Making DNSSEC future proof
Due to the COVID-19 crisis the PhD defence of Moritz Müller will take place (partly) online.
The PhD defence can be followed by a live stream.
Moritz Müller is a PhD student in the research group Design and Analysis of Communication Systems (DACS) and a research engineer at SIDN Labs, the research department of the registry of the Dutch ccTLD.nl. His supervisors are prof.dr.ir. A. Pras and prof.dr.ir. R.M. van Rijswijk-Deij from the Faculty of Electrical Engineering, Mathematics and Computer Science (EEMCS).
The Internet has become an essential part of our daily lives. This became even more clear during the COVID-19 pandemic when suddenly our interaction with others moved almost entirely online.
The Internet consists of a few core components. One of these core components is the Domain Name System (DNS). The DNS is responsible for translating names like www.utwente.nl to computer readable IP addresses, like 130.89.3.249. Virtually every time users want to visit www.utwente.nl or any other domain name, their computer looks up an IP address in the DNS.
The DNS protocol was not developed with security in mind. In the example above, an attacker could manipulate information in the DNS such that a domain name would direct users to a malicious website, instead of the website of the University of Twente. There, the attacker could, for example, try to infect the users' computers or serve them with misinformation.
The DNS Security Extensions (DNSSEC) address this vulnerability at its core. With DNSSEC, owners of domain names can digitally sign the information attached to their domain names. Everyone receiving this information can validate that it is correct. That means, that we can also be sure that 130.89.3.249 is actually the IP address of www.utwente.nl, thanks to DNSSEC.
DNSSEC relies on public key cryptography algorithms. Using insecure algorithms could allow attackers to forge signatures and thus manipulate information in the DNS unnoticed. This means that we could not trust any DNS message anymore.
Unfortunately, every algorithm, currently used in DNSSEC, can be broken by a technological development which has gained more traction in the last years: quantum computers. These computers have the potential to calculate some mathematical problems faster than the computers we use today. Two of those mathematical problems lay the foundation of every cryptographic algorithm used in DNSSEC. These algorithms are effectively broken as soon as a powerful enough quantum computer exists, thereby rendering DNSSEC useless. Luckily, the cryptographic community is currently working on cryptographic algorithms that can neither be broken by current computers nor by quantum computers, so called quantum-safe algorithms.
In this thesis, we take the first steps to prepare DNSSEC for the threat posed by quantum computers. Only when DNSSEC can transition to quantum-safe algorithms, we can trust the DNS, and consequentially the Internet, in the future. More concretely, we study which problems the DNS faces when introducing new algorithms in general and quantum-safe algorithms in particular. Then, we propose and evaluate solutions that makes it easier to replace algorithms in DNSSEC. Even though quantum computers might still be decades away, we show in this thesis that we need to start understanding and preparing the transition to quantum-safe algorithms now.
