Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag

Kolkman, Olaf; Schlyter, Jakob; Lewis, Edward

doi:10.17487/rfc3757

Cited by 8 publications

(11 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Designating an authentication key as a key signing key is purely an operational issue: DNSSEC validation does not distinguish between key signing keys and other DNSSEC authentication keys, and it is possible to use a single key as both a key signing key and a zone signing key. Key signing keys are discussed in more detail in [RFC3757]. Also see zone signing key.…”

Section: Definitions Of Important Dnssec Termsmentioning

confidence: 99%

DNS Security Introduction and Requirements

Larson¹,

Massey²,

Rose³

et al. 2005

518

394

View full text Add to dashboard Cite

Section: Definitions Of Important Dnssec Termsmentioning

confidence: 99%

DNS Security Introduction and Requirements

Larson¹,

Massey²,

Rose³

et al. 2005

518

394

View full text Add to dashboard Cite

“…An island of security is a subtree in the DNS hierarchy in which DNSSEC has been deployed. The public key for the root of this subtree is called a trust anchor [14]. Since the trust anchor KSK cannot be verified by its parent zone which has not deployed DNSSEC, other means are needed for resolvers to collect, verify, and maintain the trust anchor KSKs.…”

Section: Incremental Deployabilitymentioning

confidence: 99%

Deploying Cryptography in Internet-Scale Systems: A Case Study on DNSSEC

Yang

Osterweil²,

Massey

et al. 2011

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

Abstract-The DNS Security Extensions (DNSSEC) are among the first attempts to deploy cryptographic protections in an Internet-scale operational system. DNSSEC applies wellestablished public key cryptography to ensure data integrity and origin authenticity in the DNS system. While the cryptographic design of DNSSEC is sound and seemingly simple, its development has taken the IETF over a decade and several protocol revisions, and even today its deployment is still in the early stage of rolling out. In this paper, we provide the first systematic examination of the design, deployment, and operational challenges encountered by DNSSEC over the years. Our study reveals a fundamental gap between cryptographic designs and operational Internet systems. To be deployed in the global Internet, a cryptographic protocol must possess several critical properties including scalability, flexibility, incremental deployability, and ability to function in face of imperfect operations. We believe that the insights gained from this study can offer valuable inputs to future cryptographic designs for other Internet-scale systems.

show abstract

“…This allows to avoid the use of a fake key sent in a message forged by a malicious person. To trust a zone key, DNSSEC uses the DNS-tree model to establish a chain of trust [5] beginning from a secure entry point [6] to the queried zone. To create this chain, a verifiable relation between child zone and parent zone must exist: this is the role of the Delegation Signer resource record (DS RR) [10].…”

Section: Dnssec Chain Of Trustmentioning

confidence: 99%

“…If bit 7 has value 0, then the DNSKEY record holds some other type of DNS public key (such as a public key used by TKEY [11]). Bit 15 of the Flags field is the Secure Entry Point flag, described in [6]. If bit 15 has value 1, then the DNSKEY record holds a key intended for use as a secure entry point.…”

Section: The Trusted Key Rollover Problemmentioning

confidence: 99%

“…In order to validate DNSSEC records, a resolver builds a chain of trust [5] by walking through the DNS tree from a secure entry point [6] (typically a top level zone) to the zone queried. Each secure entry point (SEP), is statically configured in a resolver: the resolver knows at least one key of the zone which is taken as SEP, this key is called a trusted key.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Algorithm for DNSSEC Trusted Key Rollover

Guette

Cousin

Fort

2005

Information Networking. Convergence in Broadband and Mobile Networking

View full text Add to dashboard Cite

Abstract. The Domain Name System Security Extensions (DNSSEC) architecture is based on public-key cryptography. A secure DNS zone has one or more keys and signs its resource records with these keys in order to provide two security services: data integrity and authentication. These services allow to protect DNS transactions and permit the detection of attempted attacks on DNS. The DNSSEC validation process is based on the establishment of a chain of trust between zones. This chain needs a secure entry point: a DNS zone whose at least one key is trusted. In this paper we study a critical problem associated to the key rollover in DNSSEC: the trusted keys rollover problem. We propose an algorithm that allows a resolver to update its trusted keys automatically and in a secure way without any delay or any break of the DNS service.

show abstract

Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag

Cited by 8 publications

References 5 publications

DNS Security Introduction and Requirements

DNS Security Introduction and Requirements

Deploying Cryptography in Internet-Scale Systems: A Case Study on DNSSEC

Algorithm for DNSSEC Trusted Key Rollover

Contact Info

Product

Resources

About