Re: [secdir] Security review of draft-ietf-dnsop-onion-tld-00.txt

["Christian Huitema" <[e-mail]>]

On Tuesday, September 1, 2015 6:59 AM, Christian Huitema wrote:
> 
> On Tuesday, September 1, 2015 4:37 AM, Kathleen Moriarty wrote:
> >
> > I still have the outstanding question on security properties that may be
> buried
> > in this thread.
> 
> The question was, how could malicious DNS agents trick TOR clients into
> disclosing their presence. The recent exchange with Mark was about such
> agents passively listening for clients' mistakes. Is there a way to
actively
> trigger such mistakes?
> 
> Such attacks would require actively sending information to clients, such
as "if
> you have a request for example.onion, send it to me." The way to do that
in
> the DNS is through NS records. Malicious agents could send an NS record
for
> ".onion" as additional record in a response, asking resolvers to send them
such
> traffic. This might trick legacy clients. Maybe.

Thinking about this a bit more -- this is the general problem of cache
poisoning. The additional section could also include A or AAAA records for
.onion domains. This could fool a caching resolver -- receive a request for
a name, check first if there is an exact match in the cache, and only
attempt to forward the request if there is no hit in the cache. The checks
in the draft are only considering request forwarding, not cache operation.

What about adding this text to cover the malicious server attack -- coming
after the paragraph on leaks by the legacy clients:
>>>
Malicious DNS agents could insert records for ".onion" names in the
additional section of DNS responses, with the intent of poisoning the cache
of DNS resolvers. These resolvers could then be tricked into serving the
record from their cache, bypassing the checks described in section 2. To
mitigate such attacks, it is important that caching resolvers prevent the
insertion in their caches of records for ".onion" names.
<<<
You may actually want to add part of that text in section 2.

-- Christian Huitema