Making the Case for Elliptic Curves in DNSSEC

Abstract

The Domain Name System Security Extensions (DNSSEC) add authenticity and integrity to the DNS, improving its security. Unfortunately, DNSSEC is not without problems. DNSSEC adds digital signatures to the DNS, significantly increasing the size of DNS responses. This means DNS-SEC is more susceptible to packet fragmentation and makes DNSSEC an attractive vector to abuse in amplificationbased denial-of-service attacks. Additionally, key management policies are often complex. This makes DNSSEC fragile and leads to operational failures. In this paper, we argue that the choice for RSA as default cryptosystem in DNS-SEC is a major factor in these three problems. Alternative cryptosystems, based on elliptic curve cryptography (EC-DSA and EdDSA), exist but are rarely used in DNSSEC. We show that these are highly attractive for use in DNS-SEC, although they also have disadvantages. To address these, we have initiated research that aims to investigate the viability of deploying ECC at a large scale in DNSSEC.

The Performance Impact of Elliptic Curve Cryptography on DNSSEC Validation

“…r 3 ) operated by SURFnet. 3 We performed a live capture of traffic 2 See http://www.internetsociety.org/deploy360/dnssec/statistics/ 3 The National Research and Education Network in the Netherlands. from clients to these DNS resolvers and replayed this traffic against an instrumented DNS resolver.…”

“…This number is then compared against a benchmark figure indicating the number of signature validations that can be performed on a single modern CPU core for specific elliptic curve digital signature schemes. Just as in our earlier study on the use of ECC in DNSSEC [3], we examine multiple signature schemes. We include the two signature schemes currently standardised for use in DNSSEC, ECDSA P-256 and ECDSA P-384 [14], [15].…”

“…In earlier work [3] we relied on benchmarks from the eBACS project 7 to compare RSA and elliptic curve implementations. For this paper, we performed new benchmark tests.…”

“…The cryptographic strength of ECDSA P-256 is roughly equivalent to 3072-bit RSA [20]. The reason we make this comparison is because RSA 1024-bit is the most common signature type in DNSSEC at present, while ECDSA P-256 is the most attractive candidate to replace the current RSA-based schemes [3].…”

“…The root cause of these issues is the choice of RSA as default signature algorithm for DNSSEC. We showed that alternative signature schemes based on elliptic curve cryptography (ECC) effectively address the major issues in DNSSEC described above [3]. This is because ECC signatures are significantly smaller in size, leading to smaller DNS responses.…”