Questions tagged [dnssec]
Domain Name System Security Extensions (DNSSEC) is a set of IETF specifications for digitally signed DNS.
130
questions
9
votes
2
answers
2k
views
Is the Google address being spoofed on my computer?
I might use some inappropriate terminology because I am no expert, but please feel free to correct me where it is needed.
I believe that a process has modified some network file on my computer, like ...
- 203
5
votes
0
answers
178
views
What's stopping DANE? [closed]
As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors).
My attempt at explaining the issue:
Currently, CAs are universal ...
- 268
2
votes
1
answer
235
views
Why is it dangerous for attackers to be able to enumerate all subdomains of a given domain?
While it seems like a bad idea for attackers to be able to use DNSSEC to enumerate subdomains, I cannot think of a specific attack that this information enables, which would not be doable without this ...
- 21
3
votes
1
answer
330
views
Email, Certificates and DANE [closed]
Does DANE offer the ability to provide certificates for services? Or is it just hosts?
How does one specify a mail server with DANE? If my email is j[email protected] but mail.bar.com is the email server, ...
user29925
4
votes
1
answer
567
views
Does DNSSEC provide signed statements that a certain domain does NOT yet support DNSSEC? If not, why not?
In my security class with David Wagner, we talked about some of the reasons why DNSSEC is not widely adopted right now. One of the reasons was that for backward compatibility reasons, clients need to ...
5
votes
1
answer
1k
views
Is DNSSEC immune to stripping signatures?
In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain.
Is DNSSEC system immune to this ...
- 2,223
14
votes
2
answers
4k
views
DNSSEC signing algorithms
Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5(???), NSEC3RSASHA1, NSEC3DSA.
If I understand correctly, there's Proof of Concept available for ...
- 247
5
votes
3
answers
1k
views
Why does DNSSEC have a ridiculous keysigning ceremony?
Every three months, 7 people fly to a secure ICANN server building and go through an elaborate ceremony to generate a new signing key for DNSSEC. The entire affair appears to be based on politics and ...
- 862
7
votes
2
answers
2k
views
How does a client know that a DNS zone is DNSSEC protected?
Recently, I've been reading about DNSSEC and how it works. I found other questions and some very interesting answers on this and other websites related to this matter.
However, I have a question to ...
- 173
26
votes
2
answers
7k
views
If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?
Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor.
However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
- 1,924
15
votes
3
answers
1k
views
Why is RFC4255 (SSHFP) not used for https?
I had this idea a few hours ago, but of course it already exists and there is even an RFC...
Why don't we publish the fingerprint for the SSL/TLS certificate via DNS? We need DNSSEC to make sure the ...
- 32.7k
5
votes
1
answer
3k
views
How to verify DNSKEY by using its corresponding DS
A DNSKEY on a name server can be verified by using it DS stored on its parental name server. According to RFC4034: The DS record refers to a DNSKEY RR by including a digest of that DNSKEY RR.
The ...
- 191
35
votes
3
answers
11k
views
If DNSSEC is so useful, why is its deployment non-existent for top domains?
I've read several papers on DNSSEC, and it appears that it does prevent many attack classes, and the only two possible downsides is that its deployment is hard (DNSSEC is complex), and that you can ...
- 515
7
votes
1
answer
6k
views
How to test the validity of DNSSEC from a command line interface?
I am doing a research project on The Domain Name System Security Extensions (DNSSEC).
I have a SOA, Stub resolver and a client as well as a attack machine.
My question is this. Is there a way to ...
- 71
6
votes
2
answers
1k
views
Can NSEC domain enumeration happen for zones with wildcard records?
In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) ...
- 2,821
7
votes
1
answer
331
views
Does dnssec protect against malicious registrars?
With the recent conspiracy theories around the registrar MarkMonitor Inc., the question arises, if DNSSEC protects against a registrar going malicious (or being attacked).
This is especially ...
- 27.2k
5
votes
1
answer
547
views
Kaminsky Bug Exploitation
I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that ...
- 153
17
votes
4
answers
8k
views
DNSSec (Comcast) vs DNSCurve (OpenDNS)
I was previously using OpenDNS on my internal network. I found out today that Comcast has switched over to DNSSec: Comcast DNSSec.
I've done a little research on DNSSec and its benefits. I ...
- 293
18
votes
4
answers
5k
views
Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?
DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users.
Since DNS is not used in Tor, it appears that HTTPS is ...
- 50.7k
5
votes
2
answers
4k
views
How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)
This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
- 50.7k
31
votes
3
answers
9k
views
How does DNSSec work? Are there known limitations or issues?
Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including:
DNS spoofing, especially on wifi or shared medium
Registrars that abuse their ...
- 50.7k
32
votes
2
answers
99k
views
DNS zone transfer attack
Can anyone explain what is DNS zone transfer attack or give any link, paper?
I have already googled, but could not find anything meaningful.
user6809
0
votes
2
answers
2k
views
Protecting yourself against DNS spoofing?
Are there any things which the user can do, on their own machine, to protect against DNS spoofing? I was just thinking when I was at the airport last and I wanted to check my email I used a hotspot ...
- 161
4
votes
1
answer
297
views
How exactly would SOPA-style DNS blocking threaten the security of the Internet?
A point that keeps getting mentioned in the SOPA debate is that the DNS blocking it prescribes will cause security problems. Can somebody explain in simple terms just exactly how SOPA threatens ...
- 149
7
votes
3
answers
1k
views
Is the Kaminsky bug still a problem for sites without DNSSEC?
I have read about the Kaminsky bug, but I don't fully understand how easy it is to use this vulnerability for an attacker.
Are DNS-software updated now so it's not that easy to use this vulnerability ...
- 5,183
7
votes
1
answer
468
views
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status
Where can I find the most current guidance on STS in DNS? If ...
- 50.7k
4
votes
1
answer
604
views
My DNS Name Server does not support DNSSec client queries, what alternatives do I have?
I am using a web browser to access DNSSec enabled sites. My current name server doesn't (won't) support DNSSec for at least a year. What are my alternatives?
Do any ISPs currently offer DNSSec? ...
- 50.7k
0
votes
3
answers
230
views
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
This is a high level question regarding some recent posts about enhancing web browser security from an end-user perspective.
What business/organisation(s) would have:
Sufficient technical skill to ...
- 50.7k
4
votes
1
answer
358
views
How will users know if their session is DNSSec protected or not?
There is definite security value in having DNSSec-verified connections, however I have yet to see software indicate if the connection is secure.
Ultimately I would like my users to recognize that ...
- 50.7k
9
votes
2
answers
2k
views
Does DNSSec have any benefit if used with IPSec-enabled IPv6?
I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec?
Is DNSSec an IPv4-only technology?
- 50.7k