ENHANCING
DIGITAL TRUSTWITH DNS-BASEDROOT CERTIFICATE
RE-VALIDATION
Roble Mumin

AGENDA
1.

Introduction

2.

Threats

3.

Approach4.

Detail5.

Configuration

March 2024

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

2THREATSCOMBATTING CYBERSECURITY THREATS THROUGH
ROOT CERTIFICATE RE-VALIDATION
WHY?

The Backbone ofDigital Security

Vulnerabilities andRisks

CERTIFICATES: Essential forauthentication and identification,
certificates underpin secure
digital communications,encryption, and access control,
forming the backbone ofcybersecurity infrastructure.

RISKS: Compromised certificates,
including spoofed or malicious
entries, pose severe threats,
breaking the security chain. They
enable attackers to decrypt data,
install malware, and conduct manin-the-middle attacks under aguise of legitimacy.

March 2024

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

Proactive Defensewith Root
Certificate
Re-Validation
SOLUTION: The DNS-based
Root Certificate Re-Validation
offers an approach to mitigatingthese risks by periodically revalidating root certificates. This
process ensures their legitimacy,
restoring trust and integrity to thesystem's security mechanisms.

3APPROACH
SECURING DIGITAL TRUST WITH DNS-BASED REVALIDATION AND DEDICATED DOMAINS
WHAT?

Mechanism
Leveraging DNS for Security:
Basic Mode utilizes the DNS
infrastructure, incorporating a
dedicated domain (e.g., .cert/.certs)
for storing and accessing hashedroot certificate data. This approachenables automated, real-time
validation of certificates before they
are trusted for use.

March 2024

The Role of theDedicated Domain

Mitigating
Vulnerabilities andEnhancing Trust

Dedicated Domain Advantage: By
assigning a dedicated domain(.cert/.certs) for certificate hashes,
Basic Mode creates a centralized,
easily accessible repository forvalidation purposes. This ensures that
only certificates verified against thistrusted DNS repository are accepted,
significantly reducing the risk ofcertificate spoofing or tampering.

Enhancing Cybersecurity: DNSbased Root Certificate Re-Validation
through the Basic Mode and its
dedicated domain mechanism
effectively mitigates vulnerabilities
associated with compromisedcertificates. It prevents the use ofunauthorized certificates, thereby
maintaining the integrity andtrustworthiness of digitalcommunications and transactions.

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

4DETAILCHOREOGRAPHY OF DNS-BASED CERTIFICATE REVALIDATION PROCESS
HOW?

Initiation of theQuery Process
Initiating Certificate
Validation: The process begins
when a client or system needs
to validate a certificate'sauthenticity. A DNS query isgenerated for the certificate's
hashed data stored under thededicated .cert/.certs domain,
initiating a verification request.

March 2024

Retrieving
Certificate Data via
DNS
DNS Response and Data Retrieval:
The DNS server responds to thequery with the certificate's hasheddata from the .cert/.certs domain.
This data includes the certificate's
hash value and any relevant
metadata necessary for validation,
ensuring that the information is
fetched in real-time and is up-to-date.

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

Verification andTrust
Establishment
Validating and Establishing
Trust: The client compares thefetched hash from the DNS
response against the local hash of
the certificate in question. If thehashes match, the certificate isvalidated as authentic andtrustworthy. This process effectively
mitigates risks of certificate
spoofing, tampering, or othermalicious interventions, reinforcing
the security infrastructure.
5CONFIGCONFIGURATION AND NAMESPACE STRUCTURE OF
THE .CERT/.CERTS DOMAIN
A LITTLE SOMETHING LIKE THIS!
TLD Domain Setup
and Configuration

Domain Configuration for Security:
The .cert/.certs TLD is specificallydesigned for storing hashed certificate
data. Its configuration is optimized for
security and efficiency, with strict
access controls and protocols ensuringthat only authorized queries canretrieve certificate hashes. DNSSEC isdeployed to guarantee the integrity andauthenticity of the data within thisdomain.

March 2024

Structuring theNamespace for
Certificate Data
Namespace Organization: Within
the .cert/.certs domain, certificate hashes
are organized using a structured naming
convention. This could involve segmenting
the namespace by certificate issuer, type,or validity period. For example,issuername.cert/issuername.certs could bea structure to store hashes of certificatesissued by a particular authority, facilitating
efficient and targeted queries.

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

Practical Usageand Retrieval
Mechanisms
Efficient Query and Retrieval: Tovalidate a certificate, a client
constructs a DNS query using thestructured namespace, targetingthe specific segment relevant to thecertificate in question. This query
retrieves the stored hash forcomparison, streamlining thevalidation process. Suggestions forbest practices include regular
updates to the DNS records toreflect changes in certificate status
and the use of caching mechanisms
to enhance query response times.

6CONTACT INFORMATION
Name: Roble Mumin
Position:Manager, KPMG Germany,
Cybersecurity in the Public Sector
Email:ietf@roblemumin.com

LinkedIn:March 2024

https://www.linkedin.com/in/roblemumin

IETF - HotRFC Lightning Talk – DNS Certificate Revalidation

7