Multiple-vantage-point domain control validation (multiVA) is an emerging defense for mitigating BGP hijacking attacks against certificate authorities. While the adoption of multiVA is on the rise, little work has quantified its effectiveness against BGP hijacks in the wild. We bridge the gap by presenting the first analysis framework that measures the security of a multiVA deployment under real-world network configurations (e.g., DNS and RPKI). Our framework accurately models the attack surface of multiVA by 1) considering the attacks on DNS nameservers involved in domain validation, 2) considering deployed practical security techniques such as RPKI, 3) performing fine-grained internet-scale analysis to compute multiVA resilience (i.e., how difficult it is to launch a BGP hijack against a domain and get a bogus certificate under multiVA). We use our framework to perform a rigorous security analysis of the multiVA deployment of Let's Encrypt, using a dataset that consists of about 1 million certificates and 31 billion DNS queries collected over four months. Our analysis shows while DNS does enlarge the attack surface of multiVA, the of Let's Encrypt's multiVA deployment still offers an 88% median resilience against BGP hijacks, a notable improvement over 76% offered by single-vantage-point validation. RPKI, even in its current state of partial deployment, effectively mitigates BGP attacks and improves the security of the deployment by 15% as compared to the case without considering RPKI. Exploring 11,000 different multiVA configurations, we find that Let's Encrypt's deployment can be further enhanced to achieve a resilience of over 99% by using a full quorum policy with only two additional vantage points in different public clouds.

翻译：多视角域控制验证（multiVA）是一种新兴防御技术，用于缓解针对证书颁发机构的BGP劫持攻击。尽管multiVA的采用率正在上升，但鲜有研究量化其在真实网络环境下对抗BGP劫持的有效性。我们首次提出一种分析框架，用于衡量在真实网络配置（如DNS和RPKI）下multiVA部署的安全性。该框架通过以下方式精确建模multiVA的攻击面：1）考虑域验证中涉及的DNS域名服务器攻击；2）纳入已部署的实用安全技术（如RPKI）；3）进行细粒度的互联网规模分析，以计算multiVA的韧性（即攻击者在multiVA条件下针对某个域发起BGP劫持并获取伪造证书的难度）。我们利用该框架，基于包含约100万份证书和310亿条DNS查询（覆盖四个月）的数据集，对Let's Encrypt的multiVA部署进行了严格的安全分析。分析表明，尽管DNS确实扩大了multiVA的攻击面，但Let's Encrypt的multiVA部署仍实现了88%的中位韧性以抵御BGP劫持，较单视角验证的76%有显著提升。即使处于当前部分部署状态，RPKI也能有效缓解BGP攻击，相较于未考虑RPKI的情况，将部署安全性提升了15%。通过探索11,000种不同的multiVA配置，我们发现若采用完全仲裁策略并仅在两个不同公有云中添加额外视角，Let's Encrypt的部署可进一步优化，实现超过99%的韧性。