Exit Zen
25
../../protocols/dnssec.rst:277
English
The simplest way to allow a DNSSEC server to return signed negative responses would be for the server to return a signed response that contains the received query and some information indicating the error. The client could then easily check the validity of the negative response. Unfortunately, this would force the DNSSEC server to generate signatures in real time. This implies that the private key must be stored in the server memory, which leads to risks if an attacker can take control of the server. Furthermore, those signatures are computationally complex and a simple denial of service attack would be to send invalid queries to a DNSSEC server.
0/6540 · 654
26
../../protocols/dnssec.rst:288
English
Given the above security risks, DNSSEC opted for a different approach that allows the negative replies to be authenticated by using offline signatures. The `NSEC` record exploits the lexicographical ordering of all the domain names. To understand its usage, consider a simple domain that contains three names (the associated `AAAA` and other records that are not shown) :
0/3710 · 371
27
../../protocols/dnssec.rst:302
English
In this domain, the DNSSEC server adds three `NSEC` records. A `RRSIG` signature is also computed for each of these records.
0/1240 · 124
28
../../protocols/dnssec.rst:317
English
If a resolver queries `delta.example.org`, the server will parse its zone. If this name were present, it would have been placed, in lexicographical order, between the `beta.example.org` and the `gamma.example.org` names. To confirm that the `delta.example.org` name does not exist, the server returns the `NSEC` record for `beta.example.org` that indicates that the next valid name after `beta.example.org` is `gamma.example.org`. If the server receives a query for `pi.example.org`, this is the `NSEC` record for `gamma.example.org` that will be returned. Since this record contains a name that is before `pi.example.org` in lexicographical order, this indicates that `pi.example.org` does not exist.
0/7010 · 701
29
../../protocols/dnssec.rst:331
English
Footnotes
0/100 · 9
30
../../protocols/dnssec.rst:332
English
See http://spoofer.caida.org/summary.php for an ongoing measurement study that analyses the networks where an attacker could send packets with any source IP address.
0/1650 · 165
The translation has come to an end.