Saint KeyTrap, Who Jammed the Resolvers

Patron of DNSSEC resolvers, keys that never end, and standards written with too much zeal.

Life

In February 2024 researchers at ATHENE, the German national cybersecurity research centre, revealed that DNSSEC's own rules told resolvers to try every combination of a zone's keys and signatures. A response built with many keys and many signatures was enough to keep a resolver busy for hours. The flaw had been in the standard for about twenty-five years; the big public resolvers and DNS software vendors coordinated a fix before the announcement.

Prayer

O Saint KeyTrap, who makes us try every key in every lock, teach our resolvers when to stop. Amen.

How to celebrate

Celebrated by updating BIND, Unbound, PowerDNS and friends to versions that cap the attempts.

Try every key, and you'll never open a door.