**Domain Name System Security Extensions (DNSSEC)** is a set of IETF specifications for digitally signed DNS.

learn more… | top users | synonyms

14
votes
2answers
939 views

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
13
votes
4answers
4k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
11
votes
2answers
669 views

If DNSSEC is so useful, why is its deployment non-existent for top domains?

I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
9
votes
3answers
2k views

DNSSec (comcast) vs DNSCurve (OpenDNS)

I was previously using OpenDNS on my internal network. I found out today that comcast has switched over to DNSSec:Comcast DNSSec. I've did a little research on DNSSec and its benefits. I ...
8
votes
2answers
9k views

DNS zone transfer attack

Hello Guys! Can anyone explain what is DNS zone transfer or give any link, paper? I have already googled, but could not find anything meaningful?
7
votes
3answers
305 views

Why is RFC4255 (SSHFP) not used for https?

I had this idea a few hours ago, but of course it already exists and there is even an RFC... Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
7
votes
2answers
2k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
7
votes
1answer
193 views

Does dnssec protect against malicious registrars?

With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked). This is especially ...
6
votes
3answers
559 views

Is the Kaminsky bug still a problem for sites without DNSSEC?

I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker. Are DNS-software updated now so it's not that easy to use this vulnerability ...
5
votes
1answer
213 views

Kaminsky Bug Exploitation

I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that ...
5
votes
2answers
537 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
5
votes
1answer
225 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
5
votes
0answers
90 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
4
votes
1answer
191 views

How will users know if their session is DNSSec protected or not?

There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure. Ultimately I would like my users to recognize that ...
4
votes
1answer
242 views

My DNS Name Server does not support DNSSec client queries, what alternatives do I have?

I am using a web browser to access DNSSec enabled sites. My current name server doesn't (won't) support DNSSec for at least a year. What are my alternatives? Do any ISPs currently offer DNSSec? ...
4
votes
1answer
307 views

Can NSEC domain enumeration happen for zones with wildcard records?

In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
3
votes
1answer
229 views

How exactly would SOPA-style DNS blocking threaten the security of the Internet?

A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
3
votes
1answer
119 views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
3
votes
0answers
39 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
2
votes
2answers
103 views

Why does DNSSEC have a ridiculous keysigning ceremony?

Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and ...
2
votes
1answer
707 views

How to verify DNSKEY by using its corresponding DS

A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR. The ...
2
votes
1answer
156 views

How does a client know that a DNS zone is DNSSEC protected?

Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter. However, I have a question to ...
2
votes
1answer
647 views

TESTING DNSSec from command line

I am doing a research project on DNSSec. I have a SOA, Stub resolver and a client as well as a attack machine. My question is this. On a Linux Client is there a way test for validity of record ...
1
vote
1answer
70 views

Why is it dangerous for attackers to be able to enumerate all subdomains of a given domain?

While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this ...
1
vote
1answer
1k views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
1
vote
0answers
36 views

Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?

In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
0
votes
3answers
145 views

What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?

This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective. What business/organisation(s) would have: Sufficient technical skill ...
0
votes
2answers
903 views

Protecting yourself against DNS spoofing?

Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
0
votes
0answers
18 views

Root Zone Trust Anchor Publication?

I'm reading through DNSSEC Trust Anchor Publication for the Root Zone. Section 4 lists two methods to distribute the root keys: HTTP and HTTPS. Fetching over HTTP is not secure, and fetching over ...