Delegated Private Key Distribution via DNS Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for distributing private keys in distributed messaging systems, such as email, are inefficient and error-prone, especially when multiple entities need to sign messages authorized against a shared domain, as they require manual processes and lack automated and secure key management and updates.
Innovation Solution
The system securely distributes delegated private keys via the Domain Name Service (DNS) using public key cryptography, allowing domain owners to automate the creation, updating, and publication of private/public key pairs, enabling third-party entities to sign messages on behalf of the domain owner while maintaining security and authenticity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If manual key distribution methods are used for multiple signing entities, then each entity can obtain a private key, but the process becomes error-prone and burdensome on the domain owner
Solution Approach 1:
The system enables self-service through automated key pair generation and distribution. The domain owner configures policy parameters once, and the system automatically generates key pairs, distributes private keys to authorized entities, and manages key rotation without requiring manual intervention for each key distribution event.
Solution Approach 2:
The domain owner pre-configures key distribution policies including key generation parameters, authorized entity identifiers, and rotation schedules before any key distribution occurs. This preliminary configuration enables the system to automatically execute key distribution according to the predetermined policy without ad-hoc manual intervention.
2Reliability
If manual key management processes are used, then key distribution can be performed, but key rotation becomes difficult and keys may not be updated timely
Solution Approach 1:
The system implements periodic key rotation based on pre-configured time intervals or event triggers. The automated system schedules and executes key generation and distribution at regular intervals or in response to security events, ensuring keys are updated timely without manual intervention and maintaining continuous security compliance.
3Adaptability or versatility
If subdomains are allocated to different signing organizations, then each organization has complete control, but multiple senders cannot share a single domain
Solution Approach 1:
The system introduces an automated key management intermediary that sits between the domain owner and multiple signing entities. This intermediary handles key pair generation, private key distribution, and public key registration, enabling multiple entities to sign messages for a single domain without requiring subdomain segmentation or complex manual coordination.
4Productivity
If automated key distribution is implemented, then key management becomes efficient, but security risks may increase without proper controls
Solution Approach 1:
The system applies different security measures to different aspects of key management: public keys are published in DNS for verification, private keys are distributed only to authorized entities through automated secure channels, and key rotation policies are applied based on entity-specific or time-specific criteria. This localized security approach maintains high automation while mitigating security risks through targeted controls.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A third party system generates a public-private key pair, the public key of the key pair being an encryption key, and the private key of the key pair being a decryption key. The third party system publishes the encryption key as a DNS record of a third party system. The third party system receives a request to sign a message on behalf of a domain owner, the message to be sent to a recipient, and accesses an encrypted delegated private key published by the domain owner via a DNS record of the domain owner, the encrypted delegated private key encrypted using the encryption key. The third party system decrypts the encrypted delegated private key using the decryption key, and generates a signature for the message using the delegated private key. The third party system sends the signature and the message to the recipient.