Rolling the Root Zone KSK. Matt Larson ICANN56 (Helsinki ) June 2016
|
|
- Jessie Henderson
- 5 years ago
- Views:
Transcription
1 Rolling the Root Zone KSK Matt Larson ICANN56 (Helsinki ) June 2016 matt.larson@icann.org 1
2 DNSSEC in the Root Zone Managed Jointly ICANN (IANA Functions Operator) Manages the KSK, same key since operations began in 2010 Quarterly the KSK signs the ZSK in a key ceremony Verisign (Root Zone Maintainer) Manages the ZSK, key changed quarterly The root DNSKEY RRset is managed in 10-day slots In coordination with US DoC NTIA per agreements 2
3 Activities Underway ZSK size increasing Activity managed by Verisign, covered elsewhere This activity will happen before... KSK changing ( rolling ) Separate but coordinated activities 3
4 Why Change the KSK? Primary reason: operational preparedness KSK has no expiration date Currently no weakness But no key should live forever: bad cryptographic practice Prefer to exercise rollover process under normal conditions As opposed to abnormal, such as key compromise Big challenge Involves countless/uncountable participants No test environment can cover all possibilities 4
5 Planned KSK Roll Dates Plans publically available mid-july, 2016 Key ceremonies Q ceremony (November): generate new KSK Q ceremony (February): KSK operationally ready DNS changes New KSK in root zone on July 11, 2017 New KSK signs DNSKEY RRset beginning October 11, 2017 Current KSK revoked on January 11, 2018 (Timing contingent on successful ZSK size increase) 5
6 Timeline Phase A Generation Phase B Replication Phase C First SKR Phase D Publication Phase E Rollover Phase F Revocation 2016 Q Q Q Q Q Q1 Slot 1 9 Slot 1 9 Slot 1 9 Slot 1 Slot 2 8 Slot 9 Slot 1 Slot 2 8 Slot 9 Slot 1 Slot 2 8 Slot 9 ZSK- post-publish ZSK-q1 ZSK-q1 ZSK-q1 ZSK-q1 post-publish ZSK-q2 pre-publish ZSK-q2 ZSK-q2 ZSK-q2 ZSK-q2 post-publish ZSK-q3 pre-publish ZSK-q3 ZSK-q3 ZSK-q3 ZSK- pre-publish publish publish publish revoke+sign publish publish publish New KSK created in 1st KMF New KSK replicated to 2nd KMF First SKR with new KSK signed First packet size increase Second packet size increase Rollover Delayed revocation of 6
7 If Issues Arise Plan includes back-out capability If necessary, can stay in current state or roll back at every phase Until old key revoked in Q Multiple back-out DNSKEY RRsets signed at each ceremony Back out can be immediate No need for extra key ceremony Extensive monitoring during each phase Near-real time analysis of root server traffic, observation of operational mailing lists and social media, etc. Criteria for triggering back out under development Will not be absolute but allow for operational discretion 7
8 Upcoming Activities Presenting the plan (July to December 2016) Informal feedback Presenting the new KSK (January to July 2017) New key will be introduced and publicized Follow Automated Updates (RFC 5011) July 11, 2017 through early
9 Changing Trust Anchors Trust anchors are configured data in DNSSEC validators If Automated Updates of DNSSEC Trust Anchors (RFC 5011) is enabled and working, the roll is automatic Otherwise manual intervention required Add the new KSK before October 11, 2017 (assuming all is on track) Remove the old KSK at a later date 9
10 Testing Resources Resources targeted for software developers Two third-party accelerated RFC 5011 test environments with sped up clocks Resources more suitable for operators Real time RFC 5011 test environment being developed by ICANN Roll a test zone trust anchor with actual 30-day Add Hold- Down timer 10
11 For More Information Join the mailing list: o Follow on Twitter o Hashtag: #KeyRoll Visit the web page: o 11
12 Engage with ICANN Thank You and Questions Reach me at: Website: icann.org twitter.com/icann gplus.to/icann facebook.com/icannorg weibo.com/icannorg linkedin.com/company/icann flickr.com/photos/icann youtube.com/user/icannnews slideshare.net/icannpresentations 12
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016 edward.lewis@icann.org 1 Motivation for this talk ICANN is about to change an important configuration parameter in DNSSEC
Root KSK Rollover Update (or, We're really doing it this time)
Root KSK Rollover Update (or, We're really doing it this time) Andres Pavez IANA LACNIC 29 / LACNOG 4 May 2018 What is the DNSSEC KSK? Two Components ("Keys") with a special mathematical bond Private KSK
Root Zone DNSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 51 51 KSK Rollover: An Overview ICANN is in the process of performing a Root Zone DNS Security Extensions (DNSSEC) Key Signing Key (KSK) rollover The Root Zone DNSSEC Key
2017 Root DNSSEC KSK Rollover. NANOG 70 June 6, 2017
2017 Root DNSSEC KSK Rollover Punky.Duero@iana.org NANOG 70 June 6, 2017 What is the Root Zone DNSSEC KSK? KSK The Root Zone DNSSEC Key Signing Key KSK is the top most cryptographic key in the DNSSEC hierarchy
2017 DNSSEC KSK Rollover. Guillermo Cicileo LACNIC March 22, 2017
2017 DNSSEC KSK Rollover Guillermo Cicileo LACNIC March 22, 2017 Purpose of this Talk 1 2 3 To publicize the new Root Zone DNSSEC KSK Provide status, upcoming events, and contact information Provide helpful
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
Root KSK Roll Update Webinar
Root KSK Roll Update Webinar Matt Larson, VP of Research 11 October 2017 1 Who has KSK-2017 configured as a trust anchor? Until recently, there was no way to know which trust anchors validators have configured
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
DNSSEC for the Root Zone. NZNOG Hamilton, NZ January 2010
DNSSEC for the Root Zone NZNOG Hamilton, NZ January 2010 Joe Abley, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
Reviewing New gtld Program Safeguards Against DNS Abuse. ICANN Operations and Policy Research 28 January 2016
Reviewing New gtld Program Safeguards Against DNS Abuse ICANN Operations and Policy Research 28 January 2016 Discussion Details This discussion is being recorded. Recordings and supporting materials will
Root KSK Roll Delay Update
Root KSK Roll Delay Update Data is good! David Conrad, CTO (channeling Roy Arends, ICANN Principal Research Scientist) 12 November 2017 1 Background When you validate DNSSEC signed DNS records, you need
Congratulations to Registries! New generic toplevel 500+ been delegated as a result of the New gtld Program. Many more gtlds are on the way.
Congratulations to Registries! 500+ New generic toplevel domains have been delegated as a result of the New gtld Program. Many more gtlds are on the way. 2 Customer Relations Domain Name Industry TRUST
DNS Risk Framework Update
Text Text 14 October 2014 DNS Risk Framework Update John Crain & Jacks Khawaja Chief SSR Officer; Enterprise Risk Director Agenda Text History Moving Forward Text History Defined Resiliency Model Text
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Recap DNS originally not designed with
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
Rights Protection Mechanisms: User Feedback Session
15 October 2014 Rights Protection Mechanisms: User Feedback Session Agenda Introduction (10) Panel & Interactive Discussion (50) o Trademark Clearinghouse o Sunrise Period o Trademark Claims Service o
THE BRUTAL WORLD OF DNSSEC
THE BRUTAL WORLD OF DNSSEC Patrik Fältström Head of Technology Netnod 1 Security Issues with DNS Zone Administrator Bad Data False Master Caching Resolver Zonefile Master Slave slave slave False Cache
Rolling the Root. Geoff Huston APNIC Labs March 2016
Rolling the Root Geoff Huston APNIC Labs March 2016 Use of DNSSEC Validation in Today s Internet Why is this relevant? Because the root zone managers are preparing to roll the DNS Root Zone Key Signing
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
RDAP Implementation. Francisco Arias & Gustavo Lozano 21 October 2015
RDAP Implementation Francisco Arias & Gustavo Lozano 21 October 2015 Agenda 1 2 3 History of Replacing WHOIS protocol gtld RDAP Profile RDAP Profile Details 4 5 Open Issues gtld RDAP Profile Conclusion
Root Zone DNSSEC KSK Rollover. DSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover ENOG 15 Edward.Lewis@icann.org FIRST TC September 11, 2017 5 June 2018 The Basics This talk is related to the Domain Name System, in particular,
Root KSK Roll Delay Update
Root KSK Roll Delay Update PacNOG 21 Patrick Jones, Sr. Director, Global Stakeholder Engagement 4 December 2017 1 Background When you validate DNSSEC signed DNS records, you need a Trust Anchor. A Trust
Managing the Root KSK Rollover, Step by Step for Operators
Managing the Root KSK Rollover, Step by Step for Operators Quickly spun by Edward.Lewis @ ICANN.ORG Changed-by: carlos @ lacnic.net LACNIC 27 Foz do Iguassu 1 Agenda What is the problem here? Some tools
RDAP Implementation. 7 March 2016 Francisco Arias & Gustavo Lozano ICANN 55 7 March 2016
RDAP Implementation 7 March 2016 Francisco Arias & Gustavo Lozano ICANN 55 7 March 2016 Agenda 1 2 3 Introduction [10 min] Differentiated Access [15 min] Thick Whois vs Registrar s RDAP [20 min] 4 5 Registrar
ICANN and the IANA. Elsa Saade and Fahd Batayneh MEAC-SIG August 2016
ICANN and the IANA Elsa Saade and Fahd Batayneh MEAC-SIG 2016 8 August 2016 Agenda 1 2 ICANN The IANA 2 Introduction to ICANN ICANN Video 4 ICANN To reach another person on the Internet you have to type
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
DNSSEC Validators Requirements
DNSSEC Validators Requirements draft-mglt-dnsop-dnssec-validator-requirements-05 Migault, Lewis, York IETF99 ToC Time Requirements Trust Anchor Requirements Bootstrapping / configuration TA Datastore Interaction
2017 DNSSEC KSK Rollover. DSSEC KSK Rollover
2017 DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover APNIC 44 Edward.Lewis@icann.org FIRST TC September 11, 2017 13 September 2017 DNSSEC Signing vs. Validation DNS Security Extensions Digital
KSK Roll Prepping: RFC Presented at RIPE 71 DNS WG November 19, 2015
KSK Roll Prepping: RFC 5011 Presented at RIPE 71 DNS WG November 19, 2015 Intro ICANN is preparing to roll the Root Zone KSK ICANN performs the management of the root zone KSK as part of fulfilling the
LGR Toolset (beta) User Guide. IDN Program 24 October 2017
LGR Toolset (beta) User Guide IDN Program 24 October 2017 1 Introduction to LGR Toolset (beta) Label Generation Rulesets (LGRs) specify metadata, code point repertoire, variant rules and Whole Label Evaluation
ICANN Policy Update & KSK Rollover
ICANN Policy Update & KSK Rollover Savenaca Vocea VP, Stakeholder Engagement - Oceania Commonwealth Broadband Pacific Forum 2017, Apia, Samoa 25-27 July 2017 1 Overview Coordinating with our partners,
IGO/INGO Identifiers Protection Policy Implementation. Meeting with the IRT 9 March 2016
IGO/INGO Identifiers Protection Policy Implementation Meeting with the IRT 9 March 2016 Agenda 1 2 3 Background on Policy and Current ICANN Work on IGO/INGO Protections Discussion of Implementation Deliverables
Universal Acceptance
Text #ICANN51 Text 15 October 2014 Universal Acceptance Francisco Arias Director, Technical Services Global Domains Division Edward Lewis Technical Services Sr. Manager Global Domains Division #ICANN51
LGR Toolset (beta) User Guide. IDN Program October 2016
LGR Toolset (beta) User Guide IDN Program October 2016 Introduction to LGR Toolset (beta) Label Generation Rulesets (LGRs) specify code point repertoire, variant rules and Whole Label Evaluation (WLE)
Algorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
Tyre Kicking the DNS. Testing Transport Considerations of Rolling Roots. Geoff Huston APNIC
Tyre Kicking the DNS Testing Transport Considerations of Rolling Roots Geoff Huston APNIC Five Years Ago The US KSK Repository The Amsterdam KSK Repository George Michaelson Five Years Ago Five Years Ago
Deploying the IETF s WHOIS Protocol Replacement
#ICANN51 16 October 2014 Deploying the IETF s WHOIS Protocol Replacement Francisco Arias Director, Technical Services Global Domains Division Edward Lewis Technical Services Sr. Manager Global Domains
RSSAC Activities Update. Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015
RSSAC Activities Update Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015 Agenda 1 2 3 Overview RSSAC002 Implementation Status Update RSSAC003: RSSAC Report on Root Zone TTLs 4 5 6 RSSAC
ICANN SSR Update. Save Vocea PacNOG17 Samoa 13 July 2015
ICANN SSR Update Save Vocea PacNOG17 Samoa 13 July 2015 Internet Corporation for Assigned Names and Numbers (ICANN) 1 2 3 Dedicated to keeping Internet Secure, Stable and Interoperable Formed in 1998 as
Name Collision Mitigation Update
15 October 2014 Name Collision Mitigation Update Francisco Arias Director, Technical Services Global Domains Division Karen Lentz Director, Operations & Policy Research Global Domains Division Agenda Introduction
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
That KSK Roll. Geoff Huston APNIC Labs
That KSK Roll Geoff Huston APNIC Labs The DNS may look simple But with the DNS, looks are very deceiving So lets talk DNSSEC DNSSEC introduces digital signatures into the DNS It allows a DNS resolver to
RDAP: What s Next? Francisco Arias & Marc Blanchet ICANN June 2015
RDAP: What s Next? Francisco Arias & Marc Blanchet ICANN 53 24 June 2015 Agenda 1 2 3 Introduction & Background RDAP Protocol Compliance Responses 4 5 6 Registry Specifics Registrar Specifics Issues, Conclusion
Multi Provider DNSSEC draft-huque-dnsop-multi-provider-dnssec-02. Shumon Huque March 22 nd 2018 DNSOP Working Group, IETF101, London, U.K.
Multi Provider DNSSEC draft-huque-dnsop-multi-provider-dnssec-02 Shumon Huque March 22 nd 2018 DNSOP Working Group, IETF101, London, U.K. Note to the DNS Camel* This document does not propose any new extensions
DNS Fundamentals. Steve Conte ICANN60 October 2017
DNS Fundamentals Steve Conte ICANN60 October 2017 Names and Numbers IP addresses easy for machines but hard for people IPv4: 192.0.2.7 IPv6: 2001:db8::7 People need to use names In the early days of the
Privacy and Proxy Service Provider Accreditation. ICANN58 Working Meeting 11 March 2017
Privacy and Proxy Service Provider Accreditation ICANN58 Working Meeting 11 March 2017 Agenda 13:45-15:00 15:00-15:15 15:15-16:45 Timeline Check; Policy Document Update; Third- Party Requests Break PSWG
Migrating an OpenDNSSEC signer (February 2016)
Migrating an OpenDNSSEC signer (February 2016) Contributors David Njuki Amreesh Phokeer Logan Velvindron Alain Aina Email david.njuki@afrinic.net amreesh@afrinic.net logan@afrinic.net aalain@trstech.net
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
DNSSEC KSK-2010 Trust Anchor Signal Analysis
DNSSEC KSK-2010 Trust Anchor Signal Analysis MAPRG @ IETF102 1 Overview Background: DNSSEC KSK rollover and plan Problems with the KSK rollover Case study analysis: difficulty in identifying old Trust
ICANN proposal to sign the root. ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb
ICANN proposal to sign the root ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb richard.lamb@icann.org protects the lookup like HTTPS/SSL protects the conversation is about security not
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson olafur@cloudflare.com How long does it take to? Post a new selfie on Facebook and all your friends to be notified few seconds
DNSSEC for the Root Zone. IEPG IETF 77 Anaheim, USA March 2010
DNSSEC for the Root Zone IEPG IETF 77 Anaheim, USA March 2010 Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC
DNSSECfor the Root ZoneIEPG IETF 77 Anaheim, USA March 2010
DNSSECfor the Root ZoneIEPG IETF 77 Anaheim, USA March 2010 Joe Abley, ICANN Matt Larson, VeriSign This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011 ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards of security
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
IANA Stewardship Transition & Enhancing ICANN Accountability
IANA Stewardship Transition & Enhancing ICANN Accountability What are the IANA Functions? The IANA Functions evolved in support of the Internet Engineering Task Force, and initially funded via research
Rolling the Root KSK. Geoff Huston. APNIC Labs. September 2017
Rolling the Root KSK Geoff Huston APNIC Labs September 2017 Will this break the Internet? Why? If we stuff up this trust anchor key roll then resolvers that perform DNSSEC validation will fail to provide
Internet Engineering Task Force (IETF) Request for Comments: Category: Best Current Practice ISSN: March 2017
Internet Engineering Task Force (IETF) Request for Comments: 8109 BCP: 209 Category: Best Current Practice ISSN: 2070-1721 P. Koch DENIC eg M. Larson P. Hoffman ICANN March 2017 Initializing a DNS Resolver
3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
DNSSec Operation Manual for the.cz and e164.arpa Registers
DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers version 1.9., valid since 1 January 2010 Introduction This material lays out operational rules that govern the work of the CZ.NIC association
Table of Contents. DNS security basics. What DNSSEC has to offer. In what sense is DNS insecure? Why DNS needs to be secured.
Table of Contents DNS security basics The basics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.3, 2013/09/13 11:46:36) Tuesday, Sep 17, 2013 Why DNS needs to
CIRA DNSSEC PRACTICE STATEMENT
CIRA DNSSEC PRACTICE STATEMENT 1. Introduction This DNSSEC Practice Statement ( DPS ) is a statement of security practices and provisions made by the Canadian Internet Registration Authority (CIRA). These
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
Applicability Statement: DNS Security (DNSSEC) DNSKEY Algorithm Implementation Status
Internet Engineering Task Force (IETF) S. Rose Request for Comments: 6944 NIST Updates: 2536, 2539, 3110, 4034, 4398, April 2013 5155, 5702, 5933 Category: Standards Track ISSN: 2070-1721 Applicability
Afilias DNSSEC Practice Statement (DPS) Version
Afilias DNSSEC Practice Statement (DPS) Version 1.07 2018-02-26 Page 1 of 8 1. INTRODUCTION 1.1. Overview This document was created using the template provided under the current practicing documentation.
RIPE NCC DNS Update. Wolfgang Nagele DNS Services Manager
RIPE NCC DNS Update Wolfgang Nagele DNS Services Manager DNS Department Services Reverse DNS for RIPE NCC zones Secondary for other RIRs K-root F-reverse (in-addr.arpa & ip6.arpa) Secondary DNS for cctlds
Impact of Rolling the Root KSK. Ed Lewis NetNod October 2015
Impact of Rolling the Root KSK Ed Lewis NetNod October 2015 edward.lewis@icann.org Agenda Background on DNS, DNSSEC ICANN as the KSK maintainer Valida=on of DNSSEC Impact of a Key Roll Note I have more
Richemont DNS Inc. DNS Practice Statement for the PANERAI Zone. Version 0.2
Richemont DNS Inc. DNS Practice Statement for the PANERAI Zone Version 0.2 1 Table of contents 1 INTRODUCTION...6 1.1 Overview... 6 1.2 Document Name and Identification... 6 1.3 Community and Applicability...
6 March 2012
6 March 2012 richard.lamb@icann.org www.majorbank.se=? 1.2.3.4 Get page Login page Username / Password Account Data DNS Resolver ISP www.majorbank.se = 1.2.3.4 DNS Server webserver www @ 1.2.3.4 Majorbank
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net Olaf M. Kolkman Question What would be the immediate and initial effect on memory, CPU and bandwidth resources if we were to deploy DNSSEC
DNS/DNSSEC and Domain Transfers: Are they compa:ble? Olafur Gudmundsson Steve Crocker Shinkuro inc.
DNS/DNSSEC and Domain Transfers: Are they compa:ble? Olafur Gudmundsson Steve Crocker Shinkuro inc. {ogud,steve}@shinkuro.com Background Shinkuro was asked by ORG to look into how DNSSEC affects transfers
5 DNS Security Extensions DNSSEC
Information Security 1 (InfSi1) 5 DNS Security Extensions DNSSEC Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) Andreas Steffen, 22.10.2013, 5-DNSSEC.pptx 1 Information
SSAC Advisory on DNSSEC Key Rollover in the Root
SSAC Advisory on DNSSEC Key Rollover in the Root Zone An Advisory from the ICANN Security and Stability Advisory Committee (SSAC) 07 November 2013 1 Preface This is an Advisory to the ICANN Board from
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012 NATIONAL ENGINEERING & TECHNICAL OPERATIONS DNSSEC Deployment Status We began working on this in 2008 (see Bmeline) We completed our
Packet Traces from a Simulated Signed Root
Packet Traces from a Simulated Signed Root Duane Wessels DNS-OARC DNS-OARC Workshop Beijing, China November 2009 Background We know from active measurements that some DNS resolvers cannot receive large
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
Signing the Root. MENOG 7 Istanbul, Turkey October 2010
Signing the Root MENOG 7 Istanbul, Turkey October 2010 Mehmet Akcin AS SEEN IN ROOT and my T-Shirt. IN DS 19036 8 2 49AAC11D7B6F6446702E54A 1607371607A1A41855200FD 2CE1CDDE32F24E8FB5 Since July 15, 2010
Expires: August 1998 February DNS Operational Security Considerations Status of This Document
DNS Security Working Group Donald E. Eastlake 3rd INTERNET-DRAFT CyberCash Expires: August 1998 February 1998 DNS Operational Security Considerations --- ----------- -------- -------------- Status of This
President s Report 2009
President s Report 2009 Paul Twomey, President and CEO Public Forum 2 March 2009 At Large Summit New gtld Program IDN cctld Fast Track 2010 Operating Plan and Budget Improving Institutional Confidence
Update on IANA Seoul, Republic of Korea October 2009
Update on IANA Seoul, Republic of Korea October 2009 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Documenting Processes Documenting IANA processes Technical
Assessing and Improving the Quality of DNSSEC
Assessing and Improving the Quality of DNSSEC Deployment Casey Deccio, Ph.D. Sandia National Laboratories AIMS-4 CAIDA, SDSC, San Diego, CA Feb 9, 2012 Sandia is a multiprogram laboratory operated by Sandia
DS TTL shortening experience in.jp
DS TTL shortening experience in.jp APRICOT2014 DNS Session 27 Feb 2014 Yoshiro YONEYA Copyright 2014 Japan Registry Services Co., Ltd. 1 What is DS? Establish a DNSSEC chain
Security and Stability Advisory Committee!! Activities Update! ICANN Los Angeles Meeting! October 2014! #ICANN51
Security and Stability Advisory Committee!! Activities Update! ICANN Los Angeles Meeting! October 2014! 1 Agenda 1. Overview (5 minutes) 2. Recent Achievements (5 minutes) 3. IANA Functions Stewardship
DNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How do you attack the DNS? A typical DNS query
Subject: SAC073: SSAC Comments on Root Zone Key Signing Key Rollover Plan - Design Teams Draft Report
5 October 2015 Subject: SAC073: SSAC Comments on Root Zone Key Signing Key Rollover Plan - Design Teams Draft Report The Security and Stability Advisory Committee (SSAC) welcomes the opportunity to comment
Documentation. Name Server Predelegation Check
Name Server Predelegation Check Doc. version: 1.4.1 Doc. status: Final Doc. date: 01.12.2015 Doc. name: Name Server Predelegation Check- -DNS Services-V1.4.1-2015-12-01 Copyright 2015 DENIC eg Imprint
Network Working Group. Category: Informational SPARTA, Inc. S. Crocker Shinkuro Inc. S. Krishnaswamy SPARTA, Inc. August 2007
Network Working Group Request for Comments: 4986 Category: Informational H. Eland Afilias Limited R. Mundy SPARTA, Inc. S. Crocker Shinkuro Inc. S. Krishnaswamy SPARTA, Inc. August 2007 Requirements Related
Update on ICANN Domain Name Registrant Work
1 Update on ICANN Domain Name Registrant Work Brian Gutterman Registrant Program Manager GDD Strategic Programs ICANN60 1 November 2017 2 Agenda Focus on Registrants Service and Information Domain Name
IPv6 How-To for a Registry 17th CENTR Technical Workshop
IPv6 How-To for a Registry 17th CENTR Technical Workshop Amsterdam, October 2007 Alvaro Vives (alvaro.vives@consulintel.es) Jordi Palet (jordi.palet@consulintel.es) Introduction Main steps to be undertaken
Towards a Process Flow. for. DNS Root Zone File Signature. with. KSK Rollover Provisions
CONNOTECH Experts-conseils inc. Towards a Process Flow for DNS Root Zone File Signature with KSK Rollover Provisions Thierry Moreau Document Number C004711 2008/11/24 (C) 2007 CONNOTECH Experts-conseils
APRICOT 2012 New Delhi, India February 21 - March 2
APRICOT 2012 New Delhi, India February 21 - March 2 richard.lamb@icann.org !! Fast pace of deployment at the TLD level!! Stable deployment at root!inevitable widespread deployment across core infrastructure
Understanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
Summary of the Impact of Root Zone Scaling
Summary of the Impact of Root Zone Scaling Date of Publication: October 2010 Executive Summary In February 2009, the ICANN Board requested a study be undertaken to examine the impact of the inclusion of
IDN Program Update to ccnso. Sarmad Hussain IDN Program Sr. Manager 10 Feb. 2015
IDN Program Update to ccnso Sarmad Hussain IDN Program Sr. Manager 10 Feb. 2015 Agenda Overview of IDN Program IDN TLD Program IDN cctld Fast Track IDN Tables IDN Implementation Guidelines Communications
DNSSEC Policy and Practice Statement. Anne-Marie Eklund Löwinder Quality and Security Manager
DNSSEC Policy and Practice Statement Anne-Marie Eklund Löwinder Quality and Security Manager amel@iis.se What is a DNSSEC Policy and Practice Statement (DPS)? A document that contains the DNSSEC Policy
SecSpider: Distributed DNSSEC Monitoring and Key Learning
SecSpider: Distributed DNSSEC Monitoring and Key Learning Eric Osterweil UCLA Joint work with Dan Massey and Lixia Zhang Colorado State University & UCLA 1 Who is Deploying DNSSEC? Monitoring Started From
ICANN PacNOG 11
ICANN Update @ PacNOG 11 Savenaca Vocea Nadi, 2 June 2012 The mission of The Internet Corporation for Assigned Names and Numbers ("ICANN ) To coordinate, at the overall level, the global Internet's systems