DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014!
|
|
|
- Rodney Fleming
- 6 years ago
- Views:
Transcription
1 DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014!
2 Outline! What is DANE?! The TLSA Record! TLSA Browser Plugin! Generating the TLSA Record! Other uses for DANE! 2!
3 DNS-Based Authentication of Named Entities (DANE)! 3!
4 What is DANE?! A suite of RFCs describing how to represent and authenticate named entities in DNS and DNSSEC.! Named Entities:! Web sites, and other servers! addresses! Jabber/Chat IDs! RFC 6394 Use Cases and Requirements for DNS- Based Authentication of Named Entities (DANE)! RFC 6698 The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA! Internet-Drafts: S/MIME, SMTP, IPSEC, PGP, OTR! 4!
5 The CA Way! Browser Stored CAs! UTN-USERFirst-Hardware! Gandi Standard SSL CA! SSL Server Certficiate! 5!
6 The DANE/TLSA Way! Root Zone! signed with DNSSEC! ORG Zone! signed with DNSSEC! FreeBSD.org Zone! signed with DNSSEC! TLSA Record in! FreeBSD.org Zone! SSL Server Certficiate! 6!
7 The DANE/TLSA Way! TLSA can be used in other ways as we ll see next! Match only the public key part of a cert! Match a CA, rather than server cert! Specify new CA trust anchor! 7!
8 The TLSA Record! Verisign Confidential and Proprietary! 8!
9 TLSA Record Names! Similar to SRV records! Prefixed with port and protocol labels! For example, the TLSA record for is at:!!!_443._tcp. For SMTP submission, perhaps:!!!_587._tcp.mx1.freebsd.org.! 9!
10 TLSA Wire Data Format!! ! ! ! Cert. Usage Selector Matching Type /! /! / /! / Certificate Association Data /! / /! ! 10!
11 TLSA Record Fields! Certificate Usage! 0 = CA constraint! 1 = service certificate constraint! 2 = trust anchor assertion! 3 = domain-issued certificate! Selector! 0 = full certificate! 1 = public key only! Matching Type! 0 = exact match! 1 = match SHA-256 hash! 2 = match SHA-512 hash! Certificate Association Data! full certificate, or public key data, or hash value! 11!
12 Certificate Usage 0 CA constraint! The server s cert must be validated by the CA cert referenced in the TLSA record.! The CA cert must be part of the client s normal set of trusted authorities.! Any valid cert from the CA will be accepted.! But not other CAs known to the application.! Can get a new cert from same CA without updating TLSA record.! 12!
13 Certificate Usage 1 service certificate constraint! The server s cert must match the cert referenced in the TLSA record.! The cert must validate via the application s standard PKIX mechanisms.! Must update TLSA record each time server s cert changes.! 13!
14 Certificate Usage 2 trust anchor assertion! Specifies a new trust anchor for validating the server s cert.! Similar to usage 1, except the trust anchor need not be previously known to the application.! 14!
15 Certificate Usage 3 domain-issued certificate! Server s cert must match the TLSA record.! No other CA/PKIX validation necessary.! 15!
16 Size of Certificate Association Data! SHA octets! SHA octets! Public (e.g. RSA) key varies! 1024 bits 128 octets! 2048 bits 256 octets! 4096 bits 512 octets! Full certificate varies! 4096 bit RSA key approx 1400 octets! 16!
17 For Today! Certificate Usage = 3 (domain-issued)! Selector = 0 (full certificate)! Matching Type = 1 (SHA256 hash)! 17!
18 TLSA Browser! Plugin! 18!
19 CZ.NIC s DNSSEC/TLSA Validator add-on for Web Browsers! Indicates DNSSEC status! Indicates TLSA status! Works with:! Internet Explorer! Mozilla Firefox! Google Chrome! Opera! Apple Safari! 19!
20 Add-on Setup Screen! 20!
21 Zone is signed, but no TLSA record yet! 21!
22 Generating the! TLSA Record! Verisign Confidential and Proprietary! 22!
23 First we need the certificate! $ cat /etc/apache2/ssl/ BEGIN CERTIFICATE-----! MIIEYDCCAkgCARcwDQYJKoZIhvcNAQEFBQAwgZgxCzAJBgNVBAYTAlVTMQswCQYD! VQQIEwJJRDEPMA0GA1UEBxMGTW9zY293MRcwFQYDVQQKEw5QYWNrZXQgUHVzaGVy! czelmakga1uecxmcq0exgjaybgnvbamtevbhy2tldcbqdxnozxjzienbmskwjwyj! KoZIhvcNAQkBFhp3ZXNzZWxzQHBhY2tldC1wdXNoZXJzLmNvbTAeFw0xNDAzMjEx! NjQ4MzBaFw0yMzEyMTkxNjQ4MzBaMFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJ! RDEPMA0GA1UEBxMGTW9zY293MQ4wDAYDVQQKEwU4Mzg0MzEWMBQGA1UEAxMNd3d3! LjgzODQzLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ7GES+C! ROT0cbylBSpp+29iBunyD286/B6REv4aZvMq/l4a1vMwTi+OxZsjkc1IO0ghgWgr! V1gIMe65LtPo5qlqUp+MF/MdOn0BYRYKcDfYWhHh8+Ng5YZJ0GnZcZQdZB37OO5l! 7tJhF9NB38wKlpm/z7zVSt1Eil2GE+0DfY2ME5wzkglK7a7dzSdMICyKqukCZF5z! KkE6MZrQKrKRUn8UfQ8gUizyZK2tkrcd4FjfG7z38vRnStc7OWvDMET1XzBWN1n/! u0y5zmoagsyke4klobdyk910xvjn8gj2kauptx14ktprie0njcj5nxd3kfpki6q8! wqc+cu5rp6pzrmmcaweaatanbgkqhkig9w0baqufaaocageaah3/5zkdwjbf0+rr! Sb+b+IOZxoxTBNE49wwCYg++DZpKJOvrz0JWE0cJVpiqy1uwmMcntlGekf9pF2Yl! shoofbo00lvq9jgyt0q1uju8o9p5qpw+wm5gytemnssgo1/acy+aeztz8vqduhlx! ne+uzvqneda60ezqenjkszjdtogfyy10a8e/xznlgxvdrubhdhxhericyqgd8adv! HkJvGhkjv25vyZhMwo9NmCuyqmWEKcUePTtTBBQwURLFg/DZ+/WHMSVnLUZ1tiCF! MDs7TrJBAvznes7AM6ZkFnZJf2shCVfit5pQ1Or9ZR/ONUyD/2SYoy56O4yamBuj! HuyAKObnNYoZVzzfqWGL+77AtQIdpJwoXMeIdB7mEcdND6jBTTTDDN0V3sz+ds2m! CryCawl8t1x/4jfnWTW7CVDRn2TPH/TwyG32ag1XTKHw8nTq/umLgxwfCufs9ltJ! +twdpqgstd2926v+lzrql323gxtgu4uanhvdndw9e43rychzfx48ysudqmf6yqo1! Lgn6Cuev0s7LEN5iY6uVkrX0U+Y/HOKRiWrsJSD+e8FfL8EZ7JiIj235ZG02GKFP! an26ppylwkl90km5b9a9yufsddjgzz40cllz8jt0kqwwomfbji7iu/ujmb8m23ng! SRIG3sP95b9Hq0Ce6Ok1BKdbt5U=! -----END CERTIFICATE-----! 23!
24 Tools to Generate TLSA Records! !
25 Input to Shumon s TLSA Generator! 25!
26 Output from Shumon s TLSA Generator! 26!
27 Add TLSA Record to Zone! Edit zone file, etc! Wait an appropriate amount of time for cache expiry! Check it with dig! ; <<>> DiG <<>> _443._tcp. tlsa! ; (1 server found)! ;; global options: +cmd! ;; Got answer:! ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11434! ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4!! ;; OPT PSEUDOSECTION:! ; EDNS: version: 0, flags:; udp: 4096! ;; QUESTION SECTION:! ;_443._tcp. ;; ANSWER SECTION:! _443._tcp. 15!IN!TLSA! F4E90C509BF11748A9DEF05DAAD4A6435ED915ADDCC2E7B25E2FC FAB!! 27!
28 Check Browser and Add-on! 28!
29 Other Uses for! DANE/TLSA! Verisign Confidential and Proprietary! 29!
30 Postfix (SMTP)! Postfix now looks for TLSA records! 30!
31 S/MIME! draft-ietf-dane-smime! New SMIMEA record type! Records are named with hash of user part of address:! 3f51f4663b2b798560c5b9e16d6069a28727f62518c3a1b33f7f 5214._smimecert.example.com! 31!
32 OpenPGP Keys! draft-wouters-dane-openpgp-02! New OPENPGPKEY record type! openpgpkey-milter! attempt to automatically PGP encrypt plaintext s received by the MTA/MUA before relaying the message further towards the recipient(s).! 32!
33 Off-the-Record Messaging Protocol! draft-wouters-dane-otrfp-01! New OTRFP record type! 33!
34 Thank You! 2013 VeriSign, Inc. All rights reserved. VERISIGN and other trademarks, service marks, and designs are registered or unregistered trademarks of VeriSign, Inc. and its subsidiaries in the United States and in foreign countries. All other trademarks are property of their respective owners.!
Introduction to the DANE Protocol And Updates From IETF 88
Introduction to the DANE Protocol And Updates From IETF 88 Dan York, Senior Content Strategist Internet Society ICANN 48, Buenos Aires, Argentina November 20, 2013 A Quick Overview of DANE www.internetsociety.org
DNS security extensions
DNS security extensions ENOG IV / RIPE NCC Regional Meeting 23 24 October 2012, Moscow Security related RR CERT TLSA, SMIMEA* (DANE) CAA* SSHFP SPF PKIX problems Self-signed certificates (~48% web servers)
RSA and ECDSA. Geoff Huston APNIC. #apricot2017
RSA and ECDSA Geoff Huston APNIC It s all about Cryptography Why use Cryptography? Public key cryptography can be used in a number of ways: protecting a session from third party eavesdroppers Encryption
Introduction to the DANE Protocol
Introduction to the DANE Protocol ICANN 46 April 10, 2013 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC and other Internet technologies: Case Studies Tutorials
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
DANE, why we need it. Daniel Stirnimann Bern, 29. March SWITCH 1
DANE, why we need it Daniel Stirnimann daniel.stirnimann@switch.ch Bern, 29. March 2017 2017 SWITCH 1 Why do we trust this website? 2017 SWITCH 2 Why do we trust this website? 1. DNS lookup for www.credit-suisse.com
Let s Encrypt and DANE
Let s Encrypt and DANE CaribNOG 13 Barbados 18 Apr 2017 The Deploy360 Programme The Challenge: The IETF creates protocols based on open standards, but some are not widely known or deployed People seeking
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
Testing IPv6 address records in the DNS root
Testing IPv6 address records in the DNS root February 2007 Geoff Huston Chief Scientist APNIC Priming a DNS name server 1. Take the provided root hints file 2. Generate a DNS query for resource records
Innovative uses as result of DNSSEC
Innovative uses as result of DNSSEC AKA: Some happenings in the DANE* WG in the IETF. * DNS-based Authentication of Named Entities Some background... When you connect to https://www.example.com you use
Session initiation protocol & TLS
POSH bof Session initiation protocol & TLS Olle E. Johansson, IETF 87 Berlin, July 2013 oej@edvina.net * @oej v 1.42 Executive summary: SIP security filosophy: Let s put a nice and soft fluffy TLS wrapper
DANE Best Current Practice
DANE Best Current Practice draft-dukhovni-dane-ops-01 Viktor Dukhovni & Wes Hardaker IETF 87, Berlin July 2013 General DANE Guidelines (Type Independent) Large DNS payload issues Issues with large UDP
Protecting Privacy: The Evolution of DNS Security
Protecting Privacy: The Evolution of DNS Security Burt Kaliski Senior Vice President and CTO, Verisign NSF Technology Transfer to Practice in Cyber Security Workshop November 4, 2015 Agenda DNS Overview
Secure the connections of mail servers
Secure the connections of mail servers STARTTLS and DANE protect email traffic on the internet Factsheet FS-2017-01 version 1.1 4 April 2017 Traditionally, connections between mail servers have hardly
DANE verification test suite report
Faculty of Physics, Mathematics and Informatics Graduate School of Informatics System and Network Engineering MSc DANE verification test suite report Research Project 1 Hamza Boulakhrif hamza.boulakhrif@os3.nl
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
All over DNS BoF. ENOG III / RIPE NCC Regional Meeting May 2012, Odessa
All over DNS BoF ENOG III / RIPE NCC Regional Meeting 22 23 May 2012, Odessa BoF Agenda Regional ENUM status update DNS Addressing, Security DNS RPZ FRED and other NIC.CZ activities Tunnels over DNS We
Internet Engineering Task Force. Updates: 6698 (if approved) Intended status: Standards Track Expires: January 06, 2016 Two Sigma July 05, 2015
Internet Engineering Task Force Internet-Draft Updates: 6698 (if approved) Intended status: Standards Track Expires: January 06, 2016 S. Huque Verisign Labs D. James Verisign, Inc. V. Dukhovni Two Sigma
Pretty Good Privacy (PGP
PGP - S/MIME - Internet Firewalls for Trusted System: Roles of Firewalls Firewall related terminology- Types of Firewalls - Firewall designs - SET for E-Commerce Transactions. Pretty Good Privacy (PGP
How to get a trustworthy DNS Privacy enabling recursive resolver
How to get a trustworthy DNS an analysis of authentication mechanisms for DNS s Willem Toorop NLnet Labs (presenter) Melinda Shore Fastly Benno Overeinder NLnet Labs DNS over TLS What are the actors, and
Is your DNS server up-to-date? Pieter Lexis Senior PowerDNS Engineer April 22 nd 2018
lieter_ PowerDNS pieterlexis PowerDNS Is your DNS server up-to-date? Pieter Lexis Senior PowerDNS Engineer April 22 nd 2018 1 What s all this about? A DNS recap What is EDNS? Issues with EDNS on the internet
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
Architectural Overview INSIGHT Remote Monitoring Platform
Architectural Overview Remote Monitoring Platform 1950 Excel Drive Mankato, MN 56001 U.S.A. 1-800-635-4269 www.winland.com Summary Summary The platform provides remote environmental monitoring, data logging,
Root KSK Roll Update Webinar
Root KSK Roll Update Webinar Matt Larson, VP of Research 11 October 2017 1 Who has KSK-2017 configured as a trust anchor? Until recently, there was no way to know which trust anchors validators have configured
Root Zone DNSSEC KSK Rollover. DSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover ENOG 15 Edward.Lewis@icann.org FIRST TC September 11, 2017 5 June 2018 The Basics This talk is related to the Domain Name System, in particular,
ECE 435 Network Engineering Lecture 7
ECE 435 Network Engineering Lecture 7 Vince Weaver http://web.eece.maine.edu/~vweaver vincent.weaver@maine.edu 25 September 2018 HW#3 was Posted Announcements 1 HW#2 Review C code will be discussed next
Research Project 1. Extended Validation using DNSSEC
University of Amsterdam System & Network Engineering Research Project 1 Extended Validation using DNSSEC Authors: Danny Groenewegen danny.groenewegen@os3.nl Pieter Lange pieter.lange@os3.nl Coordinators:
DNSSEC for ISPs workshop João Damas
DNSSEC for ISPs workshop João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC Overview of zone signing DNSSEC validation trust anchors validation impact of enabling validation debugging
Internet Engineering Task Force (IETF) Request for Comments: Category: Standards Track ISSN: October 2015
Internet Engineering Task Force (IETF) V. Dukhovni Request for Comments: 7671 Two Sigma Updates: 6698 W. Hardaker Category: Standards Track Parsons ISSN: 2070-1721 October 2015 The DNS-Based Authentication
Bugzilla ID: Bugzilla Summary:
Bugzilla ID: Bugzilla Summary: CAs wishing to have their certificates included in Mozilla products must 1) Comply with the requirements of the Mozilla CA certificate policy (http://www.mozilla.org/projects/security/certs/policy/)
CS 3640: Introduction to Networks and Their Applications
CS 3640: Introduction to Networks and Their Applications Fall 2018, Lecture 19: Application Layer III (Credit: Prof. Phillipa Gill @ University of Massachusetts) Instructor: Rishab Nithyanand Teaching
Public Key Infrastructures
Public Key Infrastructures Ralph Holz Network Architectures and Services Technische Universität München November 2014 Ralph Holz: Public Key Infrastructures 1 Part 3: Proposals to enhance or replace X.509
Cryptography SSL/TLS. Network Security Workshop. 3-5 October 2017 Port Moresby, Papua New Guinea
Cryptography SSL/TLS Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea 1 History Secure Sockets Layer was developed by Netscape in 1994 as a protocol which permitted persistent
Key Management and Distribution
Key Management and Distribution Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-14/
DNSSEC for ISPs workshop.! João Damas
DNSSEC for ISPs workshop!!! João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC (30 ) Overview of zone signing (30 ) DNSSEC validation (60 ) trust anchors validation impact of enabling
DNS Security DNSSEC. *http://compsec101.antibo zo.net/papers/dnssec/dnss ec.html. IT352 Network Security Najwa AlGhamdi
DNS Security DNSSEC *http://compsec101.antibo zo.net/papers/dnssec/dnss ec.html 1 IT352 Network Security Najwa AlGhamdi Introduction DNSSEC is a security extensions to the DNS protocol in response to the
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 11: Public Key Infrastructure Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Public key infrastructure Certificates Trust
5 DNS Security Extensions DNSSEC
Information Security 1 (InfSi1) 5 DNS Security Extensions DNSSEC Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) Andreas Steffen, 22.10.2013, 5-DNSSEC.pptx 1 Information
SSL/TLS and Why the CA System is Broken
SSL/TLS and Why the CA System is Broken or: How China can read your email James Schwinabart james@schwinabart.com September 6, 2011 What is SSL/TLS? Secure Sockets Layer or Transport Layer Security A protocol
That KSK Roll. Geoff Huston APNIC Labs
That KSK Roll Geoff Huston APNIC Labs The DNS may look simple But with the DNS, looks are very deceiving So lets talk DNSSEC DNSSEC introduces digital signatures into the DNS It allows a DNS resolver to
DANE/DNSSEC/TLS Testing in the Go6lab. Jan Žorž, Internet Society
DANE/DNSSEC/TLS Testing in the Go6lab Jan Žorž, Internet Society zorz@isoc.org Acknowledgement I would like to thank Internet Society to let me spend some of my ISOC working time in go6lab and test all
Cryptography and Network Security. Sixth Edition by William Stallings
Cryptography and Network Security Sixth Edition by William Stallings Chapter 19 Electronic Mail Security Despite the refusal of VADM Poindexter and LtCol North to appear, the Board's access to other sources
EDNS Compliance. Mark Andrews
EDNS Compliance Mark Andrews marka@isc.org DataSets Root and TLD servers Alexa Top 1000 Alexa Bottom 1000 of Top 1Million GOV servers from Alexa Top 1Million AU servers from Alexa Top 1Million Methodology
Chapter 19. Domain Name System (DNS)
Chapter 19 Domain Name System (DNS) TCP/IP Protocol Suite 1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. OBJECTIVES: To describe the purpose of DNS. To define
DNS and DNSSEC Management and Monitoring Changes Required During A Transition To DNSSEC. Wes Hardaker
DNS and DNSSEC Management and Monitoring Changes Required During A Transition To DNSSEC Wes Hardaker Overview Business Model Changes Relationship Requirements Relationship with
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
COSC 301 Network Management. Lecture 15: SSL/TLS and HTTPS
COSC 301 Network Management Lecture 15: SSL/TLS and HTTPS Zhiyi Huang Computer Science, University of Otago COSC301 Lecture 15: SSL/TLS and HTTPS 1 Today s Focus WWW WWW How to secure web applications?
Security by Any Other Name:
Security by Any Other Name: On the Effectiveness of Provider Based Email Security Ian Foster, Jon Larson, Max Masich, Alex C. Snoeren, Stefan Savage, and Kirill Levchenko University of California, San
FortiNAC SRV Records on Production DNS
FortiNAC SRV Records on Production DNS Version: 8.x Date: 09/10/2018 Rev: B FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET KNOWLEDGE BASE http://kb.fortinet.com
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
BCW Web Browser Versions and Update Instructions Updated 5/5/2017
To remain HIPAA compliant and adhere to DPH security requirements, all BCW providers (public and private) are responsible for ensuring that the web browser on the PC(s) used to access BIBS meet the following
CipherMail encryption. CipherMail white paper
CipherMail email encryption CipherMail white paper Copyright 2009-2017, ciphermail.com. Introduction Most email is sent as plain text. This means that anyone who can intercept email messages, either in
Independent Submission Request for Comments: ISSN: January 2014
Independent Submission Request for Comments: 7108 Category: Informational ISSN: 2070-1721 J. Abley Dyn, Inc. T. Manderson ICANN January 2014 Abstract A Summary of Various Mechanisms Deployed at L-Root
CS 356 Internet Security Protocols. Fall 2013
CS 356 Internet Security Protocols Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5
Ondřej Caletka. November 2015
A measurement of SMTP over TLS Ondřej Caletka November 2015 Ondřej Caletka (CESNET, z s p o) A measurement of SMTP over TLS November 2015 1 / 13 The principle SMTP To: bob@borg From alice@aorg Dear Bob
The Cisco HCM-F Administrative Interface
CHAPTER 5 This chapter contains information on the following topics: Overview of Cisco HCM-F Administrative Interface, page 5-1 Browser Support, page 5-2 Login and Logout, page 5-4 Online Help, page 5-5
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
When HTTPS Meets CDN: A Case of Authentication in Delegated Services. J. Liang, J. Jiang, H. Duan, K. Li, T. Wan, J. Wu
When HTTPS Meets CDN: A Case of Authentication in Delegated Services J. Liang, J. Jiang, H. Duan, K. Li, T. Wan, J. Wu Problem statement: TLS, an End-to-End Protocol 2 Problem Statement: End-to-End Protocol
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
2017 DNSSEC KSK Rollover. DSSEC KSK Rollover
2017 DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover APNIC 44 Edward.Lewis@icann.org FIRST TC September 11, 2017 13 September 2017 DNSSEC Signing vs. Validation DNS Security Extensions Digital
and Web Security
Email and Web Security Computer Security Lecture 15 David Aspinall School of Informatics University of Edinburgh 3rd March 2008 Outline Secure Email: PGP and S/MIME Issues of trust Web security: transport
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018 ITHI Principles of Operation Technical focus Problem areas à Metrics à Measurement Current value and trend over
BIND-USERS and Other Debugging Experiences. Mark Andrews Internet Systems Consortium
BIND-USERS and Other Debugging Experiences Mark Andrews Internet Systems Consortium Mark_Andrews@isc.org http://isc.org BIND-USERS and Other Debugging Experiences We will look at some typical debugging
Secure SDN Authentication (DNS based PKI model)
IETF93 22 July 2015 Prague SDNRG WG Secure SDN Authentication (DNS based PKI model) Author: Hosnieh Rafiee Ietf{at}rozanak.com www.huawei.com Summary Problem: No flexibly for PKI model Solution: Combination
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP,
Chapter 32 Security in the Internet: IPSec, SSL/TLS, PGP, VPN, and Firewalls 32.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 32.2 Figure 32.1 Common structure
2. Introduction to Internet Applications
2. Introduction to Internet Applications 1. Representation and Transfer 2. Web Protocols 3. Some Other Application Layer Protocols 4. Uniform Resource Identifiers (URIs) 5. Uniform Resource Locators (URLs)
and Web Security
Email and Web Security Computer Security Lecture 14 Mike Just 1 School of Informatics University of Edinburgh 4th March 2010 1 Based on original lecture notes by David Aspinall Outline Secure Email: PGP
DNSSEC for the Root Zone. NZNOG Hamilton, NZ January 2010
DNSSEC for the Root Zone NZNOG Hamilton, NZ January 2010 Joe Abley, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
HP Instant Support Enterprise Edition (ISEE) Security overview
HP Instant Support Enterprise Edition (ISEE) Security overview Advanced Configuration A.03.50 Mike Brandon Interex 03 / 30, 2004 2003 Hewlett-Packard Development Company, L.P. The information contained
Extensions to ACME for (TLS, S/MIME)
Extensions to ACME for email (TLS, S/MIME) draft-ietf-acme-email-tls-02 draft-ietf-acme-email-smime-01 Alexey Melnikov, Isode Ltd 1 Changes in draft-ietf-acme-emailtls-02 since Prague Removed TLS SNI challenge,
Electronic mail security
Electronic mail security Ola Flygt Växjö University, Sweden http://w3.msi.vxu.se/users/ofl/ Ola.Flygt@vxu.se +46 470 70 86 49 1 Outline Pretty Good Privacy (PGP) S/MIME 2 1 Pretty Good Privacy Philip R.
MediaAUTH Draft Proposal
MediaAUTH Draft Proposal August 21, 2012 Contents 1 Introduction 2 2 Service & User Perspective 2 2.1 Login...................................... 2 2.2 Soft Login.................................... 3
Securing Connections for IBM Traveler Apps. Bill Wimer STSM for IBM Collaboration Solutions December 13, 2016
Securing Connections for IBM Traveler Apps Bill Wimer (bwimer@us.ibm.com), STSM for IBM Collaboration Solutions December 13, 2016 IBM Technote Article #21989980 Securing Connections for IBM Traveler mobile
Wavecrest Certificate SHA-512
Wavecrest InstallationGuide Wavecrest Certificate SHA-512 www.wavecrest.net Copyright Copyright 1996-2018, Wavecrest Computing, Inc. All rights reserved. Use of this product and this manual is subject
CSE 127: Computer Security Network Security. Kirill Levchenko
CSE 127: Computer Security Network Security Kirill Levchenko November 28, 2017 Network Security Original TCP/IP design: Trusted network and hosts Hosts and networks administered by mutually trusted parties
page 1 Plain Old DNS WACREN, DNS/DNSSEC Regional Workshop Ouagadougou, October 2016
page 1 Plain Old DNS WACREN, DNS/DNSSEC Regional Workshop Ouagadougou, 10-14 October 2016 page 2 IP: Identifiers on the Internet The fundamental identifier on the internet is an IP address. Each host connected
Recommendations for DNS Privacy Service Operators
Recommendations for DNS Privacy Service Operators Presenter: Sara Dickinson sara@sinodun.com Co-authors: Roland van Rijswijk-Deij, Allison Mankin, Benno Overeinder 1 Brief history of DNS Privacy Date 2
DNS over IPv6 - A Study in Fragmentation
DNS over IPv6 - A Study in Fragmentation DNS OARC, September 2017 Geoff Huston, Joao Damas APNIC Labs What happens to a large DNS response? (Where large is > 1280 octets) What happens to a large DNS response?
Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period
Testing Recursive Name Servers for IPv6 and EDNS0 Support SAC 017 15 March 2007 Preparation Test AAAA and EDNS0 support Share Your Results Results Reported Testing Period Background The DNS Root Server
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
DNSSEC operational experiences and recommendations. Antti Ristimäki, CSC/Funet
DNSSEC operational experiences and recommendations Antti Ristimäki, CSC/Funet Agenda Funet DNSSEC status A short DNSSEC tutorial Zone signing considerations Private key security Network layer impacts Monitoring
Lecture 15 Public Key Distribution (certification)
0 < i < 2 n = N X i,y i random secret keys index i = random (secret) value Merkle s Puzzles (1974) Puzzle P i = {index i,x i,s} Y i S fixed string, e.g., " Alice to Bob" { P 0 < i < 2 i n } Pick random
When HTTPS Meets CDN
When HTTPS Meets CDN A Case of Authentication in Delegated Service Jinjin Liang 1, Jian Jiang 1, Haixin Duan 1, Kang Li 2, Tao Wan 3, Jianping Wu 1 1 Tsinghua University 2 University of Georgia 3 Huawei
Progressively Securing RIOT-OS!
+ Progressively Securing RIOT-OS! USABILITY AND NECESSITY OF SSL / TLS Slide 1 / 33 We re going to talk about: 1. Why is security important? 2. What is SSL? 3. Where is SSL being used? 4. Features: What
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536)
Princess Nora Bint Abdulrahman University College of computer and information sciences Networks department Networks Security (NET 536) Prepared by Dr. Samia Chelloug E-mail: samia_chelloug@yahoo.fr Content
Information Network I: The Application Layer. Doudou Fall Internet Engineering Laboratory Nara Institute of Science and Technique
Information Network I: The Application Layer Doudou Fall Internet Engineering Laboratory Nara Institute of Science and Technique Outline Domain Name System World Wide Web and HTTP Content Delivery Networks
Authenticating Devices
Authenticating Devices Cisco TelePresence Deployment Guide Cisco VCS X6.1 D14819.01 May 2011 Contents Contents Document revision history... 4 Introduction... 5 Local database... 6 Configuration... 6 H.350
Technologies for Securing the Networked Supply Chain. Alex Deacon Advanced Products and Research Group VeriSign, Inc.
Technologies for Securing the Networked Supply Chain Alex Deacon Advanced Products and Research Group VeriSign, Inc. Agenda Introduction Security challenges Security technologies in use today Applying
DNS. Karst Koymans & Niels Sijm. Friday, September 14, Informatics Institute University of Amsterdam
DNS Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Friday, September 14, 2012 Karst Koymans & Niels Sijm (UvA) DNS Friday, September 14, 2012 1 / 32 1 DNS on the wire 2 Zone transfers
Securing, Protecting, and Managing the Flow of Corporate Communications
Securing, Protecting, and Managing the Flow of Corporate Communications Getting mailflow right Dave Stork Technical Consultant OGD ict-diensten QR: URL to Presentation Who am I? Dave Stork Technical consultant
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
Apple Mail Edition. 1. Installing the S/MIME Certificate. 2. Sending Digitally Signed s Prerequisites. 1-2.
Apple Mail Edition Revision History Rev. Date (YYYY/MM/DD) Description Editor V.1.0 2015/4/1 Sample edition NII V.1.1 2016/12/26 Amendment with addition of [NII Open Domain S/MIME CA] as a new Certificate
Public Key Infrastructure
Public Key Infrastructure Ed Crowley Summer 11 1 Topics Public Key Infrastructure Defined PKI Overview PKI Architecture Trust Models Components X.509 Certificates X.500 LDAP 2 Public Key Infrastructure
Uniform Resource Locators (URL)
The World Wide Web Web Web site consists of simply of pages of text and images A web pages are render by a web browser Retrieving a webpage online: Client open a web browser on the local machine The web
The Importance of Being an Earnest stub
The Importance of Being an Earnest Challenges and solution for the versatile Willem Toorop 13 May 2017 OARC 26 (Madrid) From the ground-up security et n A rc a -o s 98 n 1 d 910 1 4 6 Recursive dns-oarc
Web Applications Installation. version 12.17
version 12.17 Disclaimer This document is for informational purposes only and is subject to change without notice. This document and its contents, including the viewpoints, dates and functional content