Repository navigation
DNSSEC security audit #263
Description
Hey folks,
Since we're going to be using dnsjava in VeraId, I'm planning to request an independent security audit of your DNSSEC implementation, but I have a few questions I was hoping you could answer:
- Has there been any independent assessment of the DNSSEC implementation and, if so, is the report public? I couldn't find any reference to security audits but I wanted to double check.
- Would you be happy to engage directly with the team conducting the audit? It's unclear at this point whether this would be necessary or ideal. The alternative is to communicate the findings to me, and I'll pass them on to you.
- What's the best way to report security vulnerabilities? Assuming they find any and I'm the "liaison".
Thanks!
Activity
ibauersachs commentedon Sep 23, 2022
Hi, I would welcome an external security audit. So thanks in advance for arranging something.
Large parts of the DNSSEC code in dnsjava served as the prototype for the validator in Unbound, and you can still find identical comments in both code bases. Please let this know anyone doing the audit. A bug in Unbound's validator is likely to affect dnsjava as well. CVE-2017-15105 was such an example.
nresare commentedon Sep 23, 2022
As another developer with admin rights that is mostly absent (sorry) I also welcome an audit. For time sensitive issued feel free to reach out.
gnarea commentedon Sep 26, 2022
Thank you so much @ibauersachs and @nresare! That's really helpful.
I'll be applying for the audit in a few weeks, and it'll be part of a much bigger assessment of our projects and their key dependencies, so it might take 1-2 months to get it approved and maybe an extra month for the 3rd party auditors to start their work... So it'll probably happen early next year. I'll keep you posted.
ibauersachs commentedon Aug 1, 2023
@gnarea Is there any feedback you can share?
gnarea commentedon Aug 2, 2023
@ibauersachs, I had to defer the application once again, but I recently started the process and expect to complete it within a couple of weeks. Once I've submitted it, it'll take weeks or maybe months until it's approved.
gnarea commentedon Sep 30, 2023
Hey folks. I finally got round to requesting the security earlier this week. I'll let you know when they're ready to start. It'll probably be in a few months.
ibauersachs commentedon Sep 8, 2024
Another year has almost passed. Do you have anything to share?
gnarea commentedon Sep 9, 2024
Sorry, I forgot to post an update. Due to delays with the commissioning process, the team doing the audit only just started a few weeks ago. Third party dependencies will be assessed last, so the respective reports will be available near the end of the year or early next year.
phax commentedon Sep 24, 2025
Now I got curious as well ;-) Did you had some findings?
gnarea commentedon Oct 25, 2025
Hi everyone. I'm afraid that we lost the funding before the penetration testers got to dnsjava.