TLS Authentication and DNS Security Lecture Notes

A collection of vocabulary terms exploring the mechanisms of TLS authentication, DNS record types, common network attacks like spoofing and cache poisoning, and security measures like DNSSEC and encrypted DNS.

Root CA

A certificate authority whose certificate is installed in the operating system of a device, forming the top level of the chain of trust for authenticating TLS connections.

Intermediate CA

A middle-level certificate authority whose certificate is signed by a root CA; these entities handle the majority of certificate signing for servers to keep the root private key secure.

Chain of Trust

A hierarchical process where a root certificate authority vouches for an intermediate CA, which in turn vouches for the server, allowing a client to authenticate a TLS connection.

Indirection

A concept in naming systems where an identifier refers to an object that can change while the name remains the same.

DNS (Domain Name System)

The naming system for the Internet that resolves human-readable domain names into IP addresses.

Typo Squatting

A malicious practice of registering domain names that look similar to legitimate names, such as adding extra characters or using characters that look like others (e.g., using a $1$ instead of an l), to misdirect users.

A Record

A DNS record used to store and provide IP addresses associated with a domain name.

MX Record

The Mail Exchange record in DNS that specifies the mail servers responsible for receiving email on behalf of a domain.

NS Record

The Name Server record that identifies the specific servers authorized to provide DNS information for a domain.

C Name (CNAME)

Acronym for Canonical Name, which acts as a nickname or alias to redirect one domain name to another.

Text (TXT) Records

DNS records designed to hold arbitrary text data, commonly used for site verification and email security protocols like SPF and DMARC.

SPF (Sender Policy Framework)

A specific entry in a text record that lists the mail systems and IP addresses authorized to send email from a domain’s server.

Recursive Resolver

A DNS server, typically provided by an ISP or service like Cloudflare, that follows a recursive process from the root level down to the authoritative level to find a requested record.

Authoritative Name Server

The name server that holds the definitive "ground truth" records for a specific DNS zone.

Zone

A hierarchical chunk of the DNS space, such as the root zone, top-level domain (TLD) zones like .com, or individual domain zones.

TTL ($Time to Live$)

The amount of time, measured in seconds, that a DNS record is instructed to be cached before it must be deleted and refreshed.

Reflection Attack

A type of DDoS attack where an attacker forges a victim's IP address and sends DNS queries to resolvers, causing the resolvers to send responses back to the victim's IP.

Amplification Attack

A DDoS strategy that uses small DNS requests to generate very large responses, maximizing the volume of traffic sent to a victim.

DNS Spoofing

An attack where an actor pretends to be an authoritative name server and provides a fraudulent response to a resolver to redirect traffic to a malicious IP.

Kaminsky Style Cache Poisoning

A specific attack method where an attacker makes rapid requests for many unique subdomains to force a resolver to conduct new lookups, increasing the chances of the attacker successfully injecting a forged response into the cache.

DNSSEC (DNS Security Extensions)

A suite of protocols for adding cryptographic authentication to DNS data, ensuring that records come from the authorized zone and have not been modified.

DNSKEY

The public key published by an authoritative name server in a signed DNS zone, used to verify the cryptographic signatures of the records.

DS (Delegation Signer) Record

A record in a parent zone that contains a hash of a child zone's public key, establishing the cryptographic chain of trust in DNSSEC.

DNS over TLS (DoT)

A security protocol that encrypts DNS traffic between a client and a DNS server using port $853$.

DNS over HTTPS (DoH)

A security protocol that encrypts DNS queries via the HTTPS protocol on port $443$, often making the traffic harder to block as it blends in with standard web traffic.