ion sri lanka - dane: the future of tls
TRANSCRIPT
DANE: The Future of Transport Layer Security (TLS)
ION Sri LankaJanuary 18, 2015
Dan YorkSenior Content StrategistInternet [email protected]
TLS vs SSL
Secure Sockets Layer (SSL) originally developed by Netscape in the mid-1990s
"Transport Layer Security (TLS)" evolved from SSL 3.0, although "SSL" remains commonly used term
TLS version 1.3 in active development:
• https://tools.ietf.org/html/draft-ietf-tls-tls13
• https://github.com/tlswg/tls13-spec
1/18/2015
1996 SSL 3.0 RFC 6101
1999 TLS 1.0 RFC 2246
2006 TLS 1.1 RFC 4346
2008 TLS 1.2 RFC 5246
2014/15? TLS 1.3 draft-ietf-tls-tls13
TLS – Not Just For Web Sites
TLS / SSL originally developed for web sites
Now widely used for many other services, including:
• Instant messaging
• File transfer
• Virtual Private Networks (VPNs)
• Voice over IP (VoIP)
• Custom applications
What Does TLS Do?
• Creates an encrypted tunnel between two applications
• Protects from eavesdropping
• Can be used in client/server or peer-to-peer
• Uses TCP (DTLS uses UDP)
App 1 App 2
App 1 App 2
With TLS
Without TLS
TLS and Certificates
• How do you obtain the encryption keys?
• Typically uses PKIX / X.509 certificate
• Certificate signed by a Certificate Authority (CA)
• The client application initiating the connection checks the certificate:
• Does the certificate match the site/service being visited?
• Does the app trust the CA who signed the cert?
The Problem With Certificate Authorities
• There are too many of them!
• Apps like web browsers may “trust” 1,300 Cas
• Any CA can issue a certificate for any domain
• Attackers can trick a CA into issuing a certificate
• “Middleboxes” can issue certificates to intercept traffic
• Ex. Gogo inflight WiFi service
• Several different solutions being explored
A Quick Overview of DANE
1/18/2015
The Typical TLS (SSL) Web Interaction
Web
Server
Web
Browser
https://example.com/
TLS-encryptedweb page
DNS Resolver
example.com?
10.1.1.1231
2
5
6
DNS Svrexample.co
m
DNS Svr
.com
DNS Svr
root
3
10.1.1.123
4
The Typical TLS (SSL) Web Interaction
Web
Server
Web
Browser
https://example.com/
TLS-encryptedweb page
DNS Resolver
10.1.1.1231
2
5
6
DNS Svrexample.co
m
DNS Svr
.com
DNS Svr
root
3
10.1.1.123
4
Is this encrypted
with the
CORRECT
certificate?
example.com?
Problems?
Web
Server
Web
Browser
https://www.example.com/TLS-encrypted web pagewith CORRECT certificate
DNS
Server
www.example.com?
1.2.3.41
2
Firewall
https://www.example.com/
TLS-encrypted web pagewith NEW certificate(re-signed by firewall)
DANE
Web
Server
Web
Browserw/DANE
https://example.com/TLS-encrypted web pagewith CORRECT certificate
DNS
Server
10.1.1.123DNSKEYRRSIGsTLSA
1
2Firewall(or
attacker)
https://example.com/
TLS-encrypted web pagewith NEW certificate(re-signed by firewall)
Log
files or
other
serversDANE-equipped browsercompares TLS certificatewith what DNS / DNSSECsays it should be.
example.com?
DNS-Based Authentication of Named Entities (DANE)
• Q: How do you know if the TLS (SSL) certificate is the
correct one the site wants you to use?
• A: Store the certificate (or fingerprint) in DNS (new TLSA
record) and sign them with DNSSEC.
An application that understand DNSSEC and DANE will
then know when the required certificate is NOT being used.
Certificate stored in DNS is controlled by the domain name
holder. It could be a certificate signed by a CA – or a self-
signed certificate.
DANE – Different operation modes ("certificate usage" field)
• 0 – CA specification• The TLSA record specifies the Certificate Authority (CA) who will provide TLS
certificates for the domain. Must be a valid CA included in browser/app.
• 1 – Specific TLS certificate• The TLSA record specifies the exact TLS certificate that should be used for the
domain. Note that this TLS certificate must be one that is issued by a valid CA.
• 2 – Trust anchor assertion• The TLSA record specifies the “trust anchor” to be used for validating the TLS
certificates for the domain. Allows for the use of a CA not included in application.
• 3 – Domain-issued certificate (“End-Entity Certificate”)• The TLS record specifies the exact TLS certificate that should be used for the
domain, BUT, in contrast to usage #1, the TLS certificate does not need to be signed by a valid CA. This allows for the use of self-signed certificates.
DANE – Not Just For The Web
• DANE defines protocol for storing TLS certificates in DNS
• Securing Web transactions is an obvious use case
• Other uses also possible:
• VoIP
• Jabber/XMPP
• PGP
• ?
DANE Success Stories
SMTP
360+ SMTP servers with TLSA records
http://www.tlsa.info/ - testing service
XMPP (Jabber)
255 servers
client-to-server & server-to-server
https://xmpp.net/reports.php#dnssecdane
Advertisements!
3 Steps To Use DANE On Your Server / Service
1. Use TLS on your application/service!
2. Generate and publish a TLSA record in DNS
Separate TLSA record for each specific service. For example:
– _25._tcp.example.com.
– _443._tcp.example.com.
Tools available (ex. hashslinger) to help generate records
3. Sign your domain with DNSSEC
2 Steps To Use DANE In Your Client Application
1. Have access to a DNSSEC-validating DNS resolver
Security of DANE relies on DNSSEC validation
DNSSEC validation can be easily enabled on BIND, Unbound or Windows Server
Some developers have performed validation within actual application
2. Use a DNS application library that supports DNSSEC
GetDNS API – http://getdnsapi.net/ - C, python, node.js and java
http://www.internetsociety.org/deploy360/resources/dnssec-developer-libraries/
DANE Resources
DANE Overview and Resources:
• http://www.internetsociety.org/deploy360/resources/dane/
IETF Journal article explaining DANE:
• http://bit.ly/dane-dnssec
RFC 6394 - DANE Use Cases:
• http://tools.ietf.org/html/rfc6394
RFC 6698 – DANE Protocol:
• http://tools.ietf.org/html/rfc6698
DANE Resources
DANE and email:
• https://tools.ietf.org/html/draft-ietf-dane-smtp-with-dane
• http://tools.ietf.org/html/draft-ietf-dane-smime
DANE Operational Guidance:
• https://tools.ietf.org/html/draft-ietf-dane-ops
DANE and SIP (VoIP):
• http://tools.ietf.org/html/draft-johansson-dispatch-dane-sip
• https://tools.ietf.org/html/draft-ietf-dane-srv
Other uses:
• https://tools.ietf.org/html/draft-ietf-dane-openpgpkey
• https://tools.ietf.org/html/draft-ietf-dane-rawkeys
Why Deploy DNSSEC and DANE?
1/18/2015
Reasons For Deploying DNSSEC/DANE
• TRUST – You can be sure your customers are reaching your sites – and that you are communicating with their servers.
• SECURITY – You can be sure you are communicating with the correct sites and not sharing business information with attackers, ex. email hijacking.
• INNOVATION – Services such as DANE built on top of DNSSEC enable innovative uses of TLS certificates
• CONFIDENTIALITY – DANE enables easier use of encryption for applications and services that communicate across the Internet
Email Hijacking – A Current Threat
• CERT-CC researchers have identified that someone is hijacking email by using DNS cache poisoning of MX records
• Could be prevented by DNSSEC deployment
• CERT-CC (Sept 10, 2014):
– https://www.cert.org/blogs/certcc/post.cfm?EntryID=206
• Deploy360 blog post (Sept 12, 2014):
• http://wp.me/p4eijv-5jI
Resources
1/18/2015
Start Here Pagehttp://www.internetsociety.org/deploy360/start/
Easy method of finding resources for
specific audiences, including:
• Network operators
• Content providers (ex. web site
owners)
• Developers
• Governments
• Consumer electronics vendors
• Enterprises and campus networks
• Registrars
• Internet exchange points (IXPs)
The Two Parts of DNSSEC
Signing Validating
ISPs
Enterprises
Applications
DNS Hosting
Registrars
Registries
DNSSEC Signing - The Individual Steps
Registry
Registrar
DNS Hosting Provider
Domain Name Registrant
• Signs TLD
• Accepts DS records
• Publishes/signs records
• Accepts DS records
• Sends DS to registry
• Provides UI for mgmt
• Signs zones
• Publishes all records
• Provides UI for mgmt
• Enables DNSSEC
(unless automatic)
DNSSEC Deployment Maps
• DNSSEC deployment maps:
• http://www.internetsociety.org/deploy360/dnssec/maps/
• Mailing list to receive weekly maps:
• https://elists.isoc.org/mailman/listinfo/dnssec-maps
DNSSEC Deployment Maps – Asia Pacific
https://twitter.com/deploy360
https://www.facebook.com/Deploy360
http://gplus.to/deploy360
http://www.youtube.com/user/Deploy360
http://www.internetsociety.org/deploy360/feed/
http://soundcloud.com/deploy360/
Social Media Channels
