Welcome to the resource topic for 2017/099
Title:
Making NSEC5 Practical for DNSSEC
Authors: Dimitrios Papadopoulos, Duane Wessels, Shumon Huque, Moni Naor, Jan Včelák, Leonid Reyzin, Sharon Goldberg
Abstract:NSEC5 is a new proposal for providing authenticated denial of existence for DNSSEC, for providing authenticated responses to DNS queries for names that do not exist in a zone. NSEC5 simultaneously guarantees two security properties: (1) privacy against offline zone enumeration, and (2) integrity of zone contents, even if an adversary compromises the authoritative nameserver responsible for responding to DNS queries for the zone. By contrast, today’s DNSSEC protocol can guarantee one of these properties, but not both. This paper argues that NSEC5 can be made practical and performant. To that end, we present a new version of NSEC5. Our NSEC5 redesign features a fast and efficient verifiable random function (VRF) based on elliptic curve cryptography, along with a new cryptographic proof of its security. We also redesign the DNS protocol surrounding NSEC5, leveraging precomputation to improve performance and DNS-level optimizations to shorten responses. Next, we present the first implementation of NSEC5—extending widely-used DNS software to present a full-fledged nameserver and recursive resolver that support NSEC5—and evaluate their performance under aggressive query loads. We believe that our performance results indicate that NSEC5 can be a practical solution for DNSSEC deployments.
ePrint: https://eprint.iacr.org/2017/099
See all topics related to this paper.
Feel free to post resources that are related to this paper below.
Example resources include: implementations, explanation materials, talks, slides, links to previous discussions on other websites.
For more information, see the rules for Resource Topics .