Improving PKI, BGP, and DNS Using Blockchain: A Systematic Review

CAA、CT 与 DANE 在证书部署中是否相互关联？一项 Web PKI 测量研究

Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study

本文通过对 400 万个热门域名的测量，研究 CAA、TLSA 和 CT 日志在证书部署中的关联性，发现 CAA 与 DNSSEC 部署相互割裂、CAA 语义约束常被突破，且 TLSA 记录维护质量较差。

How Effective is Multiple-Vantage-Point Domain Control Validation?

Multiple-vantage-point domain control validation (multiVA) is an emerging defense for mitigating BGP hijacking attacks against certificate authorities. While the adoption of multiVA is on the rise, little work has quantified its effectiveness against BGP hijacks in the wild. We bridge the gap by presenting the first analysis framework that measures the security of a multiVA deployment under real-world network configurations (e.g., DNS and RPKI). Our framework accurately models the attack surface of multiVA by 1) considering the attacks on DNS nameservers involved in domain validation, 2) consi…

From IP to transport and beyond: cross-layer attacks against applications

We perform the first analysis of methodologies for launching DNS cache poisoning: manipulation at the IP layer, hijack of the inter-domain routing and probing open ports via side channels. We evaluate these methodologies against DNS resolvers in the Internet and compare them with respect to effectiveness, applicability and stealth. Our study shows that DNS cache poisoning is a practical and pervasive threat. We then demonstrate cross-layer attacks that leverage DNS cache poisoning for attacking popular systems, ranging from security mechanisms, such as RPKI, to applications, such as VoIP. In a…

Nation-State Routing: Censorship, Wiretapping, and BGP

The treatment of Internet traffic is increasingly affected by national policies that require the ISPs in a country to adopt common protocols or practices. Examples include government enforced censorship, wiretapping, and protocol deployment mandates for IPv6 and DNSSEC. If an entire nation's worth of ISPs apply common policies to Internet traffic, the global implications could be significant. For instance, how many countries rely on China or Great Britain (known traffic censors) to transit their traffic? These kinds of questions are surprisingly difficult to answer, as they require combining i…

Support for public-key infrastructures in DNS

Traditionally, publicly available repositories of certificates offer the usual response to the problem of public key distribution. After issuing a public-key certificate a certification authority (CA) - in the frame of a particular public-key infrastructure (PKI) - will store and publish that certificate in a repository so that, at a later moment, end-users can search, find and retrieve public-key certificates. A known and still persisting drawback of this approach is that these repositories are not interconnected between each other on an Internet scale, therefore the search and retrieving of …