A Longitudinal, End-to-End View of the DNSSEC Ecosystem Chung, Taejoong and van Rijswijk-Deij, Roland and Chandrasekaran, Balakrishnan and Choffnes, David and Levin, Dave and Maggs, Bruce M and Mislove, Alan and Wilson, Christo, 2017 Presented by – Kalyan

Motivation Even after 20 years, DNSSEC remains misconfigured in most of the zones. Complexity of the infrastructure Security compliance, Improved Automation, Auditing of DNSSEC Management. Re-examine the validation of the queries to the server logs from the authoritative nameservers, which is used to study DNSSEC enabled resolver behaviour.

Introduction DNS DNSSEC How is it different ? CNAME, MX, NS, A DS, DNSKEY, RRsigs How is it different ? Provides Authentication and Integrity

Paper Summary 1 Study of DNSSEC deployment from root zone to the child zone and validation by the resolver 2 Study on KSKs and ZSKs – PKI Infrastructure 3 RRsigs, DNSKEY, DS [Other resource records include NSEC, NSEC3 CDNSKEY, AND CDS] 4 Active Measurements – 59K Resolvers, 150K Domains Key Rollover 6 Daily, Hourly Dataset – TTL of the cached records

DNSSEC Cache poisoning An old idea which hasn’t been incorporated completely, improper Key Mismanagement. Most of them are incoherently managed

Resolver And Root Do Bit – 1, 0 DNSSEC Aware Resolvers – request and validate DNSSEC Aware – Root Zone – Authoritative Name Servers – Resolvers Publishing the DNSKEY to the parent domain, as a DS record, which contains the hashed DNSKEY KSK. Luminati HTTP/S Proxy Service – 400k end hosts – 59k Resolvers

Findings TTL of cached records. <= 1 Hour, => 1 Hour Key Rollover DNSKEY- DS Records Weak Key Length of Keys – 1024 bits is not adequate

Findings [Cont..] SOA Records – Cannot be validated No SOA records being signed DS Records - Incorrect Does not match the KSKs

Criticism Active measurements could have been incorporated for better results Other records were not available for the study. No explanation or very little insight about the records.

THANK YOU