A DNSSEC-based trust infrastructure

Abstract

The management of trust issues is central to a wide variety of digital systems, including systems dealing with electronic signature, authentication, or signing of applications. The common approach to trust management is the use of possibly signed trust lists and trust stores that enumerate trusted issuers. This approach fails to scale well and is thus unsuited for the implementation of larger trust infrastructures, as, for example, in support of a regional authentication infrastructure that enables a marketplace of services. This paper proposes to use the domain name system (DNS) with security extension (DNSSEC) as a base for the creation of a globally scalable and flexible trust infrastructure. As opposed to trust lists or stores, this also provides a vehicle for the efficient and secure dissemination of trust information among stakeholders.