International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

A Security Evaluation of DNSSEC with NSEC3

Authors:
Jason Bau
John C Mitchell
Download:
URL: http://eprint.iacr.org/2010/115
Search ePrint
Search Google
Abstract: Domain Name System Security Extensions (DNSSEC) and Hashed Authenticated Denial of Existence (NSEC3) are slated for adoption by important parts of the DNS hierarchy, including the root zone, as a solution to vulnerabilities such as ”cache-poisoning” attacks. We study the security goals and operation of DNSSEC/NSEC3 using Murphi, a finite-state enumeration tool, to analyze security properties that may be relevant to various deployment scenarios. Our systematic study reveals several subtleties and potential pitfalls that can be avoided by proper configuration choices, including resource records that may remain valid after the expiration of relevant signatures and potential insertion of forged names into a DNSSEC-enabled domain via the opt-out option. We demonstrate the exploitability of DNSSEC opt-out options in an enterprise setting by constructing a browser cookie-stealing attack on a laboratory domain. Under recommended configuration settings, further Murphi model checking finds no vulnerabilities within our threat model, suggesting that DNSSEC with NSEC3 provides significant security benefits.
BibTeX
@misc{eprint-2010-23016,
  title={A Security Evaluation of DNSSEC with NSEC3},
  booktitle={IACR Eprint archive},
  keywords={applications / Domain Name System (DNS)},
  url={http://eprint.iacr.org/2010/115},
  note={Revised and corrected version of conference paper in Network and Distributed Systems Security (NDSS) 2010 mitchell@cs.stanford.edu 14670 received 2 Mar 2010},
  author={Jason Bau and John C Mitchell},
  year=2010
}