DNSSUX - Why DNSSEC Makes Us Weaker

DNSSUX - Why DNSSEC Makes Us Weaker

Explore the complexities and potential vulnerabilities of DNSSEC in this 23-minute conference talk from Derbycon 2016. Delve into the hierarchical structure of DNS and how DNSSEC implements a Public Key Infrastructure similar to X.509 for TLS. Examine the signing process of DNS records by parent nodes in zones and understand the role of NSEC records in DNSSEC-protected names. Learn about the critical reconnaissance step of zone enumeration for malicious actors and the evolution of NSEC to NSEC3 for improved protection. Discover CloudFlare's innovative "Black Lies" and DNS Shotgun approaches to DNS security. Conclude by considering the challenges in securing DNS and the ongoing search for effective solutions in this complex domain.