Re: [dnsext] MAR proposal #1: Algorithm downgrade protection

[Brian Dickson <[e-mail]>]

I think there is one specific place, where (a) there is value in stricter
checking, where (b) the cost of doing so is reasonably low, and where (c)
that however low the risk may be, the risk-cost-value equation (low risk,
low cost, high value) favors the SHOULD level of "check all known
algorithms, and check for the presence of signatures which match algorithms,
in the DS RRSET.

That place is, signatures on both the apex DNSKEY RRSET and the
corresponding DS RRSET. (I.e., the SEP to the KSK).

However unlikely it is that an RRSIG for a RRSET could be forged, the
consequences of such a forged signature for a substituted "stripped down"
DNSKEY RRSET and/or DS RRSET (which, instead of a robust set of DNSKEY
algorithms, contains just one algorithm, for which the key has been
compromised or for which a new key has been installed) are significant.

The impact would be that, in that cache, every other algorithm and every
signature on every RRSET in the zone would then be BAD, since the algorithms
would not be found, and the RRSIGs would fail to validate (either for bad
signature, or lack of chain of trust back to the root or any trust anchor).
The resolver would then attempt to retrieve valid answers by querying the
forger's server, for everything in the zone.

The attacker would thus be able ensure the downgrade attack would succeed on
the entire zone, and in all likelihood the downgrade would not generally
risk detection (i.e. that the bulk of operators of validating resolvers
would either not recognize that there is a problem, or not understand what
the problem is). Depending on local policy and implementer's choices, it is
possible that no warnings or errors would even be generated.

Any cached data (i.e. from the "good" authority server, vs the forger) would
be either tossed, or be moved to the BAD cache and have a new (short) TTL
applied, and would not be returned to the client except when CD=0, and would
fail to validate anyway (where FAIL == BOGUS).

On the other hand, whenever there is more than one algorithm, and DS/DNSKEY
checking is stronger than "any algorithm, any signature", the requirements
on an attacker are to either look for a weaker spot (individual
other-RRtypes), dedicate a lot more resources, or just give up. If more than
one algorithm needs to be defeated, the risk of any single algorithm being
*the* problem goes away. The attack window on "regular" RRSIGs in a zone
will tend to be much smaller (due to lower TTLs and re-signing, and easy key
rollover within any given algorithm), and the duration of the results of a
successful attack correspondingly small, which also works against a
potential attacker. This is presuming the ZSKs are rolled reasonably
frequently - an action which invalidates cached RRSIGs signed by the
previous ZSKs, i.e. for any given algorithm.

I can't comment on the likelihood that weaknesses in two or more algorithms
being found and exploited within a given time window, but I suspect it's
rather low.

And having multiple signatures (which multiple algorithms necessarily
implies) all needing to validate, makes possible the separation of
key-holders, avoiding single-point-of-exploitation on the signing side, as
well. Specifically, key separation for the KSK (the real high-value target).

Brian

P.S. I know we're talking about extraordinarily low probabilities to start
with, in terms of being able to "get lucky" in doing a brute force attack.
However, there is benefit in terms of the social engineering side, if key
separation for even low-value keys becomes commonplace. In both cases, there
is benefit at reasonably low costs to both authority  operators and
validator operators. SEPs are everything in DNSSEC, and thus, SEPs need
pretty strong protection.

On Sat, Apr 2, 2011 at 2:37 AM, Paul Hoffman <[e-mail]> wrote:

> On Apr 1, 2011, at 4:24 PM, Samuel Weiler wrote:
>
> > This is a proposed change in DNSSECbis that arguably changes the
> mandatory algorithm rules.  I'm posting this as a summary of what I
> understand some may support, I don't support this change myself. Please post
> in this thread with your support or lack thereof.
> >
> >
> > In order to provide some protection against algorithm downgrade[1], we're
> defining a mechanism for zone signers to signal to validators that a SET of
> algorithms should ALL be checked, when possible, before determining that an
> answer from the zone is Secure.  Specifically, we're overloading the DS
> RRset to do that signalling.
> >
> > Validators SHOULD check signatures from all algorithms present in a
> zone's DS RRset or trust anchors before declaring an answer from the zone to
> be Secure.  If it is impossible to validate an answer with one or more of
> those algorithms, the answer SHOULD be treated as Bogus.
> >
> > This is a subset of the checks unbound was performing that let to the
> discovery of the problems with .cz's algorithm roll process.
> >
> > Please post in this thread with your support or objections.
>
> I do not support this change. It makes DNSSEC validation both more mushy
> and more brittle by having zones "signal" to relying parties what the zone
> wants the relying parties to do. It is more mushy because a clearer
> statement can be made: just sign with the algorithms you want. It makes it
> more brittle because now there are more ways to make a zone accidentally go
> bogus.
>
> --Paul Hoffman
>
> _______________________________________________
> dnsext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsext
>