Zone state revocation for DNSSEC

Authors:
Eric Osterweil;Vasileios Pappas;Dan Massey;Lixia Zhang
Affiliations:
UCLA;IBM;Colorado State University;UCLA
Venue:
Proceedings of the 2007 workshop on Large scale attack defense
Year:
2007

Citing 1
Cited 1

Development of the domain name system

SIGCOMM '88 Symposium proceedings on Communications architectures and protocols

Quantifying the operational status of the DNSSEC deployment

Proceedings of the 8th ACM SIGCOMM conference on Internet measurement

Quantified Score

Hi-index	0.00

Visualization

Abstract

DNS Security Extensions (DNSSEC) are designed to add cryptographic protection to the Internet's name resolution service. However the current design lacks a key revocation mechanism. In this paper we present Zone State Revocation (ZSR), a lightweight and backward compatible enhancement to DNSSEC. ZSR enables zones to explicitly revoke keys using self-certifying certificates, and enables DNS name-servers to opportunistically inform distributed caching resolvers of key revocations via lightweight control messages. Further, ZSR allows resolvers to distinguish between legitimate key changes and potential attacks when authentication chains are broken. ZSR is designed to work well with global-scale DNS operations, where millions of caches may need to be informed of a revocation, and where time is critical.