Clarifications and Implementation Notes for DNS Security (DNSSEC)

Blacka, David; Weiler, Samuel

doi:10.17487/rfc6840

Cited by 24 publications

(2 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, we did not implement all DNS features, such as DNSSEC [10,[22][23][24]33]. Cryptographic operations are hard to fuzz, but may still represent interesting attack targets for malicious actors.…”

Section: Limitationsmentioning

confidence: 99%

ResolFuzz: Differential Fuzzing of DNS Resolvers

Bushart,

Rossow

2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper identifies and analyzes vulnerabilities in the DNS infrastructure, with particular focus on recursive DNS resolvers. We aim to identify semantic bugs that could lead to incorrect resolver responses, introducing risks to the internet's critical infrastructure. To achieve this, we introduce ResolFuzz, a mutation-based fuzzer to search for semantic differences across DNS resolver implementations. ResolFuzz combines differential analysis with a rule-based mechanism to distinguish between benign differences and potential threats. We evaluate our prototype on seven resolvers and uncover multiple security vulnerabilities, including inaccuracies in resolver responses and possible amplification issues in PowerDNS Recursor's handling of DNAME Resource Records (RRs). Moreover, we demonstrate the potential for self-sustaining DoS attacks in resolved and trust-dns, further underlining the necessity of comprehensive DNS security. Through these contributions, our research underscores the potential of differential fuzzing in uncovering DNS vulnerabilities.

show abstract

Section: Limitationsmentioning

confidence: 99%

ResolFuzz: Differential Fuzzing of DNS Resolvers

Bushart,

Rossow

2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Domain name owners may be able to deploy ZSKs with ECDSA algorithms, and choose a different algorithm for the KSK; however, this trick is prohibited by RFC 6840 and often causes resolvers to fail validation[66].…”

mentioning

confidence: 99%

The Reality of Algorithm Agility

Müller

Toorop²,

Chung

et al. 2020

Proceedings of the ACM Internet Measurement Conference

View full text Add to dashboard Cite

The DNS Security Extensions (DNSSEC) add data origin authentication and data integrity to the Domain Name System (DNS), the naming system of the Internet. With DNSSEC, signatures are added to the information provided in the DNS using public key cryptography. Advances in both cryptography and cryptanalysis make it necessary to deploy new algorithms in DNSSEC, as well as deprecate those with weakened security. If this process is easy, then the protocol has achieved what the IETF terms "algorithm agility".In this paper, we study the lifetime of algorithms for DNSSEC. This includes: (i) standardizing the algorithm, (ii) implementing support in DNS software, (iii) deploying new algorithms at domains and recursive resolvers, and (iv) replacing deprecated algorithms. Using data from more than 6.7 million signed domains and over 10,000 vantage points in the DNS, combined with qualitative studies, we show that DNSSEC has only partially achieved algorithm agility. Standardizing new algorithms and deprecating insecure ones can take years. We highlight the main barriers for getting new algorithms deployed, but also discuss success factors. This study provides key insights to take into account when new algorithms are introduced, for example when the Internet must transition to quantum-safe public key cryptography.

show abstract

Intrusion Detection and Network-Based Attacks

Oorschot¹

2021

Information Security and Cryptography

View full text Add to dashboard Cite

Clarifications and Implementation Notes for DNS Security (DNSSEC)

Cited by 24 publications

References 9 publications

ResolFuzz: Differential Fuzzing of DNS Resolvers

ResolFuzz: Differential Fuzzing of DNS Resolvers

The Reality of Algorithm Agility

Intrusion Detection and Network-Based Attacks

Contact Info

Product

Resources

About