Loading...
Please wait, while we are loading the content...
Similar Documents
NSEC5: Provably Preventing DNSSEC Zone Enumeration
| Content Provider | CiteSeerX |
|---|---|
| Abstract | Abstract—We use cryptographic techniques to study zone enu-meration in DNSSEC. DNSSEC is designed to prevent attackers from tampering with domain name system (DNS) messages. The cryptographic machinery used in DNSSEC, however, also creates a new vulnerability, zone enumeration, enabling an adversary to use a small number of online DNSSEC queries combined with offline dictionary attacks to learn which domain names are present or absent in a DNS zone. We prove that the current DNSSEC standard, with NSEC and NSEC3 records, inherently suffers from zone enumeration: specifically, we show that security against (1) attackers that tamper with DNS messages and (2) privacy against zone enu-meration cannot be satisfied simultaneously, unless the DNSSEC nameserver performs online public-key cryptographic operations. We then propose a new construction that uses online public-key cryptography to solve the problem of DNSSEC zone enu-meration. NSEC5 can be thought of as a variant of NSEC3, in which the unkeyed hash function is replaced with a deterministic RSA-based keyed hashing scheme. With NSEC5, a zone remains protected against network attackers and compromised name-servers even if the secret NSEC5-hashing key is compromised; leaking the NSEC5-hashing key only harms privacy against zone enumeration, effectively downgrading the security of NSEC5 back to that of the current DNSSEC standard (with NSEC3). I. |
| File Format | |
| Access Restriction | Open |
| Subject Keyword | Dnssec Zone Enumeration Current Dnssec Standard Secret Nsec5-hashing Key Cryptographic Technique Online Public-key Cryptography Online Dnssec Query Dns Message Network Attacker Dnssec Nameserver Performs Nsec5-hashing Key Enu-meration Cannot Nsec3 Record New Vulnerability Zone Enumeration Public-key Cryptographic Operation Small Number New Construction Offline Dictionary Attack Dns Zone Domain Name System Unkeyed Hash Function Cryptographic Machinery Domain Name |
| Content Type | Text |
