Automated private key recovery for DNSSEC
Download
1 / 8

Automated private key recovery for DNSSEC Colorado State University, CS 681 John Tesch - PowerPoint PPT Presentation


  • 64 Views
  • Uploaded on

Automated private key recovery for DNSSEC Colorado State University, CS 681 John Tesch. Motivation. DNSSEC provides for asymmetric keys but does not address the issue of lost keys. The key regeneration process may affect performance of DNS servers

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Automated private key recovery for DNSSEC Colorado State University, CS 681 John Tesch' - argyle


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

Automated private key recovery for DNSSEC

Colorado State University, CS 681

John Tesch


Motivation
Motivation

  • DNSSEC provides for asymmetric keys but does not address the issue of lost keys.

  • The key regeneration process may affect performance of DNS servers

  • Multiple pairs of keys create conflicts among DNS servers


Asymmetric keys
Asymmetric keys

  • The public key is stored in the KEY resource record and is backed up.

  • The private key is stored and protected in the file system of the DNS server

  • The public key can be reloaded

  • The loss of the private key requires a re-computation of a new pair of keys


Simplistic approach
Simplistic Approach

  • Take the private key, Sprv, and encrypt it with the public key of the parent DNS server, Ppub. m = [Sprv,Ppub]

  • Provides some redundancy, but still a single point of failure

  • Can be compromised or lost


Our approach
Our Approach

  • Take the private key, Sprv, and encrypt it with the public key of the parent, Ppub. m = [Sprv,Ppub]

  • Divide the encryption, m, into parts or shares. m\n

  • Distribute and encrypt the shares to subordinate DNS servers (child).

  • [m/n,Cpub]


K n threshold scheme
(k,n)=threshold scheme

  • A dealer shares a secret key between n parties

  • Each party receives a share

  • A group of any k participants can cooperate to reconstruct the shares

  • No group of k-1 participants can get any information about the secret


Algorithm modification
Algorithm modification

  • Use Shamir’s (k,n)-threshold scheme

  • Encrypt the shares with the public keys of the DNS childern

  • Store the shares on the DNS database as a Resource Record


Conclusion
Conclusion

  • Using our method, private keys can be stored in plain sight.

  • The use of the (k,n)-threshold scheme allows for voting when recreating the private key

  • The distribution of the shares cannot be easily traced


ad