ECM 1413 Domain Name System

Question 1

Domain Names

Answer 1

Devices are labelled with numeric IP addresses
Domain names are names for the numeric IP addresses

Question 2

What does the DNS do

Answer 2

DNS translates human-readable domain names into machine-readable IP addresses

Question 3

DNS requirements:

Answer 3

• Scalability
• Efficiency
• Reliability
• Maintainability

Question 4

Hierarchical design of domains

Answer 4

root
top level domains
second level domains
third level domains

Question 5

Root DNS Servers

Answer 5

• Top level, represented by (.)
• Thirteen logical root DNS servers
• Redundancy: each logical root server refers to multiple physical ones
• First point of contact if a DNS resolver can’t resolve a name

Question 6

Top-level Domain Servers

Answer 6

• Organisational (com, org, edu, gov, net)
• Geographical (uk, us, fr, eg, sp, de)
• Managed by ICANN (Internet Corporation for Assigned Names and Numbers)

Question 7

Authoritative Servers

Answer 7

• Hold the complete data for a domain’s DNS records
• Source of DNS responses
• To ensure maintainability, Authoritative servers must be updated automatically

Question 8

DNSSEC

Answer 8

• Attackers exploiting vulnerabilities in the DNS - it doesn’t check for credentials before accepting an answer.
• DNSSEC adds a lauer of trust on top of DNS
• The Domain Name System Security Extensions (DNSSEC) uses
  ○ Asymmetric Encryption
  ○ Hash Functions

Question 9

Asymmetric Encryption

Answer 9

• Uses a pair of keys (private and public)
• Using the encryption key as the public key (private communication)
• Using the decryption key as the public key (Signature verification of documents)

Question 10

Hash function

Answer 10

A hash function takes data of arbitrary size, M, and returns a fixed-size number, H(M)

Question 11

Creating a digital signature

Answer 11

• DNS data is put through hash function to give hash value (digital fingerprint)
• encrypt hash value with private key to give digital signature
• attach digital signature to dns data to give signed dns data

Question 12

Verifying a DNS response

Answer 12

• put the dns data of the signed dns data through the hash function to get its hash value
• decrypt the digital signature with the public key to get the hash value
• compare the two
• the dns response is valid if they match