NSEC5: Provably Preventing DNSSEC Zone Enumeration.

摘要: We use cryptographic techniques to study zone enumeration in DNSSEC. DNSSEC is designed prevent attackers from tampering with domain name system (DNS) messages. The machinery used DNSSEC, however, also creates a new vulnerability, enumeration, enabling an adversary small number of online queries combined offline dictionary attacks learn which names are present or absent DNS zone. prove that the current standard, NSEC and NSEC3 records, inherently suffers enumeration: specifically, we show security against (1) tamper messages (2) privacy cannot be satisfied simultaneously, unless nameserver performs public-key operations. then propose construction uses publickey cryptography solve problem enumeration. NSEC5 can thought as variant NSEC3, unkeyed hash function replaced deterministic RSA-based keyed hashing scheme. With NSEC5, remains protected network compromised nameservers even if secret NSEC5-hashing key compromised; leaking only harms effectively downgrading back standard (with NSEC3).