Hierarchical Hash-Based Signatures for Quantum-Resistant DNSSEC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNSSEC algorithms such as RSA, DSA, and ECDSA are vulnerable to potential advances in cryptanalysis, including the threat of practical quantum computers, and known hash-based digital signatures are impractical due to their large size, posing a security risk to the Domain Name System (DNS).
Innovation Solution
Implementing efficient and compact hash-based digital signatures using recursive hash trees to sign batches of DNS resource records, leveraging existing DNSSEC architecture, and utilizing amortization to reduce signature size overhead without requiring architectural changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional asymmetric cryptography algorithms (RSA, DSA, ECDSA) are used for DNSSEC, then current security standards are met, but vulnerability to quantum computer attacks and future cryptanalysis occurs
Solution Approach 1:
The patent changes the cryptographic parameter basis from algebraic problems (RSA, DSA, ECDSA) to hash function properties (preimage resistance, collision resistance). This fundamental parameter change makes the system resistant to quantum computer attacks while maintaining security against future cryptanalysis, as hash-based cryptography is believed to be secure even against quantum computers.
2Reliability
If known hash-based digital signatures are used, then resistance to quantum computer attacks is achieved, but signature size becomes impractically large
Solution Approach 1:
The patent segments the signature process by introducing a hierarchical structure where a root signature covers multiple child signatures. Instead of requiring each individual signature to be independently verified, the system divides the verification into a root level and multiple child levels, allowing efficient verification of multiple records through a single root signature while maintaining quantum resistance.
Solution Approach 2:
The patent merges multiple individual signatures into a single root signature through the hierarchical structure. By combining the verification of multiple child signatures under one root signature, the system reduces the total signature size overhead while maintaining the security benefits of hash-based cryptography. This merging approach allows efficient verification of multiple DNS records without requiring separate full-length signatures for each.
3Reliability
If hash-based digital signatures are implemented with proper security, then future-proof authentication is achieved, but implementation complexity increases
Solution Approach 1:
The patent makes the hierarchical signature structure universal by designing it to work with existing DNSSEC infrastructure. The root signature and child signatures can be verified using standard DNSSEC validation mechanisms, making the system multi-functional and compatible with current implementations. This universality reduces implementation complexity by avoiding the need for completely new validation protocols while still providing future-proof authentication.
Data Source
AI summary
Techniques for signing internet data are disclosed. The techniques include accessing a plurality of internet data records. The techniques also include generating, using at least one electronic processor, leaf nodes from the plurality of internet data records, and constructing a recursive hash tree from the plurality of leaf nodes. The techniques also include deriving information sufficient to validate the root node, and publishing, in an internet public key infrastructure (PKI) as a synthesized public key, the information sufficient to validate the root node. The techniques also include providing, through the internet and as a signature on at least one of the plurality of internet data records, validation data including sibling path data from the recursive hash tree, such that an internet client validates the at least one of the internet data records using at least the validation data and the synthesized public key.