Questions tagged [dnssec]
Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.
21
questions
31
votes
3
answers
9k
views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
- 50.7k
32
votes
2
answers
99k
views
DNS zone transfer attack
Can anyone explain what is DNS zone transfer attack or give any link, paper?
I have already googled, but could not find anything meaningful.
user6809
13
votes
2
answers
3k
views
When using https but not DNSSEC, under what situation, a client is vulnerable?
So DNSSEC is to ensure that returned IP address is not poisoned. And https is to verify the remote server.
My question is that when protected by https, under what circumstances, a client is ...
- 133
26
votes
2
answers
7k
views
If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor.
However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
- 1,924
11
votes
1
answer
4k
views
Is DNSSEC really useless if TLS is properly configured?
I was reading this article http://sockpuppet.org/blog/2015/01/15/against-dnssec/ and this line caught my eye, "With TLS properly configured, DNSSEC adds nothing." My gut reaction was to disagree, but ...
- 918
10
votes
2
answers
3k
views
Storing SSL certificates in DNS records
Why not get rid of all certificate authorities and all the special kind of SSL certificates there are (extended validation etc. etc.) and instead just require anyone who wanted SSL to write their own ...
- 367
5
votes
2
answers
4k
views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
- 50.7k
5
votes
1
answer
1k
views
Is DNSSEC immune to stripping signatures?
In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain.
Is DNSSEC system immune to this ...
- 2,223
35
votes
3
answers
11k
views
If DNSSEC is so useful, why is its deployment non-existent for top domains?
I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
- 515
17
votes
4
answers
8k
views
DNSSec (Comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.
I've done a little research on DNSSec and its benefits. I ...
- 293
15
votes
3
answers
1k
views
Why is RFC4255 (SSHFP) not used for https?
I had this idea a few hours ago, but of course it already exists and there is even an RFC...
Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
- 32.7k
12
votes
3
answers
774
views
Should the average user care about DNS security?
Denise is an average user who goes with the default settings of her OS and home router. She knows that her browser and email client use DNS and she's worried because I told her that the DNS protocol ...
- 44.7k
10
votes
1
answer
794
views
Non-validating DNSSEC aware client security implications
I understood that Windows 7 and newer Windows clients are DNSSEC aware, but that they are non-validating. That means that they are not performing any DNSSEC validation, but that they can require the ...
- 2,299
9
votes
2
answers
2k
views
Does DNSSec have any benefit if used with IPSec-enabled IPv6?
I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?
Is DNSSec an IPv4-only technology?
- 50.7k
7
votes
2
answers
6k
views
Can you force your PC or device to use only DNSSec-verified lookup results?
Okay, I'll admit something first-off: I don't really understand some of the practical aspects of how DNSSec protections work very well.(Even after reading resources like this.)
Well, I certainly ...
- 2,735
7
votes
1
answer
1k
views
Does DNSSEC still have the "enumerate all names in zone" problem?
According to Wikipedia:
DNSSEC introduces the ability for a hostile party to enumerate all the
names in a zone by following the NSEC chain. NSEC RRs assert which
names do not exist in a zone by ...
- 2,194
4
votes
1
answer
1k
views
How to acquire DNSSEC root trust anchor from IANA?
I want to establish trust in a DNSSEC record. I found, that it can be done
$ dig +sigchase +trusted-key=./root.key @8.8.8.8 eesti.ee
root.key could be obtained with
$ dig . DNSKEY @8.8.8.8 | grep -...
- 41
4
votes
1
answer
573
views
Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?
In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
3
votes
3
answers
408
views
Does using DNSSEC in parallel with an anonymisation network decrease your privacy?
When using an anonymous communication network like Tor, to ensure privacy you must route your DNS traffic through the system even if your computer always uses DNSSEC for DNS lookups, would this be ...
- 43
0
votes
3
answers
230
views
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.
What business/organisation(s) would have:
Sufficient technical skill to ...
- 50.7k
0
votes
2
answers
561
views
Obtaining the public DNSSEC root key
Is the public DNSKEY of the DNS root zone that I have to trust when validating a DNSSEC key chain usually bundled with an OS? If so where is it located under Ubuntu 15.04, Linux?
What is otherwise ...
- 303