1

A cryptographic Oracle is where one can deduce the private key when a error condition is created.

Considering the recent ASP.NET padding Oracle exploit, can anyone tell me if the DNSSec implementations have been protected from similar "Cryptographic Oracle" attacks?

1 Answer 1

4

Is this attack even relevant against DNSSEC?

An oracle in cryptography is a system that gives you hints as you ask questions. This works interactively to reveal the private key in the ASP.NET case. This asking and answering/hinting is done while the private key is online (which is necessary for SSL/TLS to work), so little by little the key is "exposed" as new questions/connections come to it.

DNSSEC was designed to work so that the private key could be kept completely offline (like it is for the root (".") servers), and all data is signed once and can be left alone. The ISC BIND DNS server (for example) uses flat text files to store its zone data, and all records (normal DNS records and the RRSIGs) are simply sent from this/these file/s.

There is no way for an attacker to send the BIND server queries that would make it query the private key for an answer (best practices state that the private key shouldn't even be stored on publicly accessible DNS servers). Every response to a DNS query is taken from static data, and so there is no oracle in the chain to get answers from and/or attack.

1
  • Thank you for explaining this! I was unaware the private key was offline. Oct 29, 2010 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .