5

What makes DNSSEC immune to a MITM attack?

Why can't I sign a key for example.com and get this to a resolving nameserver or client before they can get it from the real source?

Improve this question
1
  • The integrity verification part will probably stop you from getting invalid data to the DNSSEC resolver.
    – nik
    Aug 2, 2009 at 3:19

2 Answers 2

Reset to default
7

MITM isn't impossible, it just requires a lot more effort. Due to the integrity verification process Keith and Nik pointed out, you'll have to spoof not just the target example.com domain, but also .com and . (once it gets signed). Which means that simple cache-poisoning will no longer work, you have to completely subvert the target's entire resolver stream.

It works like SSL in a lot of ways. The root domain has delegation-signer records that are used to verify that the child domain (.com in this case) resolver is really the correct resolver. This repeats for each child domain until you get to a hostname. The actual verification process works in reverse, in it goes up the tree until it gets to an unsigned level and verifies from there. DNS attackers will have to fake the entire resolver tree up to the signed root (be that .com or .) in order to succeed. This is why getting DNS-root signed is such a big deal.

A lot of how DNSSEC improves security is by making it a lot harder to feed bad data into resolver caches and improve resistance to playing games with the DNS transaction process between clients and legitimate resolvers. A fully compromised DNS server will still return bad data even if it is using DNSSEC, and an in-line proxy rewriting DNS requests on the wire would have to fake every single DNS request not just the intended ones, but that's a harder problem to solve in general; as well as harder to get into place in the first place.

Improve this answer
5
  • So if you control the recursive server for a non-recursive client (and many clients aren't) then you can spoof? I guess you need to trust the server you rely on for your recursive look ups.
    – David Pashley
    Aug 2, 2009 at 7:58
  • @david That's about right. Though it looks like Windows 7 will have DNSSEC stuff in it, so even that'll take some jiggery pokery to make work (for Windows anyway).
    – sysadmin1138 ♦
    Aug 2, 2009 at 16:18
  • 1
    to clarify, MITM is almost impossible, and certainly impractical with current computers and cracking algorithms. Strictly speaking DNSSEC is "end-to-end" only if the client end does its own validation.
    – Alnitak
    Aug 2, 2009 at 19:54
  • why is it harder to fake the whole tree though?
    – Bill Gray
    Aug 2, 2009 at 23:34
  • Just came across the question, and this answer is quite misleading. MITM is not possible with DNSSEC because DNSEEC-enabled recursive resolvers already have pre-shared trust anchor for root zone. All the rest descends from root and is signed-by-key-which-in-turn-signed-by-key-which-in-turn-signed-by-key-which-signed-by-ROOT, thus attacker can't inject any untrusted data. The only practical ways to circumvent DNSSEC is to compromise DNS servers or stole private keys. (Breaking RSA keys doesn't count as practical).
    – Sandman4
    May 24, 2012 at 15:23
4

This article explains it a bit. A quick snippit: What is DNSSEC?

  • DNSSEC is a proposed Internet standard that modifies DNS resource records and protocols to provide security for query and response transactions made between domain name resolvers and nameservers. Specifically, the security DNSSEC provides includes:

  • Integrity verification: a DNS resolver can determine that information received from a nameserver has not been tampered with in transit Source authentication: a DNS resolver can determine that the information received originated from an authoritative nameserver

  • Authenticated denial of existence: a DNS resolver can verify that a particular query is unresolvable because no DNS record actually exists on the authoritative nameserver

Improve this answer
9
  • I've read up on it, but still don't see why a MITM attack is not possible.
    – Bill Gray
    Aug 2, 2009 at 4:11
  • Nothing is impossible, but (despite your previous assertions) cracking 1024 bit+ RSA keys is very, very, very difficult. That's what it takes to perform a MITM attack.
    – Alnitak
    Aug 2, 2009 at 21:41
  • Cracking 1024 bit keys has been shown not to be that hard. It is probably partly why the keys have a 30 day lifetime. My question is, why do you even have to crack the keys? Why can't I just pass fake keys for all keys?
    – Bill Gray
    Aug 3, 2009 at 6:36
  • because the signature for each key is stored in the parent zone (DS record). And the root zone's key is downloaded offline (out of band) and pre-configured in your DNS server.
    – Alnitak
    Aug 3, 2009 at 10:49
  • 3
    DNSSEC relies on bootstrapping an initial trust-anchor (ideally that for the root when it's signed later this year). That's the only weak point at which a fake key might be believed, hence why the distribution systems for that rely on out-of-band mechanisms and PGP, etc.
    – Alnitak
    Aug 4, 2009 at 16:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .