{"id":1607,"date":"2016-02-19T10:42:51","date_gmt":"2016-02-19T09:42:51","guid":{"rendered":"http:\/\/blog.benny-baumann.de\/?p=1607"},"modified":"2016-02-19T09:21:10","modified_gmt":"2016-02-19T08:21:10","slug":"trust-delegation-with-caa-dns-rr","status":"publish","type":"post","link":"https:\/\/blog.benny-baumann.de\/?p=1607","title":{"rendered":"Trust Delegation with CAA DNS RR"},"content":{"rendered":"<p>Every security technology needs a certain deployment base in order to be effective. With many other security measures already at our disposal restricting the set of Certificate Authorities that may issue a X.509 certificate for a given domain is just another step. The standard for doing so, is RFC&nbsp;6844 specifying the <a href=\"https:\/\/tools.ietf.org\/html\/rfc6844\">DNS Certificate Authority Authorization (CAA) Resource Record<\/a>. Specifying a special DNS RR it allows any complying CA to check, if the owner of the domain (actually: The one in control of the DNS) wishes any given CA to issue certificates for this domain.<\/p>\n<p>Given the CAA DNS RR is quite new, the question arose, <a href=\"https:\/\/twitter.com\/Cryptoki\/status\/700299270407221248\">if there are any deployments<\/a> yet.<br \/>\n<!--more--><\/p>\n<p>Given that, unlike for IPv4, there is no easily searchable address space for domain names, the matter was a bit more complicated, than one might think at first. Also not having a comprehensive list of more than the <a href=\"http:\/\/s3.amazonaws.com\/alexa-static\/top-1m.csv.zip\">Alexa Top 1M websites<\/a> at hand, that ought to do as a rough approximation of the question.<\/p>\n<p>Another approach tried was using the oldy-but-goody <a href=\"https:\/\/dnscurve.org\/nsec3walker.html\">NSEC3Walker<\/a>, with the quite ovious downside, that enumerating the zones to yield a list of domain names takes quite some time &#8211; and thus it only has been attempted for the .fail domain so far.<\/p>\n<p>Which brings us to the first observation: The .fail domain, being one of the newGTLD, doesn&#8217;t really look like it was actively used for DNSSEC, thus for the domains that use DNSSEC (49 according to my scan) we get only 4 using CAA DNS RR: all of which are mine. While this percentage of about 8.2% might look promising, it is most likely incidental due to the small number of domains covered:<\/p>\n<pre>\r\ncrypto.fail.\t\t3600\tIN\tTYPE257\t\\# 31 0005696F6465666D61696C746F3A62656E62653139383740676D782E 6E6574\r\ncrypto.fail.\t\t3600\tIN\tTYPE257\t\\# 49 000569737375656361636572742E6F72673B206163636F756E743D31 32323334323B20726F6F743D67312D636C61737333\r\ncrypto.fail.\t\t3600\tIN\tTYPE257\t\\# 53 0009697373756577696C646361636572742E6F72673B206163636F75 6E743D3132323334323B20726F6F743D67312D636C61737333\r\nopenpgp.fail.\t\t3600\tIN\tTYPE257\t\\# 31 0005696F6465666D61696C746F3A62656E62653139383740676D782E 6E6574\r\nopenpgp.fail.\t\t3600\tIN\tTYPE257\t\\# 49 000569737375656361636572742E6F72673B206163636F756E743D31 32323334323B20726F6F743D67312D636C61737333\r\nopenpgp.fail.\t\t3600\tIN\tTYPE257\t\\# 53 0009697373756577696C646361636572742E6F72673B206163636F75 6E743D3132323334323B20726F6F743D67312D636C61737333\r\nsecurity.fail.\t\t3600\tIN\tTYPE257\t\\# 31 0005696F6465666D61696C746F3A62656E62653139383740676D782E 6E6574\r\nsecurity.fail.\t\t3600\tIN\tTYPE257\t\\# 49 000569737375656361636572742E6F72673B206163636F756E743D31 32323334323B20726F6F743D67312D636C61737333\r\nsecurity.fail.\t\t3600\tIN\tTYPE257\t\\# 53 0009697373756577696C646361636572742E6F72673B206163636F75 6E743D3132323334323B20726F6F743D67312D636C61737333\r\nx509.fail.\t\t3600\tIN\tTYPE257\t\\# 49 000569737375656361636572742E6F72673B206163636F756E743D31 32323334323B20726F6F743D67312D636C61737333\r\nx509.fail.\t\t3600\tIN\tTYPE257\t\\# 31 0005696F6465666D61696C746F3A62656E62653139383740676D782E 6E6574\r\nx509.fail.\t\t3600\tIN\tTYPE257\t\\# 53 0009697373756577696C646361636572742E6F72673B206163636F75 6E743D3132323334323B20726F6F743D67312D636C61737333\r\n<\/pre>\n<p>All 4 domains have DNSSEC, TLSA (DANE) and CAA records, with both TLSA and CAA designating <a href=\"https:\/\/www.cacert.org\/\">CAcert<\/a> as the CA to be used to issue certificates (incidentially the same CA this blog uses too).<\/p>\n<p>Which brings us back to the initial attempt to query domains given a set of previously known domain names. Downloading and extracting the Alexa Top 1M is straight forward and asking for the actual records can be automated with just one line of bash:<\/p>\n<pre lang=\"bash\">cat top-1m.csv | cut -d, -f2 | parallel -j16 dig +nocmd +noadditional +noauthority +noquestion TYPE257 | grep --line-buffered -v \\; | grep --line-buffered TYPE257 | tee top-1m.caa.txt \r\n<\/pre>\n<p>Looking at the results as they arrive we&#8217;ll find the following output:<\/p>\n<pre>google.com.\t\t85980\tIN\tTYPE257\t\\# 19 0005697373756573796D616E7465632E636F6D\r\nsymantec.com.\t\t1502\tIN\tTYPE257\t\\# 19 0005697373756573796D616E7465632E636F6D\r\nopera.com.\t\t3600\tIN\tTYPE257\t\\# 34 0005696F6465666D61696C746F3A686F73746D6173746572406F7065 72612E636F6D\r\nopera.com.\t\t3600\tIN\tTYPE257\t\\# 19 0005697373756564696769636572742E636F6D\r\nopera.com.\t\t3600\tIN\tTYPE257\t\\# 23 0009697373756577696C6464696769636572742E636F6D\r\ncomodo.com.\t\t1200\tIN\tTYPE257\t\\# 19 00056973737565636F6D6F646F63612E636F6D\r\ncomodo.com.\t\t1200\tIN\tTYPE257\t\\# 35 0005696F6465666D61696C746F3A73736C616275736540636F6D6F64 6F63612E636F6D\r\nfu-berlin.de.\t\t86400\tIN\tTYPE257\t\\# 38 0005696F6465666D61696C746F3A6365727469666963617465406675 2D6265726C696E2E6465\r\nfu-berlin.de.\t\t86400\tIN\tTYPE257\t\\# 17 00056973737565706B692E64666E2E6465\r\ninstantssl.com.\t\t1200\tIN\tTYPE257\t\\# 19 00056973737565636F6D6F646F63612E636F6D\r\ninstantssl.com.\t\t1200\tIN\tTYPE257\t\\# 35 0005696F6465666D61696C746F3A73736C616275736540636F6D6F64 6F63612E636F6D\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 19 00056973737565737461727473736C2E636F6D\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 18 00056973737565642D74727573742E6E6574\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 19 0005697373756567656F74727573742E636F6D\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 23 0009697373756577696C64737461727473736C2E636F6D\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 23 0009697373756577696C6467656F74727573742E636F6D\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 22 0009697373756577696C64642D74727573742E6E6574\r\nposteo.de.\t\t1800\tIN\tTYPE257\t\\# 34 0005696F6465666D61696C746F3A686F73746D617374657240706F73 74656F2E6465\r\nlets-fish.com.\t\t86400\tIN\tTYPE257\t\\# 36 0005696F6465666D61696C746F3A61646D4074656E73717561726567 616D65732E636F6D\r\nlets-fish.com.\t\t86400\tIN\tTYPE257\t\\# 23 8009697373756577696C64737461727473736C2E636F6D\r\nlets-fish.com.\t\t86400\tIN\tTYPE257\t\\# 19 80056973737565737461727473736C2E636F6D\r\ndefcon.org.\t\t86400\tIN\tTYPE257\t\\# 19 0005697373756564696769636572742E636F6D\r\nentrust.net.\t\t7200\tIN\tTYPE257\t\\# 21 0005697373756563612E656E74727573742E6E6574\r\nlets-hunt.com.\t\t86400\tIN\tTYPE257\t\\# 36 0005696F6465666D61696C746F3A61646D4074656E73717561726567 616D65732E636F6D\r\nlets-hunt.com.\t\t86400\tIN\tTYPE257\t\\# 19 80056973737565737461727473736C2E636F6D\r\nlets-hunt.com.\t\t86400\tIN\tTYPE257\t\\# 23 8009697373756577696C64737461727473736C2E636F6D\r\ndevever.net.\t\t300\tIN\tTYPE257\t\\# 22 000569737375656C657473656E63727970742E6F7267\r\ntensquaregames.com.\t86400\tIN\tTYPE257\t\\# 19 80056973737565737461727473736C2E636F6D\r\ntensquaregames.com.\t86400\tIN\tTYPE257\t\\# 23 8009697373756577696C64737461727473736C2E636F6D\r\ntensquaregames.com.\t86400\tIN\tTYPE257\t\\# 36 0005696F6465666D61696C746F3A61646D4074656E73717561726567 616D65732E636F6D\r\nmelenky.ru.\t\t900\tIN\tTYPE257\t\\# 19 00056973737565737461727473736C2E636F6D\r\nbgbm.org.\t\t86400\tIN\tTYPE257\t\\# 38 0005696F6465666D61696C746F3A6365727469666963617465406675 2D6265726C696E2E6465\r\nbgbm.org.\t\t86400\tIN\tTYPE257\t\\# 17 00056973737565706B692E64666E2E6465\r\nmushroom-hunt.com.\t86400\tIN\tTYPE257\t\\# 36 0005696F6465666D61696C746F3A61646D4074656E73717561726567 616D65732E636F6D\r\nmushroom-hunt.com.\t86400\tIN\tTYPE257\t\\# 19 80056973737565737461727473736C2E636F6D\r\nmushroom-hunt.com.\t86400\tIN\tTYPE257\t\\# 23 8009697373756577696C64737461727473736C2E636F6D\r\nseas.sk.\t\t28800\tIN\tTYPE257\t\\# 12 0009697373756577696C643B\r\nseas.sk.\t\t28800\tIN\tTYPE257\t\\# 32 0005696F6465666D61696C746F3A686F73746D617374657240736561 732E736B\r\nseas.sk.\t\t28800\tIN\tTYPE257\t\\# 19 0005697373756567656F74727573742E636F6D\r\n<\/pre>\n<p>Which boils down to the following groups of domains:<\/p>\n<ul>\n<li>Certificate Authorities (CAs):\n<ul>\n<li>google.com<\/li>\n<li>symantec.com<\/li>\n<li>comodo.com<\/li>\n<li>instantssl.com<\/li>\n<li>entrust.net<\/li>\n<\/ul>\n<\/li>\n<li>Browsers:\n<ul>\n<li>opera.com<\/li>\n<\/ul>\n<\/li>\n<li>Universities:\n<ul>\n<li>fu-berlin.de<\/li>\n<li>bgbm.org<\/li>\n<\/ul>\n<\/li>\n<li>Mail Providers:\n<ul>\n<li>posteo.de<\/li>\n<\/ul>\n<\/li>\n<li>Games:\n<ul>\n<li>tensquaregames.com<\/li>\n<li>lets-fish.com<\/li>\n<li>lets-hunt.com<\/li>\n<li>mushroom-hunt.com<\/li>\n<\/ul>\n<\/li>\n<li>Technology:\n<ul>\n<li>defcon.org<\/li>\n<li>devever.net<\/li>\n<\/ul>\n<\/li>\n<li>Geography:\n<ul>\n<li>melenky.ru<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>In case you wonder: I classify Google as a CA here, because <a href=\"https:\/\/pki.google.com\/\">they are<\/a> (apart from several other pet projects they maintain). But in the context of this research, the most reasonable cause for them to deploy probably is managing PKI themselves.<\/p>\n<p>Which brings us to some interesting point: While Google has it&#8217;s own PKI they allow Symantec Inc. to issue certificates for them. Having a closer look at the data above, we find the following properties used:<\/p>\n<ul>\n<li><strong>issue<\/strong>: Present for all 17 domains, posteo.de using 3 different ones. Specified CAs include:\n<ul>\n<li>Symantec: google.com, symantec.com<\/li>\n<li>DigiCert: opera.com, defcon.org<\/li>\n<li>Comodo: comodo.com, instantssl.com<\/li>\n<li>DFN Verein CA (German Research Network PKI): fu-berlin.de, bgbm.org<\/li>\n<li>StartCom: posteo.de, lets-fish.com, lets-hunt.com, tensquaregames.com, mushroom-hunt.com, melenky.ru<\/li>\n<li>D-Trust: posteo.de<\/li>\n<li>GeoTrust: posteo.de, seas.sk<\/li>\n<li>Entrust: entrust.net<\/li>\n<li>others: devever.net<\/li>\n<\/ul>\n<\/li>\n<li><strong>issuewild<\/strong>: Only present for 7 domains:\n<ul>\n<li>DigiCert: opera.com<\/li>\n<li>StartCom: posteo.de, lets-fish.com, lets-hunt.com, tensquaregames.com, mushroom-hunt.com<\/li>\n<li>D-Trust: posteo.de<\/li>\n<li>GeoTrust: posteo.de<\/li>\n<li>Denial of IssueWild: seas.sk<\/li>\n<\/ul>\n<\/li>\n<li><strong>iodef<\/strong>: Present for 11 domains and pointing either to some mailbox on that domain (with opera.com, posteo.com and seas.sk), some inherited collection address (with tensquaregames.com and its related lets-fish.com, lets-hunt.com and mushroom-hunt.com), or an abuse\/information mailbox at the CA (Comodo for comodo.com &amp; instantssl.com, and the DFN Verein CA for fu-berlin.de &amp; bgbm.org).<\/li>\n<\/ul>\n<p>No other or custom properties for CAA DNS RR are present for the Alexa set of domains.<\/p>\n<p>Cross-checking these results with deployment of DNSSEC yields that only 8 of the 17 domains discovered to use CAA DNS RR also use DNSSEC (i.e. have a DNSKEY present):<\/p>\n<ul>\n<li>defcon.org<\/li>\n<li>devever.net<\/li>\n<li>lets-fish.com<\/li>\n<li>lets-hunt.com<\/li>\n<li>melenky.ru<\/li>\n<li>mushroom-hunt.com<\/li>\n<li>posteo.de<\/li>\n<li>tensquaregames.com<\/li>\n<\/ul>\n<p>This quite low rate of DNSSEC among CAA DNS RR protected domains (47%) is kinda unexpected given that DNSSEC is usually the more powerful protection, while CAA is &#8211; by its very definition &#8211; only an optional band-aid for in-depth protection at issuance of a certificate.<\/p>\n<p>Yet given the very dim overall deployment of CAA DNS RR there&#8217;s not much lost due to this lack of other domain protections. Yet it is quite interesting nonetheless to see all major features of the RFC being used in real-world deployments so far.<\/p>\n<p class=\"wp-flattr-button\"><a href=\"https:\/\/blog.benny-baumann.de\/?flattrss_redirect&amp;id=1607&amp;md5=85985ff8bd901c5d9c887a4e59e011ce\" title=\"Flattr\" target=\"_blank\"><img src=\"http:\/\/blog.benny-baumann.de\/wp-content\/plugins\/flattr\/img\/flattr-badge-large.png\" srcset=\"http:\/\/blog.benny-baumann.de\/wp-content\/plugins\/flattr\/img\/flattr-badge-large.png\" alt=\"Flattr this!\"\/><\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Every security technology needs a certain deployment base in order to be effective. With many other security measures already at our disposal restricting the set of Certificate Authorities that may issue a X.509 certificate for a given domain is just another step. The standard for doing so, is RFC&nbsp;6844 specifying the DNS Certificate Authority Authorization [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[4],"tags":[48,69,50,349],"class_list":["post-1607","post","type-post","status-publish","format-standard","hentry","category-server","tag-dns","tag-internet","tag-ssl","tag-x-509"],"_links":{"self":[{"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/posts\/1607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1607"}],"version-history":[{"count":10,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/posts\/1607\/revisions"}],"predecessor-version":[{"id":1617,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=\/wp\/v2\/posts\/1607\/revisions\/1617"}],"wp:attachment":[{"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.benny-baumann.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}