Algorithm for DNSSEC Trusted Key Rollover

Guette, Gilles; Cousin, Bernard; Fort, D.

doi:10.1007/978-3-540-30582-8_71

Cited by 4 publications

(4 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recycled keys are those that were shared in separate zones or used, removed, and then re-used. DNSSEC zones are often presumed to create distinct keys for themselves without sharing usage with other zones, and that once a key expires and completes its operational lifetime, it will '06 '07 '08 '09 '10 '11 '12 '13 '14 '15 '16 '17 '18 '19 [36] suggested an extension to the DNSKEY format itself to indicate when key transitions are underway. In subsequent work [37], this approach was evolved by proposing the new Resource Record KRI.…”

Section: Related Workmentioning

confidence: 99%

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

Osterweil

Tehrani

Schmidt

et al. 2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

When the global rollout of the DNS Security Extensions (DNSSEC) began in 2005, a first-of-its-kind trial started: The complexity of a core Internet protocol was magnified in favor of better security for the overall Internet. Thereby, the scale of the loosely-federated delegation in DNS became an unprecedented cryptographic key management challenge. Though fundamental for current and future operational success, our community lacks a clear notion of how to empirically evaluate the process of securely transitioning keys.In this paper, we propose two building blocks to formally characterize and assess key transitions. First, the anatomy of key transitions, i.e., measurable and well-defined properties of key changes; and second, a novel classification model based on this anatomy for describing key transition practices in abstract terms. This abstraction allows for classifying operational behavior. We apply our proposed transition anatomy and transition classes to describe the global DNSSEC deployment. Specifically, we use measurements from the first 15 years of the DNSSEC rollout to detect and understand which key transitions have been used to what degree and which rates of errors and warnings occurred. In contrast to prior work, we consider all possible transitions and not only 1:1 key rollovers. Our results show measurable gaps between prescribed key management processes and key transitions in the wild. We also find evidence that such noncompliant transitions are needed in operations.

show abstract

Section: Related Workmentioning

confidence: 99%

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

Osterweil

Tehrani

Schmidt

et al. 2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

show abstract

“…While recent related work signals a renewed interest in key transitions, previous literature exists that suggests augmenting the DNSSEC protocol to add explicit semantics that indicate ongoing key transitions. Guette et al [16] suggested an extension to the DNSKEY format, itself, to indicate when key transitions are underway. Then, in subsequent work [15], this approach was evolved by proposing a new Resource Record (the KRI).…”

Section: Related Workmentioning

confidence: 99%

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

Osterweil¹,

Tehrani²,

Schmidt³

et al. 2021

Preprint

View full text Add to dashboard Cite

When the global rollout of the DNS Security Extensions (DNSSEC) began in 2005, it started a first-of-its-kind trial: increasing complexity of a core Internet protocol in favor of better security for the overall Internet. The necessary cryptographic key management is made particularly challenging by DNS' loosely-federated delegation substrate and unprecedented cryptographic scale. Though fundamental for current and future operational success, our community lacks a clear notion of how to empirically evaluate the process of securely changing (or transitioning) keys.In this paper, we propose two building blocks to fundamentally understand and assess key transitions. First, the anatomy of key transitions: measurable and well-defined properties of key changes; and second a novel classification model based on this anatomy to describe key transitions practices in abstract terms. Our anatomy enables the evaluation of cryptographic keys' life cycles in general, and comparison of operational practices with prescribed key management processes, e.g., RFC key rollover guidelines. The fine-grained transition anatomy is then abstracted through our classification model to characterize transitions in abstract terms which rather describe a transition's behavior than its specific features.The applicability and utility of our proposed transition anatomy and transition classes are exemplified for the global DNSSEC deployment. Specifically, we use measurements from the first 15 years of the DNSSEC rollout to detect and measure which key rollover/transitions have been used, to what degree, and what their rates of errors and warnings have been. Our results show measurable gaps between prescribed key management processes and key transitions in the wild. We also find evidence that such noncompliant transitions are inevitable in the wild.

show abstract

“…During the last two years, three methods [10,12,18] have been designed to automatically update the trusted key set of a resolver. In this section, we describe briefly these three methods and we discuss their limitations.…”

Section: Related Workmentioning

confidence: 99%

“…In [10], the authors propose to use the first of the reserved bits of the Flag field and to call it the under changes bit. That gives the following meaning to this bit: when this bit is set the key contained in the DNSKEY RR is under changes and is going to be removed from the DNS zone file.…”

Section: The Automated Trusted Key Rollover Algorithmmentioning

confidence: 99%

Automating trusted key rollover in DNSSEC

Guette

2009

JCS

Self Cite

View full text Add to dashboard Cite

The Domain Name System (DNS) is a distributed tree-based database largely used to translate a human readable machine name into an IP address. The DNS security extensions (DNSSEC) has been designed to protect the DNS protocol using public key cryptography and digital signatures. Every secure DNS zone owns at least a key pair (public/private) to provide two security services: data integrity and authentication. To trust some DNS data, a DNS client has to verify the signature of this data with the right zone key. This verification is based on the establishment of a chain of trust. To build this chain of trust, a DNSSEC client needs a secure entry point: a zone key configured as trusted in the client. In this paper, we study the management problem of this kind of key also call the trusted key rollover problem. We propose a new resource record (RR) to automate this rollover and avoid the inconsistency problem between the resolver key set and the name server key set. Without our new record and solution, this problem needs an administrator action to be solved.

show abstract

Algorithm for DNSSEC Trusted Key Rollover

Cited by 4 publications

References 12 publications

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

Automating trusted key rollover in DNSSEC

Contact Info

Product

Resources

About