Internet Resilience in France 2015 Document produced by the ANSSI with the participation of the Afnic. Researched and written by: François Contat, Pierre Lorinquer, Florian Maury, Julie Rossi, Maxence Tury, Guillaume Valadon and Nicolas Vivet. The editorial team would like to thank the observatory members and the reviewers for enriching this report with their comments and remarks. Document formatted using LATEX. Figures produced with TikZ and PGFPlots. Please send any comments or remarks to the following address: [email protected] Table of contents Executive Summary 5 Presentation of the Observatory 7 Introduction 9 1 Resilience in Terms of the BGP Protocol 11 1.1 Introduction 11 1.2 Prefixes Hijacks 15 1.3 The Use of Route Objects 19 1.4 Declarations in the RPKI 22 2 Resilience in terms of the DNS protocol 25 2.1 Introduction 25 2.2 Dispersion of authoritative DNS servers 30 2.3 Implementing DNSSEC 34 2.4 Dispersion of inbound e-mail relays 36 3 Resilience in terms of the TLS protocol 43 3.1 Introduction 43 3.2 Session Negotiation 46 3.3 Robustness of Certificate Signatures 50 General Conclusion 53 Bibliography 55 Acronyms 59 Internet Resilience in France - 2015 3 Executive Summary Since 2011, the Internet Resilience Observatory in France has studied the technologies that are critical for the proper operation of the Internet in France. In order to understand the dependence of the French economy and society on those of other countries, the Observatory focuses on the French Internet, a subset of the Internet in France that does not take into account foreign players. Resilience is defined as the ability to operate during an incident and return to the nom- inal state. It can be characterized by measurable indicators, some of which come directly from engineering rules called best practices. Written by ANSSI1, this report analyzes resilience through the BGP2, DNS3 and TLS4 protocols. The first two are used respectively to carry data using routing advertisements, and provide the mapping between a domain name and an IP address. The third is in particular used to encrypt communications between a web server and its clients. In 2015, the Observatory identified that the recommended TLS version 1.2 is supported by 75 % of web servers for delegated zones under the .fr TLD5. Regarding IPv6, the trends initiated in previous years are continuing, indicating that best practices in operating this protocol seem to be followed by few. To allow the reproduction of a part of the results, the main tools used for the BGP analyses have been published [1, 2]. The Observatory encourages all Internet players to appropriate the best engineering practices accepted for BGP [3], DNS [4], and TLS, and to anticipate the threat of DDoS [5]. In addition, the Observatory makes the following recommendations: • monitor prefix advertisements, and be prepared to react in case of BGP hijacks; • use algorithms supporting forward secrecy and abandon SSLv2 and SHA-1 in favor of more robust mechanisms; • diversify the number of SMTP and DNS servers in order to improve the robustness of the infrastructure; • apply best practices including those contained in this document, to limit the effects of failures and operational errors; • pursue the deployments of IPv6, DNSSEC, and RPKI to develop skills and to anticipate possible operational problems. 1Agence nationale de la sécurité des systèmes d’information / The French national authority for the defence and the security of information systems. 2Border Gateway Protocol. 3Domain Name System. 4Transport Layer Security. 5Top Level Domain. Internet Resilience in France - 2015 5 Presentation of the Observatory The Internet is an essential infrastructure for economic and social activities at the global, national and local levels. A major outage would significantly affect the smooth running of France and its economy. In addition, the operation of the Internet as a whole is often misunderstood and can be perceived as an opaque system, managed by players whose roles are poorly identified. Despite the importance of that issue, no organization in France had been entrusted with studying the risks of a malfunction of the Internet at the national level. Set up under the aegis of the ANSSI6 in 2011, the purpose of the Internet Resilience Observatory is to improve knowledge about the Internet by studying the technologies critical for its proper operation. One of its objectives is to increase the collective un- derstanding of the French Internet in order to have a coherent vision as complete as possible. In particular this helps to identify the interactions between the various players concerned. By nature, the Internet is international and has no borders. It is possible, however, to define the Internet in France as all of the French and international players engaged in an activity related to Internet technologies within the country. As part of its studies, the Observatory focuses on the French Internet, a subset of the Internet in France, which does not include foreign players. Studying the French Internet helps better understand the interdependencies of the French economy and society on foreign companies or organizations. Resilience, in turn, is defined as the ability to operate during an incident and return to the nominal state. A natural extension of resilience is robustness, i.e. the capacity, beforehand, to minimize the impact of an incident on the status of the system as a whole. On the technical level, the resilience and robustness of the Internet can be characterized by a set of measurable technical indicators. Some are directly based on engineering rules, referred to as best practices, defined by the technical and scientific community. The Internet Resilience Observatory in France is also tasked with defining and measuring representative resilience indicators, and to make its findings public. Stakeholders in the French Internet are involved in the initiative in order to increase the efficiency of the response and encourage the widest possible adoption of best practices. 6Agence nationale de la sécurité des systèmes d’information. Internet Resilience in France - 2015 7 Introduction Backed by their experience on BGP and DNS protocols, the Observatory team wanted to extend its analyses to other protocols to better understand the Internet in France. Their choice fell on the TLS protocol that in particular enables encryption of the com- munications between a web server and its clients. The scope of this new analysis consists of all the websites corresponding to delegated zones under the .fr TLD implementing HTTPS 7. This new report presents various indicators and measurement methodologies, and the results associated with the observations made on TLS. Regarding the BGP protocol, the main tools used for the analysis have been pub- lished [1, 2]. They can be used both to analyze the BGP archives of the RIS8 project, and to detect conflicts between prefix advertisements [6]. In 2015, a new methodol- ogy of detecting routing leaks was also developed. It is designed to facilitate manual analyses while reducing the number of false positives. This is an important step in the automation of repetitive classification tasks previously performed manually. The study of mail relays via the DNS protocol, introduced in the 2014 report, has been improved, especially with respect to the dependencies on third-party domain names, and dispersions by country and by operator. This development helps better understand the phenomena of concentration on hosting platforms that can affect service availabil- ity. To echo the new indicator on the TLS protocol, observations on DNSSEC9 now incorporate an analysis of the cryptographic algorithms used. For the sake of brevity, this new report provides a summary of the analyses and de- tails the highlights of 2015. Previous reports are thus the reference in terms of the descriptions and methodologies for recurring technical indicators. In a nutshell French operators wishing to obtain detailed information about BGP indicators may request individual reports. 7The version of the HTTP protocol protected by TLS. 8Routing Information Service. 9Domain Name System Security Extensions. Internet Resilience in France - 2015 9 Chapter 1 Resilience in Terms of the BGP Protocol 1.1 Introduction 1.1.1 Operation of the BGP Protocol Each Internet operator manages sets of contiguous IP1 addresses, called prefixes, which it can divide for its own needs or those of its customers. To form the infrastructure of the Internet, the operators connect to each other using the BGP protocol [7]. The aim of this protocol is to exchange reachability information about the prefixes between two operators which are then called AS2 and identified by a unique number. Each of the ASes informs its peer that that it can route traffic to its prefixes. Intercon- nections are divided into two categories: • peering: an agreement in which each peer advertises to the other the prefixes that it manages. For example, if an ISP and a content broadcaster come to a peering agreement, they will exchange their traffic directly; • transit: a commercial agreement between a customer and its transit operator. In practice, the customer advertises its prefixes to its operator so that the latter can propagate them. In return, the latter advertises the rest of the prefixes constituting the Internet. In a BGP interconnection, each peer associates an AS_PATH with the prefixes it adver- tises. In 1.1 the router of AS65540 has learnt the AS_PATH 64510 64500 for prefix 192.0.2.0/24. To reach IP address 192.0.2.1, a packet from the AS65540 will cross AS64510 before arriving at the AS64500. The AS managing the prefix is located to the right in the list constituting an AS path. In practice, a BGP message of the UPDATE type is used to indicate the AS path associated with a prefix. This BGP message is responsible for advertising the routes.