OpenID at risk due to DNS flaw, warns researcher

A fundamental issue affects the OpenID authentication system, due to its reliance on the Domain Name System, a Sun identity-technology specialist has warned.

Robin Wilton, a corporate architect for federated identity at Sun, described OpenID's reliance on the integrity of the Domain Name System (DNS) as a "multi-factor problem" in light of the discovery of a fundamental flaw in DNS by security researcher Dan Kaminsky.

"You may have seen the recent announcements about DNS cache poisoning, and the potential effect of this on all kinds of internet-based applications' security," Wilton wrote in a blog post on Friday. "One area in which it can have a particularly significant impact is OpenID."

OpenID is a shared, online identity service that lets people create one single login to use on multiple sites. Its supporters include major organisations such as Microsoft, Yahoo and the BBC.

Wilton wrote that OpenID is not designed to require the prior exchange of security information between parties for the process to work. Instead, it relies on the integrity of the underlying DNS system to ensure that identity is vouched for by the "correct" trust provider. This means that, if the underlying DNS system is compromised (for example, through cache poisoning), authentication is undermined, as it is impossible to tell whether an entity vouching for an identity can be trusted.

Wilton wrote that none of Sun's enterprise authentication systems had been affected as it uses the Liberty authentication mechanism, a rival to OpenID. Sun had been investigating OpenID as a research project, he said.

Another problem with OpenID was highlighted in a security advisory published on Friday, which quoted findings by Google researcher Ben Laurie, and Richard Clayton, of the Cambridge University Computer Labs. Various OpenID providers have TLS server certificates that use weak private keys, the researchers said, as a result of a previously reported flaw in the Debian random-number generator. This opens the door to a cache-poisoning attack where a malicious server would pretend to be the true OpenID provider.

Writing in a blog post on Saturday, Clayton said that this flaw particularly affected Sun's implementations of OpenID.

"The problem that Ben and I have identified is that an attacker can poison a DNS cache so it serves up the wrong IP address for openid.sun.com," Clayton wrote. "Then, even if the victim is really cautious and uses HTTPS and checks the cert, their credentials can be phished. Thereafter, anyone who trusts Sun as an [OpenID] identity provider could be very disappointed."