DNSSEC+: An Enhanced DNS Scheme Motivated by Benefits and Pitfalls of DNSSEC
<|reference_start|>DNSSEC+: An Enhanced DNS Scheme Motivated by Benefits and Pitfalls of DNSSEC: The absence of security measures between DNS recursive resolvers and authoritative nameservers has been exploited by both inline and off-path attacks. While many security proposals have been made in practice and previous literature, they typically suffer from deployability barriers and/or inadequate security properties. The absence of a broadly adopted security solution between resolvers and nameservers motivates a new scheme that mitigates these issues in previous proposals. We present DNSSEC+, which addresses security and deployability downsides of DNSSEC, while retaining its benefits. DNSSEC+ takes advantage of the existent DNSSEC trust model and authorizes the nameservers within a zone for short intervals to serve the zone data securely, facilitating real-time security properties for DNS responses, without requiring long-term private keys to be duplicated (thus put at risk) on authoritative nameservers. Regarding name resolution latency, DNSSEC+ offers a performance comparable to less secure schemes. We define nine security, privacy, and deployability properties for name resolution, and show how DNSSEC+ fulfills these properties.<|reference_end|>
@article{jahromi2024dnssec+:,
    title={DNSSEC+: An Enhanced DNS Scheme Motivated by Benefits and Pitfalls of
  DNSSEC},
    author={Ali Sadeghi Jahromi, AbdelRahman Abdou, Paul C. van Oorschot},
    journal={arXiv preprint arXiv:2408.00968},
    year={2024},
    archivePrefix={arXiv},
    eprint={2408.00968},
    primaryClass={cs.CR}
}