Internship 2026 — PKI vs DANE: performance analysis of web protocols

• Supervisors: Simon Fernandez, Franck Rousseau
• Host group: LIG — Drakkar team
• Location: IMAG building, Grenoble
• Duration: 3 to 6 months
• Contact: simon.fernandez@grenoble-inp.fr
• Topics: networks, web, performance, research

Context #

During a TCP+TLS connection, the server must supply a certificate chain so that the client can authenticate it. That chain can be long and complex, and transferring all the necessary x509 certificates costs packet round trips at connection time. For mail servers, an alternative is seeing growing use: DANE. Built on DNS and authenticated by DNSSEC, DANE binds TLS certificates to services on domain names. The DNS infrastructure delivers that data to clients efficiently and keeps certificates cached for later reuse.

The work #

The successful candidate will join the Drakkar research team at the Laboratoire d’Informatique de Grenoble. The work is a performance comparison of the two ways of delivering certificate chains: the classic x509 certificates transferred during the TCP connection, and DANE+DNSSEC retrieved from the DNS. The comparison will center on the size of the packets exchanged, resolution time, and the ability to revoke certificates.

It will rest on extensive Internet measurement to collect the data needed for the comparison, together with analysis of DNS traffic and TLS certificates.

Reading the scientific literature on the subject will be necessary at the start of the internship in order to understand what is at stake. The analysis will need the scientific rigor required for its results to be reproducible.

Skills involved #

• Software development (Python or another language)
• Network protocols (TCP, TLS, DNS)
• Analysis of large volumes of data
• Working with unfamiliar data formats