SIKnX8w9ACv8LCNyktYfLGBA59UtIe7nnXjudrwRZl
/anp2oOGiQfvbA43LAzI7qqrYNYE1fCUv3Pw98by60VmYnpeQVrbfvD9daQIbEw=
=dfp9
-----END PGP SIGNATURE-----