Securing The Root: A Proposal For Distributing Signing Authority

Management of the Domain Name System (DNS) root zone file is a uniquely global policy problem. For the Internet to connect everyone, the root must be coordinated and compatible. While authority over the legacy root zone file has been contentious and divisive at times, everyone agrees that the Internet should be made more secure. A newly standardized protocol, DNS Security Extensions (DNSSEC), would make the Internet's infrastructure more secure. In order to fully implement DNSSEC, the procedures for managing the DNS root must be revised. Therein lies an opportunity. In revising the root zone management procedures, we can develop a new solution that diminishes the impact of the legacy monopoly held by the U.S. government and avoids another contentious debate over unilateral U.S. control. In this paper we describe the outlines of a new system for the management of a DNSSEC-enabled root. Our proposal distributes authority over securing the root, unlike another recently suggested method, while avoiding the risks and pitfalls of an intergovernmental power sharing scheme

Evaluation of Dnssec in Microsoft Windows and Microsoft Windows Server 2008 R2

The Domain Name System (DNS) provides important name resolution services on the Internet. The DNS has been found to have security flaws which have the potential to undermine the reliability of many Internet-based systems. DNS Security Extensions (DNSSEC) offers a long-term solution these DNS security flaws. However, DNSSEC adoption has been slow because it is challenging to deploy and administer. DNSSEC has also been criticized for not being an end-toend solution. Microsoft included support for DNSSEC in its latest operating systems, Windows Server 2008 R2 and Windows 7. This thesis concluded that DNSSEC features in Windows Server 2008 R2 and Windows 7 are not fully developed and are unlikely to impact DNSSEC adoption rates

A Formal Specification of the DNSSEC Model

The Domain Name System Security Extensions (DNSSEC) is a suite of specifications that provide origin authentication and integrity assurance services for DNS data. In particular, DNSSEC was designed to protect resolvers from forged DNS data, such as the one generated by DNS cache poisoning. This article presents a minimalistic specification of a DNSSEC model which provides the grounds needed to formally state and verify security properties concerning the chain of trust of the DNSSEC tree. The model, which has been formalized and verified using the Coq proof assistant, specifies an abstract formulation of the behavior of the protocol and the corresponding security-related events, where security goals, such as the prevention of cache poisoning attacks, can be given a formal treatment

Library and Tools for Server-Side DNSSEC Implementation

Tato práce se zabývá analýzou současných open source řešení pro zabezpečení DNS zón pomocí technologie DNSSEC. Na základě provedené rešerše je navržena a implementována nová knihovna pro použití na autoritativních DNS serverech. Cílem knihovny je zachovat výhody stávajících řešení a vyřešit jejich nedostatky. Součástí návrhu je i sada nástrojů pro správu politiky a klíčů. Funkčnost vytvořené knihovny je ukázána na jejím použití v serveru Knot DNS.This thesis deals with currently available open-source solutions for securing DNS zones using the DNSSEC mechanism. Based on the findings, a new DNSSEC library for an authoritative name server is designed and implemented. The aim of the library is to keep the benefits of existing solutions and to eliminate their drawbacks. Also a set of utilities to manage keys and signing policy is proposed. The functionality of the library is demonstrated by it's use in the Knot DNS server.

Addressing the challenges of modern DNS:a comprehensive tutorial

The Domain Name System (DNS) plays a crucial role in connecting services and users on the Internet. Since its first specification, DNS has been extended in numerous documents to keep it fit for today’s challenges and demands. And these challenges are many. Revelations of snooping on DNS traffic led to changes to guarantee confidentiality of DNS queries. Attacks to forge DNS traffic led to changes to shore up the integrity of the DNS. Finally, denial-of-service attack on DNS operations have led to new DNS operations architectures. All of these developments make DNS a highly interesting, but also highly challenging research topic. This tutorial – aimed at graduate students and early-career researchers – provides a overview of the modern DNS, its ongoing development and its open challenges. This tutorial has four major contributions. We first provide a comprehensive overview of the DNS protocol. Then, we explain how DNS is deployed in practice. This lays the foundation for the third contribution: a review of the biggest challenges the modern DNS faces today and how they can be addressed. These challenges are (i) protecting the confidentiality and (ii) guaranteeing the integrity of the information provided in the DNS, (iii) ensuring the availability of the DNS infrastructure, and (iv) detecting and preventing attacks that make use of the DNS. Last, we discuss which challenges remain open, pointing the reader towards new research areas

DNS-based Authentication of Named Entities

Public Key Infrastructure (PKI) has turned out to be useful when two parties negotiate about a shared secret in order to establish an encrypted connection between them. To verify the public key, a certificate is used. The certificate is issued by a public, generally trusted third party Certificate Authority (CA). Usually, the web browsers have a list of trusted CAs. It is a well-known problem that the number of security risks increases when the number of CAs grows. A compromised CA can, by an attacker's malicious action or by a human error, issue a trusted certificate to a party who does not own the domain. The purpose of this Master of Science Thesis is to research the applications of the DANE protocol, which is standardized by the IETF. The research question is, how to validate a target receiver while negotiating the encrypted connection. Special focus is on the secure email system. The DANE protocol makes use of the existing Domain Name System (DNS) and its Security Extensions (DNSSEC). This Master of Science Thesis begins with a theoretical part, where the technical background and current techniques are introduced. The DANE protocol and its features are also considered in this chapter. The latter part considers the method in practice, and describes how DANE can be used for the certificate verification instead of CA. The testing phase proves that the deployment of DANE is not complex and the increase of delay and traffic are not significant. DANE provides the needed association between the DNSSEC's chain of trust and the received certificate

Deploying DNSSEC in islands of security

The Domain Name System (DNS), a name resolution protocol is one of the vulnerable network protocols that has been subjected to many security attacks such as cache poisoning, denial of service and the 'Kaminsky' spoofing attack. When DNS was designed, security was not incorporated into its design. The DNS Security Extensions (DNSSEC) provides security to the name resolution process by using public key cryptosystems. Although DNSSEC has backward compatibility with unsecured zones, it only offers security to clients when communicating with security aware zones. Widespread deployment of DNSSEC is therefore necessary to secure the name resolution process and provide security to the Internet. Only a few Top Level Domains (TLD's) have deployed DNSSEC, this inherently makes it difficult for their sub-domains to implement the security extensions to the DNS. This study analyses mechanisms that can be used by domains in islands of security to deploy DNSSEC so that the name resolution process can be secured in two specific cases where either the TLD is not signed or the domain registrar is not able to support signed domains. The DNS client side mechanisms evaluated in this study include web browser plug-ins, local validating resolvers and domain look-aside validation. The results of the study show that web browser plug-ins cannot work on their own without local validating resolvers. The web browser validators, however, proved to be useful in indicating to the user whether a domain has been validated or not. Local resolvers present a more secure option for Internet users who cannot trust the communication channel between their stub resolvers and remote name servers. However, they do not provide a way of showing the user whether a domain name has been correctly validated or not. Based on the results of the tests conducted, it is recommended that local validators be used with browser validators for visibility and improved security. On the DNS server side, Domain Look-aside Validation (DLV) presents a viable alternative for organizations in islands of security like most countries in Africa where only two country code Top Level Domains (ccTLD) have deployed DNSSEC. This research recommends use of DLV by corporates to provide DNS security to both internal and external users accessing their web based services.LaTeX with hyperref packagepdfTeX-1.40.1

Enabling Post-Quantum Signatures in DNSSEC: One ARRF at a time

The Domain Name System Security Extensions (DNSSEC) provide authentication of DNS responses using digital signatures. DNS relies on UDP as its primary delivery method which imposes several constraints, with the most notable being that DNS message sizes should be no larger than 1232 bytes to avoid message delivery issues. It is possible to deliver larger DNS messages by either utilizing UDP fragmentation or falling back to TCP, but neither are sufficiently reliable in the current DNS ecosystem. Although large DNSSEC messages are not a primary concern today — due to the signature size of actively used algorithms such as RSA or elliptic curve cryptography — large DNS messages become an alarming issue for post-quantum signing algorithms due to their larger signatures and/or keys. In this thesis, we propose ARRF, a method for fragmenting large DNS resource records at the application layer (rather than the transport layer). ARRF is a request-based fragmentation method, meaning that the initial response contains a truncated response and all remaining fragments must be explicitly requested. By using request-based fragmentation, ARRF avoids issues of previously proposed — and rejected — application-layer DNS fragmentation techniques. By requiring fragments to be explicitly requested at the application layer we avoid issues caused by problematic network devices along the transmission path. We implement ARRF and evaluate its performance on a simulated network when used for the three post-quantum algorithms selected by NIST for standardization (Falcon, CRYSTALS-Dilithium and SPHINCS+) at the 128-bit security level. Our experiments show that ARRF has considerably lower resolution times compared to DNS over UDP with TCP fallback for all tested algorithms. We also find that, when using ARRF to deliver Falcon and Dilithium less data transmission is required. ARRF was also designed with a low implementation burden. Our implementation is a simple lightweight daemon which sits in front of DNS name servers and resolvers and performs the fragmentation and reassembly transparently

Authenticated and Secure Automotive Service Discovery with DNSSEC and DANE

Automotive softwarization is progressing and future cars are expected to operate a Service-Oriented Architecture on multipurpose compute units, which are interconnected via a high-speed Ethernet backbone. The AUTOSAR architecture foresees a universal middleware called SOME/IP that provides the service primitives, interfaces, and application protocols on top of Ethernet and IP. SOME/IP lacks a robust security architecture, even though security is an essential in future Internet-connected vehicles. In this paper, we augment the SOME/IP service discovery with an authentication and certificate management scheme based on DNSSEC and DANE. We argue that the deployment of well-proven, widely tested standard protocols should serve as an appropriate basis for a robust and reliable security infrastructure in cars. Our solution enables on-demand service authentication in offline scenarios, easy online updates, and remains free of attestation collisions. We evaluate our extension of the common vsomeip stack and find performance values that fully comply with car operations