NSEC5: Provably Preventing DNSSEC Zone Enumeration

Abstract

We use cryptographic techniques to study zone enumeration in DNSSEC. DNSSEC is designed to prevent attackers from tampering with domain name system (DNS) messages. The cryptographic machinery used in DNSSEC, however, also creates a new vulnerability, zone enumeration, enabling an adversary to use a small number of online DNSSEC queries combined with offline dictionary attacks to learn which domain names are present or absent in a DNS zone. We prove that the current DNSSEC standard, with NSEC and NSEC3 records, inherently suffers from zone enumeration: specifically, we show that security against (1) attackers that tamper with DNS messages and (2) privacy against zone enumeration cannot be satisfied simultaneously, unless the DNSSEC nameserver performs online public-key cryptographic operations. We then propose a new construction that uses online publickey cryptography to solve the problem of DNSSEC zone enumeration. NSEC5 can be thought of as a variant of NSEC3, in which the unkeyed hash function is replaced with a deterministic RSA-based keyed hashing scheme. With NSEC5, a zone remains protected against network attackers and compromised nameservers even if the secret NSEC5-hashing key is compromised; leaking the NSEC5-hashing key only harms privacy against zone enumeration, effectively downgrading the security of NSEC5 back to that of the current DNSSEC standard (with NSEC3).

Primary-Secondary-Resolver Membership Proof Systems

“…In our companion paper [36], we prove two very important facts about non-interactive PSR systems. The first is that f -ZK, where f (R) is the cardinality of the set R, implies prevention of zone enumeration, i.e.…”

“…UOWHFs in turn can be constructed from one-way functions [68]. PSR systems imply identification schemes, as shown in our companion paper [36], which in turn imply the existence of one-way functions, as shown by Impagliazzo and Luby [45] (see also [44]). …”

“…In a companion paper to this work [36] the notion of PSR systems was introduced (albeit it was defined as a one-round proof protocol), as well as an efficient construction named NSEC5 was suggested. NSEC5 is based on RSA and analyzed in the random oracle model.…”

“…We consider PSR Systems that are more general than those of [36] and define PSR systems with interactive proofs as well as systems that are perfect zero-knowledge.…”

“…In order to construct the function F we use variants of Verifiable Random Functions (VRF) and Verifiable Unpredictable Functions (VUF) [55], the Naor-Reingold PRF [59] with zero knowledge interactive proofs, the GHR signature scheme [33] and a random oracle construction which uses the famous BLS signature scheme [18]. The scheme NSEC5 presented in [36] (which resides in the random oracle model) falls into this category as well.…”