flâneur

DNSSEC | Computer Security

textbook.cs161.org · 3,483 words · saved by 1 readers

DNSSEC is an extension to regular DNS that provides integrity and authentication on all DNS messages sent. Sanity check: Why do we not care about the confidentiality of DNSSEC?1 We want every DNS record to have integrity and authenticity, and we want everyone to be able to verify the integrity and authenticity of records. Digital signatures are a good fit in this situation, because only someone with the private key can create signatures, and everyone can use the public key to verify signatures. To ensure integrity and authenticity, let’s have every name server generate a public/private key pair and sign every record it sends with its private key. When the name server receives a DNS request, it sends the records, along with a signature on the records and the public key, to the resolver. The resolver uses the public key to verify the signature on the records. Because of the signatures, a network attacker (MITM, on-path, off-path) cannot tamper with the data or inject malicious data witho

DNSSEC | Computer Security Skip to main content Menu Expand (external link) Document Search Copy Copied Computer Security 33. DNSSEC DNSSEC is an extension to regular DNS that provides integrity and authentication on all DNS messages sent. Sanity check: Why do we not care about the confidentiality of DNSSEC? 1 33.1. Signing records We want every DNS record to have integrity and authenticity, and we want everyone to be able to verify the integrity and authenticity of records. Digital signatures are a good fit in this situation, because only someone with the private key can create signatures, an

saved by

related reading