arXiv subjects

Ali Sadeghi Jahromi

Publications and source records attributed to Ali Sadeghi Jahromi.

4 recordsLinked to original sources

arXiv2026

A Multi-Perspective Study of the Internet Shutdown in Iran

Iran conducted two nationwide Internet shutdowns in 2026, on January 8-25 and March 1-May 26, the latter lasting 86 days. We characterize both using three complementary measurement planes: six months of daily Censys scan data, BGP analysis of RIPE RIS snapshots spanning 2019-2026, and continuous per-prefix TCP probing from five vantage points. Each plane captures a different aspect of Iranian connectivity, and interpreting any one in isolation can be misleading. Unlike the partial BGP withdrawal of 2019, the 2022 and 2026 shutdowns were enforced by forwarding-plane discard while 80-88% of Iranian prefixes remained announced, leaving control-plane monitors blind. Restoration is similarly invisible to BGP, appearing in our forwarding-plane measurements as a centrally coordinated step. Censys host counts overshoot to approximately 3.6 times their pre-shutdown baseline after both restorations, rather than returning to baseline. Active probing reveals this inflation to be an artifact: most of the 3M apparent hosts are injected UDP/5353 responses synthesized by an on-path element at Iran's international gateway. Finally, AS-path classification shows that some apparent shutdown survivors were routed through foreign upstreams and never traversed the enforcement point. Together, these results show that measuring shutdowns requires reading multiple planes against one another, as no single signal reliably distinguishes genuine connectivity from its absence.

cs.NI↗

arXiv2025

Fine-grained CDN Delegation

The use of Content Delivery Networks (CDNs) has significantly increased over the past decade, with approximately 55 million websites currently relying on CDN services. Emerging solutions, such as Delegated Credentials (RFC 9345), lack fine-grained definitions of many critical aspects of delegation, such as the length of delegation chains, revocation mechanism, permitted operations, and a well-defined scope for said delegation. We present Delegation Certificates (DeCerts), which modify X.509 certificate standard and add new extensions to enable fine-grained CDN delegation. DeCerts allow domain owners to specify delegated and non-delegated subdomains, and control the depth of delegation extended by CDNs, which provides flexibility in delegation management. But more importantly, DeCerts are built on a new principle which provides full autonomy to domain owners-domain owners can issue DeCerts fully independent of Certificate Authorities (CAs), and thus have greater flexibility in policy control, including revocation methods. Such level of flexibility would be hard to match if CAs where to issue such certificates. Revoking a DeCert revokes delegation. We discuss multiple revocation mechanisms for a DeCerts balancing security, performance, and delegator control. We modify Firefox to support DeCert (i.e., proper validation) as a proof-of-concept, and test it to demonstrate the feasibility, compatibility of DeCerts with browsers and TLS/HTTPS protocols. DeCerts enhance the security, scalability, and manageability of CDN delegation, offering a practical solution for Internet services.

cs.NI↗

arXiv2025

A Survey and Evaluation Framework for Secure DNS Resolution

Since security was not among the original design goals of the Domain Name System (herein called Vanilla DNS), many secure DNS schemes have been proposed to enhance the security and privacy of the DNS resolution process. Some proposed schemes aim to replace the existing DNS infrastructure entirely, but none have succeeded in doing so. In parallel, numerous schemes focus on improving DNS security without modifying its fundamental two-stage structure. These efforts highlight the feasibility of addressing DNS security as two distinct but compatible stages. We survey DNS resolution process attacks and threats and develop a comprehensive threat model and attack taxonomy for their systematic categorization. This analysis results in the formulation of 14 desirable security, privacy, and availability properties to mitigate the identified threats. Using these properties, we develop an objective evaluation framework and apply it to comparatively analyze 12 secure DNS schemes surveyed in this work that aim to augment the properties of the DNS resolution process. Our evaluation reveals that no single scheme provides ideal protection across the entire resolution path. Instead, the schemes tend to address a subset of properties specific to individual stages. Since these schemes targeting different stages of DNS resolution are complementary and can operate together, combining compatible schemes offers a practical and effective approach to achieving comprehensive security in the DNS resolution process.

cs.CR↗

arXiv2025

ss2DNS: A Secure DNS Scheme in Stage 2

The absence of security and privacy measures between DNS recursive resolvers and authoritative nameservers has been exploited by both on-path and off-path attackers. Although numerous security proposals have been introduced in practice and in the literature, they often face deployability barriers and/or lack a compelling set of security and privacy properties, resulting in limited adoption. We introduce ss2DNS, a novel DNS scheme designed to mitigate the security and privacy vulnerabilities in the resolution process between resolvers and authoritative nameservers, while preserving efficiency by maintaining a single round-trip. ss2DNS takes advantage of a hierarchical trust model that does not rely on entities external to DNS zones, and delegates nameserver replicas within each zone to serve zone data securely for short, renewable time intervals. This design enables real-time security properties for DNS messages without requiring the duplication of long-term private keys on replicas, thereby minimizing exposure to compromise. We implement a proof of concept of ss2DNS for evaluation and show that for server-side processing latency, resolution time, and CPU usage, ss2DNS is comparable to less-secure schemes but significantly outperforms DNS-over-TLS.

cs.CR↗