On the Adoption of the Elliptic Curve Digital Signature Algorithm (ECDSA) in DNSSEC

    Research output: Chapter in Book/Report/Conference proceedingConference contributionAcademicpeer-review

    13 Citations (Scopus)
    220 Downloads (Pure)

    Abstract

    The Domain Name System Security Extensions (DNSSEC) are steadily being deployed across the Internet. DNSSEC extends the DNS protocol with two vital security properties, authenticity and integrity, using digital signatures. While DNSSEC is meant to solve security issues in the DNS, it also introduces a new one: the digital signatures significantly increase DNS packet sizes, making DNSSEC an attractive vector to abuse in amplification denial-of-service attacks. By default, DNSSEC uses RSA for digital signatures. Earlier work has shown that alternative signature schemes, based on elliptic curve cryptography, can significantly reduce the impact of signatures on DNS response sizes. In this paper we study the actual adoption of ECDSA by DNSSEC operators, based on longitudinal datasets covering over 50% of the global DNS namespace over a period of 1.5 years. Adoption is still marginal, with just 2.3% of DNSSEC-signed domains in the .com TLD using ECDSA. Nevertheless, use of ECDSA is growing, with at least one large operator leading the pack. And adoption could be up to 42% higher. As we demonstrate, there are barriers to deployment that hamper adoption. Operators wishing to deploy DNSSEC using current recommendations (with ECDSA as signing algorithm) must be mindful of this when planning their deployment.
    Original languageEnglish
    Title of host publication2016 12th International Conference on Network and Service Management (CNSM)
    PublisherIEEE
    Pages258-262
    Number of pages5
    ISBN (Electronic)978-1-5090-3236-5
    DOIs
    Publication statusPublished - 19 Jan 2017
    Event12th international Conference on Network and Service Management, CNSM 2016 - Montreal, Canada
    Duration: 31 Oct 20164 Nov 2016
    Conference number: 12
    http://www.cnsm-conf.org/2016/

    Conference

    Conference12th international Conference on Network and Service Management, CNSM 2016
    Abbreviated titleCNSM 2016
    Country/TerritoryCanada
    CityMontreal
    Period31/10/164/11/16
    Internet address

    Keywords

    • 2023 OA procedure

    Fingerprint

    Dive into the research topics of 'On the Adoption of the Elliptic Curve Digital Signature Algorithm (ECDSA) in DNSSEC'. Together they form a unique fingerprint.

    Cite this