On the Adoption of the Elliptic Curve Digital Signature Algorithm (ECDSA) in DNSSEC

    Research output: Contribution to conferencePaperpeer-review

    12 Citations (Scopus)
    104 Downloads (Pure)


    The Domain Name System Security Extensions (DNSSEC) are steadily being deployed across the Internet. DNSSEC extends the DNS protocol with two vital security properties, authenticity and integrity, using digital signatures. While DNSSEC is meant to solve security issues in the DNS, it also introduces a new one: the digital signatures significantly increase DNS packet sizes, making DNSSEC an attractive vector to abuse in amplification denial-of-service attacks. By default, DNSSEC uses RSA for digital signatures. Earlier work has shown that alternative signature schemes, based on elliptic curve cryptography, can significantly reduce the impact of signatures on DNS response sizes. In this paper we study the actual adoption of ECDSA by DNSSEC operators, based on longitudinal datasets covering over 50% of the global DNS namespace over a period of 1.5 years. Adoption is still marginal, with just 2.3% of DNSSEC-signed domains in the .com TLD using ECDSA. Nevertheless, use of ECDSA is growing, with at least one large operator leading the pack. And adoption could be up to 42% higher. As we demonstrate, there are barriers to deployment that hamper adoption. Operators wishing to deploy DNSSEC using current recommendations (with ECDSA as signing algorithm) must be mindful of this when planning their deployment.
    Original languageUndefined
    Number of pages5
    Publication statusPublished - Nov 2016
    Event12th international Conference on Network and Service Management, CNSM 2016 - Montreal, Canada
    Duration: 31 Oct 20164 Nov 2016
    Conference number: 12


    Conference12th international Conference on Network and Service Management, CNSM 2016
    Abbreviated titleCNSM 2016
    Internet address


    • IR-104111
    • EWI-27653

    Cite this