3 ms·

Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?

moviuro 8y ago
Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes). So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).
- floatingatoll 8y ago
  Is there a CAA equivalent for ARIN assignments?
  - Operyl 8y ago
    I assume you’re looking for: https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38
    - floatingatoll 8y ago
      Nope, that’s not what I’m looking for at all.
  - devicenull 8y ago
    RPKI, but it's barely used
    - floatingatoll 8y ago
      Nope, that does not cover certificate issuance for IP addresses in that range.
    - vbernat 8y ago
      This is currently used to sign ROA. A rogue actor can easily work around that by including the original AS in the AS path of the announce.
  - otterlicious 8y ago
    Not yet. :-( https://tools.ietf.org/html/draft-shoemaker-caa-ip-01 https://tools.ietf.org/html/draft-shoemaker-caa-ip-01
    - floatingatoll 8y ago
      Thank you for pointing this out. This is exactly what I’d hoped might exist someday.
- Operyl 8y ago
  Doesn’t LE use their own resolvers? EDIT: https://community.letsencrypt.org/t/where-does-letsencrypt-resolve-dns-from/37607/2 https://community.letsencrypt.org/t/where-does-letsencrypt-r...
bluejekyll 8y ago
They use a named certificate, validated against the standard CAs. Unless the hijackers were able to get a certificate with the name 'cloudflare-dns.com.' then the TLS session would fail. https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ https://developers.cloudflare.com/1.1.1.1/dns-over-tls/
- deleted 8y ago
  [deleted]
jedisct1 8y ago
For dnscrypt-proxy, definitely not. In addition to a signature of the parent cert, the DNS stamp for Cloudflare DNS says that validation must be done against dns.cloudflare.com so this would require getting a certificate for cloudflare.com.

moviuro 8y ago

Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes). So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).

floatingatoll 8y ago
Is there a CAA equivalent for ARIN assignments?
- Operyl 8y ago
  I assume you’re looking for: https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38
  - floatingatoll 8y ago
    Nope, that’s not what I’m looking for at all.
- devicenull 8y ago
  RPKI, but it's barely used
  - floatingatoll 8y ago
    Nope, that does not cover certificate issuance for IP addresses in that range.
  - vbernat 8y ago
    This is currently used to sign ROA. A rogue actor can easily work around that by including the original AS in the AS path of the announce.
- otterlicious 8y ago
  Not yet. :-( https://tools.ietf.org/html/draft-shoemaker-caa-ip-01 https://tools.ietf.org/html/draft-shoemaker-caa-ip-01
  - floatingatoll 8y ago
    Thank you for pointing this out. This is exactly what I’d hoped might exist someday.
Operyl 8y ago
Doesn’t LE use their own resolvers? EDIT: https://community.letsencrypt.org/t/where-does-letsencrypt-resolve-dns-from/37607/2 https://community.letsencrypt.org/t/where-does-letsencrypt-r...

bluejekyll 8y ago

They use a named certificate, validated against the standard CAs. Unless the hijackers were able to get a certificate with the name 'cloudflare-dns.com.' then the TLS session would fail. https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ https://developers.cloudflare.com/1.1.1.1/dns-over-tls/

deleted 8y ago
[deleted]

jedisct1 8y ago

For dnscrypt-proxy, definitely not. In addition to a signature of the parent cert, the DNS stamp for Cloudflare DNS says that validation must be done against dns.cloudflare.com so this would require getting a certificate for cloudflare.com.