1. A Longitudinal, End-to-End View of the DNSSEC Ecosystem
Chung, Taejoong and van Rijswijk-Deij, Roland and Chandrasekaran, Balakrishnan and Choffnes, David and Levin, Dave and Maggs, Bruce M and Mislove, Alan and Wilson, Christo, 2017
Presented by – Kalyan

2. Motivation
Even after 20 years, DNSSEC remains misconfigured in most of the zones.
Complexity of the infrastructure
Security compliance, Improved Automation, Auditing of DNSSEC Management.
Re-examine the validation of the queries to the server logs from the authoritative nameservers, which is used to study DNSSEC enabled resolver behaviour.

3. Introduction DNS DNSSEC How is it different ? CNAME, MX, NS, A
DS, DNSKEY, RRsigs
How is it different ?
Provides Authentication and Integrity

4. Paper Summary
1 Study of DNSSEC deployment from root zone to the child zone and validation by the resolver
2 Study on KSKs and ZSKs – PKI Infrastructure
3 RRsigs, DNSKEY, DS [Other resource records include NSEC, NSEC3 CDNSKEY, AND CDS]
4 Active Measurements – 59K Resolvers, 150K Domains
Key Rollover
6 Daily, Hourly Dataset – TTL of the cached records

5. DNSSEC Cache poisoning
An old idea which hasn’t been incorporated completely, improper Key Mismanagement.
Most of them are incoherently managed

6. Resolver And Root Do Bit – 1, 0
DNSSEC Aware Resolvers – request and validate
DNSSEC Aware – Root Zone – Authoritative Name Servers – Resolvers
Publishing the DNSKEY to the parent domain, as a DS record, which contains the hashed DNSKEY KSK.
Luminati HTTP/S Proxy Service – 400k end hosts – 59k Resolvers

7. Findings TTL of cached records. <= 1 Hour, => 1 Hour
Key Rollover
DNSKEY- DS Records
Weak Key
Length of Keys – 1024 bits is not adequate

8. Findings [Cont..] SOA Records – Cannot be validated
No SOA records being signed
DS Records - Incorrect
Does not match the KSKs

9. Criticism
Active measurements could have been incorporated for better results
Other records were not available for the study. No explanation or very little insight about the records.

10. THANK YOU