Limiting the Power of RPKI Authorities Kris Shrishak Haya Shulman - PowerPoint PPT Presentation

Applied Networking Research Workshop 2020 acm sigcomm Limiting the Power of RPKI Authorities Kris Shrishak Haya Shulman TU Darmstadt and Fraunhofer SIT

Motivation - Resource Public Key Infrastructure (RPKI) secures the interdomain routing against prefix and subprefix hijacks - However, significant power lies with the Regional Internet Registries (RIRs) This Work - Distributed RPKI system that relies on threshold signatures - Prevention rather than detection - Ensures that any change to the RPKI objects requires a joint action by a number of RIRs, avoiding unilateral IP address takedowns - No changes required at Relying Parties 1 / 19

Outline RPKI MPC Our work

Prefix hijacks 2 / 19

RPKI RPKI [RFC 6480] is a hierarchical PKI that includes: Routing Certificate (RC) Binds IP prefix to a public key Route Origin Authorization (ROA) Binds the prefix to AS - Signed by the public key associated with the RC Route Origin Validation (ROV) Validates the origin of BGP route announcements RPKI is a prerequisite for BGPSec [RFC 8205] that provides path validation. 3 / 19

Delegated and Hosted RPKI Delegated RPKI - Members run their own CA - Member generates its own certificate, gets it signed by the parent CA 1 https://ripe77.ripe.net/presentations/156-RPKI-deployment-at-scale-RIPE-1.pdf 4 / 19

Delegated and Hosted RPKI Delegated RPKI - Members run their own CA - Member generates its own certificate, gets it signed by the parent CA Hosted RPKI - RIR runs the CA for the members and manages the keys and repo - Convenient option for members as they do need to run their own CAs - Even some large providers such as Cloudflare use hosted RPKI 1 1 https://ripe77.ripe.net/presentations/156-RPKI-deployment-at-scale-RIPE-1.pdf 4 / 19

Delegated and Hosted RPKI Delegated RPKI - Members run their own CA - Member generates its own certificate, gets it signed by the parent CA Hosted RPKI - RIR runs the CA for the members and manages the keys and repo - Convenient option for members as they do need to run their own CAs - Even some large providers such as Cloudflare use hosted RPKI 1 1 https://ripe77.ripe.net/presentations/156-RPKI-deployment-at-scale-RIPE-1.pdf 4 / 19

Power imbalance - RPKI authorities can revoke and allocations - RPKI authorities can unilaterally takedown IP prefixes - Law enforcement 2 3 - ASes not necessarily in the same country as the RIR (no recourse, loss of business) - RIRs do not usually collude with each other, and often disagree with each other when it comes to their response to law enforcement agencies 4 2 RIPE NCC Blocks Registration in RIPE Registry Following Order from Dutch Police (2011) 3 ICANN Tells U.S. Court That ccTLDs Are Not “Property” — Files Motion to Quash in U.S. Legal Action Aimed at Seizing Top-Level Domains (2014) 4 M. Mueller, M. van Eeten, and B. Kuerbis. In important case, RIPE-NCC seeks legal clarity on how it responds to foreign court orders (2011) 5 / 19

Prior Works - Adding transparency logs and .dead objects to signify consent 5 - Relying parties take a part of the burden - Detection after the fact - Parent manages the signing in hosted RPKI and can sign the .dead objects itself - Blockchain to replace RPKI 6 - Scalability - Deployment issues such as consensus algorithm and incentive for the nodes to run the blockchain - If Proof-of-Stake is used, large providers will become powerful players; another form of power imbalance 5 Heilman, et. al. From the consent of the routed: Improving the transparency of the RPKI (SIGCOMM’14) 6 Adiseshu Hari and T. V. Lakshman. The Internet blockchain: A distributed, tamper-resistant transaction framework for the Internet (HotNets’16) 6 / 19

Outline RPKI MPC Our work

Multiparty Computation (MPC) x 2 Trusted Third Party x 1 x 3 7 / 19

Multiparty Computation (MPC) x 2 x 2 MPC Trusted Third Party x 1 x 1 x 3 x 3 7 / 19

MPC Threshold Signatures Traditional Signatures Threshold Signatures { sk 1 , sk 2 , sk 3 } ← Share (sk) sk sk 2 MPC Indistinguishable sk 1 sk 3 8 / 19

MPC Threshold Signatures Traditional Signatures Threshold Signatures { sk 1 , sk 2 , sk 3 } ← Share (sk) sk sk 2 MPC Indistinguishable sk 1 sk 3 8 / 19

Outline RPKI MPC Our work

Threat model Individual RIRs not entirely trusted x 2 x 2 MPC x 1 x 3 x 3 9 / 19

Threat model Individual RIRs not entirely trusted x 2 x 2 Adversary power - Passive - Active MPC x 1 x 3 x 3 9 / 19

Threat model Individual RIRs not entirely trusted x 2 x 2 Adversary power - Passive - Active MPC x 1 How many can be corrupt? - Minority x 3 x 3 9 / 19

Threat model Individual RIRs not entirely trusted x 2 x 2 Adversary power - Passive - Active MPC x 1 How many can be corrupt? - Minority - Majority x 3 x 3 9 / 19

System Setup Trust Anchor RPKI Threshold Signature RIR CA DB Module repos Hosted RPKI repos RPKI Threshold Signature Hosted CA DB Module 10 / 19

Distributed RPKI RIPE NCC Threshold Signature repos CA repos Module ARIN AFRINIC MPC LACNIC APNIC 11 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) 12 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) sk 2 sk 4 consent MPC sk 1 sk 5 sk 3 repos repos 12 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) sk 2 sk 4 consent MPC sk 1 sk 5 sk 3 repos repos 12 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) sk 2 sk 4 consent MPC sk 1 sk 5 sk 3 repos repos 12 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) sk 2 sk 4 consent MPC sk 1 sk 5 sk 3 repos repos 12 / 19

Threshold signatures for RPKI { sk 1 , sk 2 , sk 3 , sk 4 , sk 5 } ← Share (sk) Threshold signing should not be expensive sk 2 sk 4 consent MPC sk 1 sk 5 sk 3 repos repos 12 / 19

Threshold Signature in 3 phases Preprocessing Preprocessing - Member independent - Member independent - Message independent MPC Online phase 13 / 19

Threshold Signature in 3 phases Preprocessing Preprocessing - Member independent - Member independent - Message independent MPC Online phase 13 / 19

Threshold Signature in 3 phases sk 2 Preprocessing Preprocessing - Member independent - Member independent sk 4 - Message independent MPC Online phase sk 1 sk 5 sk 3 13 / 19

Threshold Signature in 3 phases sk 2 , M Preprocessing Preprocessing - Member independent - Member independent sk 4 , M - Message independent MPC Online phase sk 1 , M sk 5 , M sk 3 , M 13 / 19

Deployment Scenarios - Two-layered - Is compatible with delegated RPKI - Upper layer generates a distributed TA to the five RIRs - Distributed key generation - All RIRs have the same subjectPublicKeyInfo in their TAL - Lower layer uses the threshold signing module for the Hosted CAs - Generates signed objects - Not entirely immune to state coercion - Flat - Combines RIR CA and hosted CA - Replaces the hierarchical RPKI with a flat architecture - Not compatible with delegated RPKI 14 / 19

Evaluations Frankfurt 85.6 | 142 114.9 | 109 203.7 | 56 283.2 | 39 180.6 | 64 N. Virginia Mumbai 228.3 | 49 119.9 | 99 301.0 | 36 196.7 | 57 Sao Paolo Sydney 308.7 | 35 Figure: Latency in milliseconds | Bandwidth in Mbits/s between regions 15 / 19

Evaluations ❤❤❤❤❤❤❤❤❤❤❤ Adversary power Passive Active Majority ❤ Honest Shamir Mal. Shamir Dishonest Semi. OT MASCOT Table: Four MPC protocols LAN WAN Preprocessing Online Preprocessing Online MASCOT 209 529 20 0 . 95 Semi OT 1042 662 111 2 . 05 Mal. Shamir 699 714 91 3 . 53 Shamir 1020 769 265 3 . 54 Table: Breakdown of throughput for preprocessing (tuples/sec) and online phases (signatures/sec) 16 / 19

ROAs AFRINIC ARIN RIPENCC AFRINIC ARIN RIPENCC 100000 100000 APNIC LACNIC APNIC LACNIC 80000 80000 ROAs removed ROAs added 60000 60000 40000 40000 20000 20000 0 0 1 1 1 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 - - - - - - - - - - - - 5 6 7 8 9 0 5 6 7 8 9 0 1 1 1 1 1 2 1 1 1 1 1 2 0 0 0 0 0 0 0 0 0 0 0 0 2 2 2 2 2 2 2 2 2 2 2 2 Dates Dates Figure: Number of ROAs added and removed from March 2015 to February 2020 17 / 19

Evaluations In the WAN setting, - MASCOT: 0.95 signatures/sec or 82080 signatures/day - Shamir: 3.53 signatures/sec or 304992 signatures/day - Even our slowest protocol is able to satisfy the requirements on an average day. - Our other protocols are able to generate enough signatures even on peak days 18 / 19

Summary of our work - Distributed RPKI with a stronger threat model - Using threshold signatures in preprocessing model - No changes at Relying Parties - Technical solution that requires legal and policy barriers to be addressed to make the work truly practical 19 / 19

kris.shrishak@sit.tu-darmstadt.de RIPE NCC Threshold Signature repos CA repos Module ARIN AFRINIC MPC LACNIC APNIC