DNSSEC Via a New Stub Resolver Presentation.pdf

《DNSSEC Via a New Stub Resolver Presentation.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、DNSSECviaaNewStubResolverhttps://getdnsapi.netIntro–DNSSECviagetdns,aNewStubResolverToday,SomethingforEveryone*Fourspeakers:Allison,Willem,Glen,NeelOutline-getdnsanditssecuritymission-DNSSECanditsmeaningtoapplications-getdns,theAPI-getdns,theopensourceimplementation-getdns,thecollaborativeopenso

2、urceproject*EveryonewholikesDNS,innovativeapplicationsecurity,opensource#getdnsapiAboutgetdnsgetdnsAPI=aDNSAPIspecification–resolvingnamesgetdnsAPI=createdbyandforapplicationsdevelopersgetdns=thefirstimplementationofthisspecificationgetdns=opensource,projecthousedattwoorganizationsgetdns=cored

3、eveloperswithsupport,andevenQAgetdnsmissionslogan:SecurityBeginswithaName#getdnsapiAboutDNSSECAglobaldistributeddatabasewithauthenticateddata#getdnsapiAboutDNSSECAglobaldistributeddatabasewithauthenticateddataWasn'titaboutprotectingusersagainstdomainhijacking?DNS=thephonebookoftheInternetNoto

4、riouslyinsecureDNSSECtotherescueYes,butitcanofferthatandsomuchmore.#getdnsapiRefresher–PublicKeyCryptoEncryptPrivateEncryptReadableEncryptedReadableEncryptedmessageSharedmessagemessagemessageDecryptPublicDecryptSymmetricencryptionAsymmetricencryption#getdnsapiRefresher–DNSintwoslidesZoneswithd

5、istributedauthority..com.net.orgoreilly.comgetdnsapi.net#getdnsapiRefresher–DNSintwoslidesZoneswithdistributedauthorityThreetypesofnameserversIterativequeryinggetdnsapi.net AAuthoritatives.net NSApplicationgetdnsapi.net Agetdnsapi.net AstubRecursiveResolvernetgetdnsapi.net NSOSgetdnsapi.net Aget

6、dnsapi.net Agetdnsapigetdnsapi.net A#getdnsapiDNSSEC–PublicKeyCrypto–SigningReadablemessageHashhashofmsgHashReadableReadableEqual?messagemessageEncryptDecrypthashofmsgsignaturesignaturePrivatePublicCreatesignatureVerifysignature#getdnsapiDNSSEC–PublicKeyCrypto–delegatingauthoritycReadablelibumess

7、agePReadablemessagesignatureHashcHashReadablelibumessagePclibuEncryptEncryptPhashsignaturehashofmsgsignaturePrivatePrivatesignatureBuildingthechainoftrustsignsthemessageauthorizes#getdnsapiDNSSEC–ChainofT