Daniel Dubnikov

First this paper measures and analyzes various trade-offs be-
tween different DNSSEC configurations, such as, NSEC, NSEC3, aggressive caching, and online vs. offline signing. These measurements expose a trade-off between (1) aggressive cashing DNSSEC configuration that provides excellent performance (higher robustness to DDoS attacks) but is vulnerable to zone enumeration attacks in addition to offline signing disadvantages, and (2) online signing DNSSEC configuration, that prevents. Second, following these, we suggest and evaluate an alternative, Adaptive DNS over QUIC, (AdaDoQ), an adaptive, efficient and secure communication layer between a DNS resolver and the authoritative servers, that offers a better trade-off between DDoS resiliency and security. Under normal load conditions the resolver commu
nicates with each authoritative server with standard DNSSEC however,
when the traffic load increases, AdaDoQ switches to a QUIC connection
with heavily communicating authoritative server(s), for as long as the
traffic load is high. The public key of the authoritative ZSK (which is
verifiable through the DNSSEC chain of trust) is integrated into the symmetric key creation in QUIC to provide a DNSSEC level of authenticity
and security. AdaDoQ ensures DNS authenticity, good throughput, and
disables zone walking attacks, DNS hijacking, and cache poisoning.

Several different DNSSEC configurations have been suggested in recent years in an attempt to address different security and privacy issues in the DNS system. In this presentation we briefly review, and analyse the performances of different configurations using a baseline throughput measurement (based on DNSPERF). We show that while each configuration serves an important role by solving some issues (e.g.: Zone Walking, Scalability for Large Zones), the overall throughput of the system is degraded, and this opens the door to DDoS amplification attacks due to the much larger message size, and extra cryptography computations.

Our goal is to design and implement (PoC level implementation) of a high throughput communication link between DNS resolver and authoritative servers that provides proof of authenticity and at the same time disables zone waking attacks. The motivation is to provide the same level of security as DNSSEC without the poor performances that come with it during a flood of NX requests attack, and without opening the door to zone walking attacks.

We designed and implemented an adaptive communication protocol between recursive resolver and authoritative servers with the above properties. We implemented a PoC that works (with Knot servers) at a throughput close to that of the standard DNS protocol, w/o DNSSEC (20,500 rps, requests per second, compared to 23,500 rps in plain DNS). We note that if one is willing to scarify and enable zone walking attacks, then a much higher throughput solution is possible as demonstrated by the NSEC3 aggressive caching implementation in Knot.