A Threshold Cryptographic Backend for DNSSEC Francisco Cifuentes - - PowerPoint PPT Presentation

▶
a threshold cryptographic backend for dnssec
SMART_READER_LITE
LIVE PREVIEW

A Threshold Cryptographic Backend for DNSSEC Francisco Cifuentes - - PowerPoint PPT Presentation

Sep 22, 2022 360 likes •508 views

A Threshold Cryptographic Backend for DNSSEC Francisco Cifuentes francisco@niclabs.cl 1 Key Management Implementations Back to ICANN 40 2 Key Management Implementations Needs Zones need to be re-signed PKCS#11 periodically. Keys

slide-1
SLIDE 1

1

A Threshold Cryptographic Backend for DNSSEC

Francisco Cifuentes

francisco@niclabs.cl

slide-2
SLIDE 2

2

Key Management Implementations

Back to ICANN 40

slide-3
SLIDE 3

3

Key Management Implementations

HSM

Needs

  • Zones need to be re-signed

periodically.

  • Keys must not be cloned.

Problems

  • Hardware fails.
  • HSM are expensive.
  • SoftHSM can be vulnerable.

PKCS#11

slide-4
SLIDE 4

4

What was proposed?

A Threshold Cryptographic Backend.

PKCS#11

Threshold Cryptographic Backend

Threshold Cryptographic backend

slide-5
SLIDE 5

5

Our work with OpenDNSSEC

PKCS#11

Threshold Cryptographic Backend

slide-6
SLIDE 6

6

  • Distributed
  • Fault T
  • lerant
  • Robust
  • Secure

Cryptographic backend

Properties of the system

slide-7
SLIDE 7

7

  • Distributed

– Private key is split into shares and distributed

among n nodes.

– The signing procedure is called in each of the

n nodes.

Properties of the system

slide-8
SLIDE 8

8

  • Fault-T
  • lerant

– A subset of nodes can fail and the signing

process will be completed succesfully.

Properties of the system

slide-9
SLIDE 9

9

  • Robust

– Failures and attacks can be reduced

implementing nodes in both difgerent programming languages and operative systems.

Properties of the system

slide-10
SLIDE 10

10

  • Secure

– No one holds the complete private key. – More than k nodes have to be endangered to

authorize faked signatures.

Properties of the system

slide-11
SLIDE 11

11

What it is?

  • Basically, a PKCS#11 API

provider.

  • It uses the Threshold

Cryptographic Backend implemented then.

  • It actually signs DNS records.
slide-12
SLIDE 12

12

What it is not?

  • A fully compliant

PKCS#11 implementation.

slide-13
SLIDE 13

13

Future work

  • Complete the PKCS#11 implementation,

in order to make it usable directly from BIND (or any other software).

  • T

est on a real zone set.

slide-14
SLIDE 14

14

Questions?

Francisco Cifuentes

francisco@niclabs.cl