Roll, Roll, Roll your Root: A Comprehensive Analysis of the First Ever DNSSEC Root KSK Rollover
Roll, Roll, Roll your Root: A Comprehensive Analysis of the First Ever DNSSEC Root KSK Rollover
复制标题
滚动、滚动、滚动您的根：对首次 DNSSEC 根 KSK 轮转的综合分析
DOI：
10.1145/3355369.3355570
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
van Rijswijk-Deij, Roland
中科院分区：
文献类型：
--
作者：
Müller, Moritz;Thomas, Matthew;Wessels, Duane;Hardaker, Wes;Chung, Taejoong;Toorop, Willem;van Rijswijk-Deij, Roland
DNS安全扩展（DNSSEC）为互联网的命名系统增加了真实性和完整性。验证DNS中的信息的解析程序需要知道用于对DNS的根区域进行签名的加密公钥。在推出八年后，也就是原定日期一年后，该密钥于2018年10月首次被ICANN取代。ICANN认为这一事件（称为翻转）“取得了压倒性的成功”，在翻转期间，他们检测到“没有重大中断”。在本文中，我们独立跟踪了翻转的过程，从2017年导致其推迟的事件开始，直到2019年删除旧密钥。我们从DNS生态系统的多个Vantage位置收集了整个展期过程的数据。利用这些数据，我们研究了滚动的关键事件。这些事件包括导致翻转被推迟的遥测信号，解析器中实际翻转的近实时视图以及旧密钥被撤销后对DNS根的查询显着增加。我们的分析大大有助于确定在滚动期间观察到的挑战的原因。我们表明，虽然从最终用户的角度来看，滚动确实通过没有重大问题，有很多改进的机会和重要的经验教训，从发生在整个滚动期间的事件。根据这些经验教训，我们提出了改进的过程，为未来的翻车。
The DNS Security Extensions (DNSSEC) add authenticity and integrity to the naming system of the Internet. Resolvers that validate information in the DNS need to know the cryptographic public key used to sign the root zone of the DNS. Eight years after its introduction and one year after the originally scheduled date, this key was replaced by ICANN for the first time in October 2018. ICANN considered this event, called a rollover, "an overwhelming success" and during the rollover they detected "no significant outages".In this paper, we independently follow the process of the rollover starting from the events that led to its postponement in 2017 until the removal of the old key in 2019. We collected data from multiple vantage points in the DNS ecosystem for the entire duration of the rollover process. Using this data, we study key events of the rollover. These events include telemetry signals that led to the rollover being postponed, a near real-time view of the actual rollover in resolvers and a significant increase in queries to the root of the DNS once the old key was revoked. Our analysis contributes significantly to identifying the causes of challenges observed during the rollover. We show that while from an end-user perspective, the roll indeed passed without major problems, there are many opportunities for improvement and important lessons to be learned from events that occurred over the entire duration of the rollover. Based on these lessons, we propose improvements to the process for future rollovers.