RHINE: Robust and High-performance Internet Naming with E2E Authenticity
summary
RHINE replaces DNSSEC’s fragile chain with an end-entity PKI plus a novel public logging service called Delegation Transparency, formally verified in Tamarin and implemented as a prototype. It issues certificates for delegated zones offline, tolerates compromise of all but one trusted entity, and prevents parent-zone misissuance. Performance tests show the offline protocol issues about 20 million certificates per day on commodity servers and the online resolver adds lower latency than DNSSEC under an 80% cache hit workload.
AI-written summary · about
chapters (9)
- 0:00RHINE naming system
- 1:06DNS security limitations
- 3:15Rethinking DNS authentication
- 5:45RHINE trust model
- 7:56Offline delegation in RHINE
- 9:18Formal security verification
- 10:47Deployability comparison
- 12:10RHINE prototype performance
- 13:35Conclusion and future plans
related talks
36mEncrypted DNS from Boot to Runtime: A Zero Trust Milestone in RHEL
16mIceberg: Automated Verification of DNS Authoritative Engines via Just-in-Time...
46mDNSSEC
34mUsing DNS as a layer of defense
01h 27mDNS at 30
12mYour Shield is My Sword: A Persistent Denial-of-Service Attack via the...
27mA Longitudinal, End-to-End View of the DNSSEC Ecosystem
19mSecuring DNSSEC with Ritual and Ceremony