Domain Name System (DNS) Cookies

Eastlake, Donald; Andrews, Mark P.

doi:10.17487/rfc7873

Cited by 20 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To prevent amplification attacks, an Authoritative DNS server MAY wish to prevent returning OPENPGPKEY records over UDP unless the source IP address has been confirmed with [RFC7873]. Such servers MUST NOT return REFUSED, but answer the query with an empty answer section and the truncation flag set ("TC=1").…”

Section: Mua Behaviormentioning

confidence: 99%

DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP

Wouters¹

2016

View full text Add to dashboard Cite

OpenPGP is a message format for email (and file) encryption that lacks a standardized lookup mechanism to securely obtain OpenPGP public keys. DNS-Based Authentication of Named Entities (DANE) is a method for publishing public keys in DNS. This document specifies a DANE method for publishing and locating OpenPGP public keys in DNS for a specific email address using a new OPENPGPKEY DNS resource record. Security is provided via Secure DNS, however the OPENPGPKEY record is not a replacement for verification of authenticity via the

show abstract

Section: Mua Behaviormentioning

confidence: 99%

DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP

Wouters¹

2016

View full text Add to dashboard Cite

show abstract

“…A potential solution to this is some form of source address authentication, that allows the recipient of a packet to establish that the source address has not been spoofed. An effective way to implement this is by using cookies, as proposed by Eastlake in [16]. In short, the idea is that a name server does not send large responses to a client using EDNS0 unless the client proves its authenticity using an authentication cookie established during an initial interaction between client and server.…”

Section: Edns0 Cookiesmentioning

confidence: 99%

DNSSEC and its potential for DDoS attacks

Rijswijk-Deij

Sperotto

Pras

2014

Proceedings of the 2014 Conference on Internet Measurement Conference

View full text Add to dashboard Cite

Over the past five years we have witnessed the introduction of DNSSEC, a security extension to the DNS that relies on digital signatures. DNSSEC strengthens DNS by preventing attacks such as cache poisoning. However, a common argument against the deployment of DNSSEC is its potential for abuse in Distributed Denial of Service (DDoS) attacks, in particular reflection and amplification attacks. DNS responses for a DNSSEC-signed domain are typically larger than those for an unsigned domain, thus, it may seem that DNSSEC could actually worsen the problem of DNS-based DDoS attacks. The potential for abuse in DNSSEC-signed domains has, however, never been assessed on a large scale. In this paper we establish ground truth around this open question. We perform a detailed measurement on a large dataset of DNSSEC-signed domains, covering 70% (2.5 million) of all signed domains in operation today, and compare the potential for amplification attacks to a representative sample of domains without DNSSEC. At first glance, the outcome of these measurements confirms that DNSSEC indeed worsens the DDoS phenomenon. Closer examination, however, gives a more nuanced picture. DNSSEC really only makes the situation worse for one particular query type (ANY), for which responses may be over 50 times larger than the original query (and in rare cases up to 179×). We also discuss a number of mitigation strategies that can have immediate impact for operators and suggest future research directions with regards to these mitigation strategies.

show abstract

“…To prevent amplification attacks, an Authoritative DNS server MAY wish to prevent returning SMIMEA records over UDP unless the source IP address has been confirmed with DNS Cookies [RFC7873]. If a query is received via UDP without source IP address verification, the server MUST NOT return REFUSED but answer the query with an empty answer section and the truncation flag set ("TC=1").…”

Section: Response Sizementioning

confidence: 99%