January 2015 Summaries

Cloudflare has published its first DNSSEC signed zone, www.cloudflare.com, and invites users to analyze and provide feedback on the implementation. The company aims to make DNSSEC as widespread and easy-to-use as TLS. They are addressing complexities of DNSSEC by signing on the fly, using ECDSA for smaller answers and reduced risk of reflection attacks, and providing a fully managed solution. Users can participate in the beta program by emailing their website name and answer to a question about DNSSEC algorithm number for ECDSAP256SHA256.

The blog post discusses the author's experience with DNSSEC and his decision to join CloudFlare. He explains that DNSSEC is a protocol providing integrity protection for answers from authoritative servers, and its design has evolved over time. Widespread deployment of crucial building blocks for DNSSEC has been achieved, but more needs to be done in terms of signing enterprise zones and enabling validation in resolvers and clients. The author joined CloudFlare because they wanted to do things correctly from the beginning and were not afraid to innovate. He highlights some unique aspects of their DNSSEC implementation, such as generating signatures at the edge on demand, using ECDSA P-256 for stronger and smaller signatures, and a special approach to negative answers that provides better defense against zone walking. The announcement regarding CloudFlare's alpha DNSSEC support is the first step towards providing comprehensive DNSSEC offerings to their customers.

In January 2015, David Fritsch discussed how Cloudflare's Universal SSL was used by many customers to secure their websites with free SSL certificates. One of the issues faced was "Mixed Content" errors when using Flexible SSL, which creates a secure connection between website visitors and Cloudflare but an insecure one between Cloudflare and the origin server. This issue can be resolved by using relative protocols in links to assets like javascript, CSS, and images. The latest version of Cloudflare's WordPress plugin helps resolve these errors by altering the protocol within the links to assets. However, limitations still exist for some plugins that add assets through JavaScript, requiring further action from plugin developers. Additionally, Flexible SSL has its limitations and may not be suitable for websites handling sensitive information like credit cards, where Full SSL with an SSL certificate on the server is recommended.

John Graham-Cumming and his colleague Marek discovered a DDoS attack against one of their DNS servers, with the source IP address being spoofed. They noticed a correlation between the TTL field in the IP header and the IPv4 source address. The 'random' source port was found to be the first two bytes of the random IP source address reversed. A relationship between the TTL and the first byte of the IP address was also established, as well as one between the DNS ID field and the first two bytes of the source IP. However, the method by which the random source IPs are generated remains a mystery.