Articles
Likes on articles
Willem Toorop is a developer and researcher at NLnet Labs. NLnet Labs is a non-profit research lab dedicated to the development of Open Source software and open standards for the benefit of the Internet. NLnet Labs mission is to provide globally recognized innovations and expertise for those technologies that turn a network of networks into an Open Internet for All. At NLnet Labs, Willem's topics of interest are end-user security and privacy. Willem has actively researched how DNSSEC may be hampered for end-users and looked into strategies to overcome such roadblocks. The results of this research are incorporated in the getdns resolver library and its associates stub resolver Stubby. Besides his work on getdns and Stubby, Willem is also the primary maintainer and developer of the other NLnet Labs DNS libraries: ldns and Net::DNS.
• 16 min read
In this instalment of our Journeying into XDP series, we look into a passive BPF-program that enables us to plot graphs of DNS metrics without altering the DNS packets or touching the DNS software itself.
• 9 min read
Merely doing RPKI ROV does not provide any guarantees where your packet ends up. We conducted an experiment where we look into the impact of RPKI ROV on whether the packet ends up in the intended location based on active beaconing with two servers.
• 7 min read
As cryptographic analysis and related technologies advance, the signing algorithms at the heart of DNSSEC have to keep up. Moritz Müller and colleagues take a look at barriers on the road to more secure algorithms and discuss ways to make the journey faster.
• 16 min read
In this post, we at NLnet Labs look at how eXpress Data Path (XDP) can augment existing DNS software. We share our experiences of implementing Response Rate Limiting in XDP.
• 13 min read
Network programming using XDP has been on our radar (and if you are reading this, possibly on yours too!) for a while now. As tooling around this technology has vastly improved, we decided that it was time to finally get our hands dirty and see what this technology is all about.
Showing 5 article(s)
DNSSEC is not only just a security measure, it is also a viable alternative for the flawed PKIX based on Certificate Authorities. With DANE (the DNSSEC based PKIX) domain owners can vouch for their own services themselves, without needing the third party Certificate Authority. DANE is already increasingly used with infrastructural services such as SMTP, but currently uptake on end-points is hampered by interfering middle-boxes. Benno Overeinder wrote an excellent blog-post on these matters earlier this year: https://labs.ripe.net/Members/benno_overeinder/bringing-dns-security-and-privacy-to-the-end-user Work to overcome the issues in bringing DNSSEC to the end-user devices is in progress. For example with the DNSSEC chain TLS extension with which the DANE record including all DNSSEC data needed to authenticate a TLS session is transferred in band in the TLS session, bypassing the DNSSEC hampering middleboxes: https://datatracker.ietf.org/doc/draft-ietf-tls-dnssec-chain-extension/
Showing 1 comment(s)