Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

Securing DNSSEC Keys via Threshold ECDSA from Generic MPC

: Dalskov, Anders; Orlandi, Claudio; Keller, Marcel; Shrishak, Kris; Shulman, Haya


Chen, L.:
Computer Security - ESORICS 2020. 25th European Symposium on Research in Computer Security, ESORICS 2020. Proceedings. Pt.II : Guildford, UK, September 14-18, 2020, virtually
Cham: Springer Nature, 2020 (Lecture Notes in Computer Science 12309)
ISBN: 978-3-030-59012-3 (Print)
ISBN: 978-3-030-59013-0 (Online)
ISBN: 978-3-030-59014-7
European Symposium on Research in Computer Security (ESORICS) <25, 2020, Online>
Conference Paper
Fraunhofer SIT ()

Deployment of DNSSEC, although increasing, still suffers from many practical issues that results in a false sense of security. While many domains outsource zone management, they also have to outsource DNSSEC key management to the DNS operator, making the operator an attractive target for attackers. Moreover, DNSSEC does not provide any sort of protection in the case the operator itself decides to serve false information, for example, if it gets compromised.
In this work, we show how to use techniques from threshold ECDSA: (1) to protect keys such that domains do not reveal their signing keys to a DNS operator, and (2) to protect the operational integrity of DNS operator. As a result of being highly specialized, prior work on threshold ECDSA has focused on a limited set of threat models, and none have so far considered techniques to amortize signature generation. Our work takes a different approach and presents a generic technique for obtaining a threshold ECDSA protocol from any secure multiparty computation protocol that works over an appropriate finite field. We show how this technique lends itself to very efficient threshold signing protocols by comparing it against state-of-the-art protocols from both academia and industry. For similar threat models, our protocols are as fast as the previous best protocol in terms of signing, and up to an order of magnitude faster for key generation on a fast network. Finally, we show how to integrate our application into a widely used DNS management software and demonstrate through experiments the overhead compared to traditional DNSSECs.