DNSSEC+: The Game-Changer Fixing DNS Security Issues

DNSSEC+ is a new security scheme designed to address vulnerabilities in DNS that leverages the existing DNSSEC trust model but introduces short-term authorizations for nameservers to serve zone data securely, enhancing real-time security without compromising performance or requiring long-term key duplication. 

The approach mitigates the deployability challenges and security risks associated with previous proposals by offering comparable performance to less secure alternatives while fulfilling nine defined security, privacy, and deployability properties for name resolution. 

It introduces digital signatures to DNS messages to improve data authenticity by utilizing a chain of trust with public keys stored in DNS records to verify the legitimacy of responses. 

Attackers can exploit it to launch DDoS attacks due to the larger response sizes, while unsigned delegation records and zone enumeration attacks can compromise security. 

DNSCurve, an alternative solution, uses authenticated encryption but has limitations; it requires private keys on nameservers, posing security risks in anycast deployments, and the lack of a well-defined trust model hinders secure key distribution. 

The threats and desired properties for a secure Stage 2 DNS scheme (DNSSEC+). Adversaries can tamper with DNS responses (on-path) or eavesdrop on queries (off-path). 

Security threats include the injection of false responses and replaying captured responses, and availability threats involve overloading nameservers or using them to amplify DoS attacks. 

Privacy threats concern leaking information from queries or responses, aiming to achieve message authentication, avoid duplicating long-term secrets on name servers, maintain single-round trip resolution, and leverage the established DNSSEC trust model. 

It also targets to minimize amplification factors, prevent replay attacks with a time-varying parameter, and adhere to a “fail closed” principle upon validation failure. While confidentiality is not its primary focus, DNSSEC+ offers optional query encryption for privacy. 

DNSSEC+ key updates involve distinct processes for different key types. Short-term keys are replaced before expiration, while long-term agreement keys require careful coordination between zone administrators and parent zones to avoid disruptions. 

Long-term zone signing keys are updated through a customized double-DS method, where the new key is published alongside the old one, allowing sufficient time for cache expiration before complete removal, minimizing the impact on name resolution. 

According to Arxiv, DNSSEC+ is a new DNS security scheme that builds upon the DNSSEC trust model, which enhances security by eliminating the need to duplicate long-term keys on nameservers, addressing a key vulnerability. 

While maintaining DNSSEC’s trust model, DNSSEC+ achieves comparable name resolution performance by optimizing for single round-trip resolution. To ensure comprehensive security, combining DNSSEC+ with a Stage 1 secure DNS scheme is recommended. 

Also Read:

• Hackers Hijack ISP to Poison Software Updates
• New Android Malware ‘BlankBot’ Takes Full Control of Your Phone