Resource Records for the DNS Security Extensions

Abstract

This document is part of a family of documents that describe the DNS Security Extensions (DNSSEC). The DNS Security Extensions are a collection of resource records and protocol modifications that provide source authentication for the DNS. This document defines the public key (DNSKEY), delegation signer (DS), resource record digital signature (RRSIG), and authenticated denial of existence (NSEC) resource records. The purpose and format of each resource record is described in detail, and an example of each resource record is given. This document obsoletes RFC 2535 and incorporates changes from all updates to RFC 2535. Arends, et al.

Design and Implementation of Security for HIMALIS Architecture of Future Networks

“…The DNR and HNR records are stored in the similar manner as DNSSEC [8] records. On top of that, we defined some new resource records such as HID and PK to store the host ID and public key, respectively.…”

“…For example, although HIP uses certificates and public keys to establish secured sessions between hosts, it does not cover the security of ID/locator mapping servers or registries. DNS Security (DNSSEC) [8] provides integrity protection of records retrieved from a DNS server. However, the DNS structure itself is not favorable for frequently updating the records in the server although it is favorable for faster and efficient retrieval of static records.…”

Managing DS Records from the Parent via CDS/CDNSKEY

“…The same argument applies to "CDNSKEY 0 3 0 0"; the value 3 in the second field is mandated by [RFC4034], Section 2.1.2.…”

Edwards-Curve Digital Security Algorithm (EdDSA) for DNSSEC

“…DNSSEC, which is broadly defined in [RFC4033], [RFC4034], and [RFC4035], uses cryptographic keys and digital signatures to provide authentication of DNS data. Currently, the most popular signature algorithm in use is RSA.…”