DNSSEC for ISPs workshop João Damas
|
|
|
- Morgan Doyle
- 5 years ago
- Views:
Transcription
1 DNSSEC for ISPs workshop João Damas 1
2 Outline of workshop Brief intro to DNSSEC Overview of zone signing DNSSEC validation trust anchors validation impact of enabling validation debugging Making DNSSEC useful for you 2
3 Brief Introduction to DNSSEC 3
4 The protocol bits What is DNSSEC meant to do? What does it do? How does it do it? 4
5 What is DNSSEC meant to do? It protects data in transit between an authoritative name server and a client Optionally, it can securely link the zones in the DNS tree It does not: ensure data is correct, only that no one has interfered with it 5
6 What is DNSSEC meant to do? This should enable a new world of applications/services see DANE, SSHFP, new anti-spam tools DANE: 6
7 What does DNSSEC do? It defines a protocol to allow verification of DNS data by a client who knows the public key used to sign the DNS data. 7
8 How does DNSSEC secure DNS? Technical elements Data signing 8
9 Technical elements Keys Proof of nonexistence Zone links Signatures 9
10 Keys Public key cryptography choice of algorithms: RSA/DSA/GOST Data digests SHA1, SHA2, GOST $ dig bondis.org dnskey... bondis.org. IN DNSKEY BQEAAAAB1Io2mihvmT6Dj9CSNGOqWjklO2OlusMnOofmbBAbEHFTFhG69zE0DcT0Pyp9b0Iinvn1U389 jlvdzvp9x2cirjwmlir4uo3trfnkt4jewlbhwuftpuh15idctnfywpkd5vdfoopy8edj2llh1iwiwq8ryu9 OtIR S8Nyrvb59g0= 10
11 Keys Public key cryptography choice of algorithms: RSA/DSA/GOST Data digests SHA1, SHA2, GOST Flags $ dig bondis.org dnskey... bondis.org. IN DNSKEY BQEAAAAB1Io2mihvmT6Dj9CSNGOqWjklO2OlusMnOofmbBAbEHFTFhG69zE0DcT0Pyp9b0Iinvn1U389 jlvdzvp9x2cirjwmlir4uo3trfnkt4jewlbhwuftpuh15idctnfywpkd5vdfoopy8edj2llh1iwiwq8ryu9 OtIR S8Nyrvb59g0= 10
12 Keys Public key cryptography choice of algorithms: RSA/DSA/GOST Data digests SHA1, SHA2, GOST Flags $ dig bondis.org dnskey... bondis.org. IN DNSKEY BQEAAAAB1Io2mihvmT6Dj9CSNGOqWjklO2OlusMnOofmbBAbEHFTFhG69zE0DcT0Pyp9b0Iinvn1U389 jlvdzvp9x2cirjwmlir4uo3trfnkt4jewlbhwuftpuh15idctnfywpkd5vdfoopy8edj2llh1iwiwq8ryu9 OtIR S8Nyrvb59g0= 10 Protocol
13 Keys Public key cryptography choice of algorithms: RSA/DSA/GOST Data digests SHA1, SHA2, GOST Flags $ dig bondis.org dnskey Algorithm... bondis.org. IN DNSKEY BQEAAAAB1Io2mihvmT6Dj9CSNGOqWjklO2OlusMnOofmbBAbEHFTFhG69zE0DcT0Pyp9b0Iinvn1U389 jlvdzvp9x2cirjwmlir4uo3trfnkt4jewlbhwuftpuh15idctnfywpkd5vdfoopy8edj2llh1iwiwq8ryu9 OtIR S8Nyrvb59g0= 10 Protocol
14 Keys Key Signing Key Zone Signing Key Only difference is how they are used, otherwise they are identical (1bit) 11
15 Proof of nonexistence Critical to avoid false negatives (e.g. interception) Pre-computed (DoS mitigation) probably modern hardware could compute the elements in real time. Two ways. Both valid NSEC NSEC3 12
16 NSEC NSEC Describe intervals between two consecutive names that existent in the zone Allows zone walking Some TLDs see this as a privacy problem the problemtends to be in the whois, not in the DNS 13 X
17 NSEC -$ dig patio.bondis.org +dnssec ;; QUESTION SECTION: ;patio.bondis.org. IN A ;; AUTHORITY SECTION: ns.bondis.org. 300 IN NSEC smtp1.bondis.org. A RRSIG NSEC ns.bondis.org. 300 IN RRSIG NSEC bondis.org. nywlzu X
18 NSEC Zone Walking 14
19 NSEC $ dig patio.bondis.org +dnssec ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN ;; QUESTION SECTION: ;patio.bondis.org. IN A ;; AUTHORITY SECTION: ns.bondis.org. 300 IN NSEC smtp1.bondis.org. A RRSIG NSEC ns.bondis.org. 300 IN RRSIG NSEC bondis.org. nywlzusk5q... 14
20 NSEC $ dig patio.bondis.org +dnssec ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN ;; QUESTION SECTION: ;patio.bondis.org. IN A previous ;; AUTHORITY SECTION: ns.bondis.org. 300 IN NSEC smtp1.bondis.org. A RRSIG NSEC ns.bondis.org. 300 IN RRSIG NSEC bondis.org. nywlzusk5q... 14
21 NSEC $ dig patio.bondis.org +dnssec ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN ;; QUESTION SECTION: ;patio.bondis.org. IN A previous next ;; AUTHORITY SECTION: ns.bondis.org. 300 IN NSEC smtp1.bondis.org. A RRSIG NSEC ns.bondis.org. 300 IN RRSIG NSEC bondis.org. nywlzusk5q... 14
22 NSEC3 Replaces the names in NSEC records with hashes of existing names hard for humans to debug Introduces an unrelated but useful feature: opt-out 15
23 NSEC3 $ dig isc0.org +dnssec +noall +answer +authority ; <<>> DiG P1 <<>> isc0.org +dnssec +noall +answer +authority ;; global options: +cmd org. 872 IN SOA a0.org.afilias-nst.info. noc.afilias-nst.info org. 872 IN RRSIG SOA org. DaeMBz24QcHdzTQrjE7SdzJ42SKgNBK2sFSZaWNRzwskT2QghgbUcywf 2GxSFf6cChEsFe4hULXzWWDHqMcipiIlAjT78UMfZ8o5XHFXw458M7FT bb+41u0ox75wtocxxha8+zrxgn9csa7que29c/ JQhg/Ynv9ylAnww36U fjc= h9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 872 IN RRSIG NSEC org. GmtpVsYkxJ1yRmt8vWsuHmbWBJCJhuGaRvoKccdDX8B/gO1Q+cUw8jG2 lh24mv4j4vipbvqvbi72g/ 1DNFdOPW2Vqn3aIctA+8co9wImHr/5tNHY HcCwF79x/wm38nFbhxxI7XDWPfvTMy+YbjCeSddxIPdegggBRHPZOLj5 QQA= h9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 872 IN NSEC D399EAAB H9R9S3ARGOL56DI1SIA1K4AORTQ8FGPN NS SOA RRSIG DNSKEY NSEC3PARAM tc8i66k7jila0sgib7tjeic8vftrevko.org. 872 IN RRSIG NSEC org. E3DwrbG9RdbfaQcu0nDyylhYAP44Ezo48qwUO95wXVQPkgkdJnTgPz5P aecbljmbg4riy7sa4smwy6wpo3cpvpd7tcvoy5ujfqkeqjhop8eyfagf BpvlrBMPTo3KefFoEjQ0RscN0ZWIR+/ rwlpzda4r9yp7u+yu0axoq6eb /bu= tc8i66k7jila0sgib7tjeic8vftrevko.org. 872 IN NSEC D399EAAB TCEKMSLUSATMEGL10541FLRRD7CNAL2J A RRSIG vaiuqvth0uj0nkst7dkbscpig5lcg2op.org. 872 IN RRSIG NSEC org. eyxnpljjd/b3c9/v1dfhyf5jju1cwhc40v+zvvhygksncsndzlxyiv/1 T33Lc5ka6cdCK/FHWy0/ qn7idrvviyorndpq0f8akmme/gl1zvtuhzoz 3fP0JkQgC2EmHF4m/sPOMPBVPUYwU3fnzh4XtBZJFcnrXSHv7Mg9E9P6 NQo= vaiuqvth0uj0nkst7dkbscpig5lcg2op.org. 872 IN NSEC D399EAAB VARKIF352C7E5J1AGLO6DJ68T9H5N4R1 A RRSIG 16
24 Linking zones In DNS search jumps from zone to zone via delegations $ isc.org ;; QUESTION SECTION: ;isc.org. IN A ;; AUTHORITY SECTION: isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS sfba.sns-pb.isc.org. 17
25 Linking zones DNSSEC creates a parallel tree. Keys are represented in parent zones with a new record DS (delegation signer) $ bondis.org any ;; ANSWER SECTION: bondis.org. 32 IN NS ns.bondis.org. bondis.org. 32 IN NS borg.c-l-i.net. bondis.org IN DS B5E5C737CBA4D8610EF16D6161CDFF7C48F8C6A63157A900510ABC 1C52BE66 bondis.org IN DS E64E49EAC3B9C CDE6DE9A11A4BA9C061 18
26 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type 19
27 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
28 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
29 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
30 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
31 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
32 Signing the Data Signatures are what you can actually check to verify data is real Stored in the RRSIG record one per name and record type $ dig isc.org any +dnssec ;; QUESTION SECTION: ;isc.org. IN ANY ;; ANSWER SECTION: isc.org IN RRSIG DNSKEY isc.org. J7d/2l/cPUHzyg3ze... isc.org IN RRSIG DNSKEY isc.org. WO2LHgs1bkK2d04FCkCG01O4Z... isc.org IN DNSKEY BEAAAAOhHQDBrhQbtphgq2wQUpEQ5t4DtUHxoMVFu2hWLDMvoOMRXjGr hhcefvazih7yj... isc.org IN DNSKEY BEAAAAO6L6BadeFzvt6J63GDGrFANfJAitCd9Njcj49y6PE1Bv6t33sE yxsvi4kwbjqgv... isc.org IN RRSIG NS isc.org. QD/j5eKOVyYW+iOUTDGzo... isc.org IN NS sfba.sns-pb.isc.org. isc.org IN NS ns.isc.afilias-nst.info. isc.org IN NS ams.sns-pb.isc.org. isc.org IN NS ord.sns-pb.isc.org. isc.org IN RRSIG DS org. WA/UeCd+Pi6eNmPFWAXQ5O7k... isc.org IN DS D08B4C6A1D9F6AEE1E2237AEF69F3F9759 isc.org IN DS F1E184C0E1D615D20EB3C223ACED3B03C773DD952D5F0EB5C777586D E18DA6B5 19
33 Overview of zone signing 20
34 Create key(s) standard utilities come with BIND and others dnsssec-keygen Most common case people create 2 types of keys DNS itself doesn t care about these key types, purely administrative KSK/SEP, ZSK 21
35 Sign zone Use cli tools that ship with BIND and others dnssec-signzone Use automated processes BIND 9.7+ zkt opendnssec 22
36 Serve the signed zone Make sure all NS are DNSSEC enabled Don t forget signatures have an expiry date 23
37 More details See online resources index.php/tools_and_resources 24
38 DNSSEC Validation 25
39 Getting the necessary elements The server software BIND, Unbound, PowerDNS recursor we will use BIND here The Key material documentation/ 26
40 Getting the necessary elements Tools DiG (with the special sauce) drill wireshark dnscap ( 27
41 Getting our hands dirty First make sure DiG is ready compile BIND using STD_CDEFINES='-DDIG_SIGCHASE=1./configure not the cleanest code ever but it solves the problem nicely 28
42 Get the keys for the root zone Kjqmt7v.crt 30-Jun :53 Kjqmt7v.csr 15-Jul :13 draft-icann-dnssec-trust-anchor.html 15-Jul :44 draft-icann-dnssec-trust-anchor.txt 15-Jul :44 icann.pgp 15-Jul :48 icannbundle.p12 15-Jul :13 icannbundle.pem 15-Jul :13 root-anchors.asc 15-Jul :13 root-anchors.p7s 30-Jun :53 root-anchors.xml 15-Jul :13 Multiple choices. For me the most convenient is the combination of the PGP signature with the xml file... even if xml has DS record. BIND needs DNSKEY 29
43 Get the keys for the root zone To verify, get the DNSKEY from the DNS itself DNSKEY +noall +answer +multi >/tmp/root-key and convert to DS using a BIND utility dnssec-dsfromkey -f /tmp/root-key. Compare the DS with the one in rootanchors.xml 30
44 Configure BIND to validate Introduce the validate key into named.conf Manual management trusted-keys Automatic management managed-keys RFC5011 Make sure DNSSEC is enabled 31
45 DLV Useful under some circumstances frequent use of islands of security testing What is it? early deployment aid how does it work? 32
46 Enabling DLV enable it with dnssec-lookaside auto You can register your own DNSSEC keys with ISC s DLV registry 33
47 Making DNSSEC useful for you 34
48 You can use it now, to your own advantage Problem to be solved: a new server comes online or you change the SSH host key (e.g. OS change/upgrade) You need to manually refresh the key at all clients or you can use SSHFP 35
49 Using SSHFP with your SSH system This is something that benefits you in your daily work You need to: generate SSHFP records and put them in the zone (one time per key) Sign the zone with DNSSEC configure SSH clients (one time) 36
50 Get data into the zone Generate SSHFP records by hand using tools, such as Add to the corresponding server name shuttle.c-l-i.net. IN SSHFP C6164E07B920CE AB33DFAF30E6 Sign the zone 37
51 Configure the SSH client Add option VerifyHostKeyDNS yes (or ask) to.ssh/config Enable EDNS0 in /etc/resolv.conf options edns0 or use and env var in $SHELL RES_OPTIONS=edns0 38
52 Voilá If DNSSEC validation is working OpenSSH will use the keys automatically 39
53 When things break Things don t break... 40
DNSSEC for ISPs workshop.! João Damas
DNSSEC for ISPs workshop!!! João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC (30 ) Overview of zone signing (30 ) DNSSEC validation (60 ) trust anchors validation impact of enabling
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
BIND-USERS and Other Debugging Experiences. Mark Andrews Internet Systems Consortium
BIND-USERS and Other Debugging Experiences Mark Andrews Internet Systems Consortium Mark_Andrews@isc.org http://isc.org BIND-USERS and Other Debugging Experiences We will look at some typical debugging
DNSSEC operational experiences and recommendations. Antti Ristimäki, CSC/Funet
DNSSEC operational experiences and recommendations Antti Ristimäki, CSC/Funet Agenda Funet DNSSEC status A short DNSSEC tutorial Zone signing considerations Private key security Network layer impacts Monitoring
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
2017 DNSSEC KSK Rollover. DSSEC KSK Rollover
2017 DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover APNIC 44 Edward.Lewis@icann.org FIRST TC September 11, 2017 13 September 2017 DNSSEC Signing vs. Validation DNS Security Extensions Digital
Computer Science 161 Fall Weaver. Network Security 6
Network Security 6 1 Controlling Networks On The Cheap Motivation: How do you harden a set of systems against external attack? Key Observation: The more network services your machines run, the greater
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution
SYSADMIN DNSSEC Sergey Ilin, Fotolia Trusted name resolution with DNSSEC CHAIN OF TRUST Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution service.
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
What's so hard about DNSSEC? Paul Ebersman May 2016 RIPE72 Copenhagen
What's so hard about DNSSEC? Paul Ebersman Paul_Ebersman@cable.comcast.com 23-27 May 2016 RIPE72 Copenhagen 1 Why use DNSSEC What does it solve? Helps against cache poisoning Identifies DNS lying Enables
Hands-on DNSSEC with DNSViz. Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016
Hands-on DNSSEC with DNSViz Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016 Preparation Demo and exercises available at: http://dnsviz.net/demo/ Includes links to the following: VirtualBox
2017 DNSSEC KSK Rollover. Guillermo Cicileo LACNIC March 22, 2017
2017 DNSSEC KSK Rollover Guillermo Cicileo LACNIC March 22, 2017 Purpose of this Talk 1 2 3 To publicize the new Root Zone DNSSEC KSK Provide status, upcoming events, and contact information Provide helpful
Understanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
DNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
Table of Contents. DNS security basics. What DNSSEC has to offer. In what sense is DNS insecure? Why DNS needs to be secured.
Table of Contents DNS security basics The basics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.3, 2013/09/13 11:46:36) Tuesday, Sep 17, 2013 Why DNS needs to
DENIC DNSSEC Testbed Software support for DNSSEC Ralf Weber
DENIC DNSSEC Testbed Software support for DNSSEC Ralf Weber (ralf.weber@nominum.com) Who is Nominum? Mission Product Leadership Industry Expertise Deliver the Trusted Internet Experience Strategic Partners:
Table of Contents. DNS security. Alternative DNS security mechanism. DNSSEC specification. The long (and winding) road to the DNSSEC specification
Table of Contents DNS security Karst Koymans Informatics Institute University of Amsterdam (version 1.19, 2011/09/27 14:18:11) Friday, September 23, 2011 The long (and winding) road to the DNSSEC specification
Lab 6 Implementing DNSSEC
Lab 6 Implementing DNSSEC Objective: Deploy DNSSEC-signed zones. Background DNSSEC (or DNS Security Extensions) provide security to the zone files. Note: In the steps below, we are using myzone.net - our
DNS security. Karst Koymans & Niels Sijm. Tuesday, September 18, Informatics Institute University of Amsterdam
DNS security Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Tuesday, September 18, 2012 Karst Koymans & Niels Sijm (UvA) DNS security Tuesday, September 18, 2012 1 / 38 1 Chain
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
Assessing and Improving the Quality of DNSSEC
Assessing and Improving the Quality of DNSSEC Deployment Casey Deccio, Ph.D. Sandia National Laboratories AIMS-4 CAIDA, SDSC, San Diego, CA Feb 9, 2012 Sandia is a multiprogram laboratory operated by Sandia
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
Step by step DNSSEC deployment in.se. Anne-Marie Eklund Löwinder Quality & Security
Step by step DNSSEC deployment in.se Anne-Marie Eklund Löwinder Quality & Security Manager,.SE amel@iis.se @amelsec www.iis.se Timeline 2005 signing of the.se zone. 2006 allowing DS records from friendly
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
DNSSECbis Lookaside Validation. Peter Losher Internet Systems Consortium (November 2006)
DNSSECbis Lookaside Validation Peter Losher Internet Systems Consortium (November 2006) Topics Introduction DNS Delegation and Resolution DNSSECbis Data and Traversal DLV Overview
Scott Rose, NIST Winter JointTechs Meeting Jan 30, 2011 Clemson University
Scott Rose, NIST scottr@nist.gov 2011 Winter JointTechs Meeting Jan 30, 2011 Clemson University Special Thanks to RIPE NCC who provided the base slides for this tutorial. DNS is not secure Known vulnerabilities
DNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
RIPE NCC DNS Update. K-root and DNSSEC. Anand Buddhdev October 2018 RIPE 77
RIPE NCC DNS Update K-root and DNSSEC Anand Buddhdev October 2018 RIPE 77 K-root Status 63 instances (2 new since RIPE 76, in Vilnius and Lugansk) Response rate across all of K-root Capacity and usage
DNSSEC deployment. Phil Regnauld Hervey Allen
DNSSEC deployment Phil Regnauld Hervey Allen Overview We will talk about: the problems that DNSSEC addresses the protocol and implementations the practical problems tied to real-world deployment We will
1 Release Notes for BIND Version
1 Release Notes for BIND Version 9.12.0 1.1 Introduction BIND 9.12.0 is a new feature release of BIND. This document summarizes new features and functional changes that have been introduced on this branch,
RSA and ECDSA. Geoff Huston APNIC. #apricot2017
RSA and ECDSA Geoff Huston APNIC It s all about Cryptography Why use Cryptography? Public key cryptography can be used in a number of ways: protecting a session from third party eavesdroppers Encryption
DNS SECurity Extensions technical overview
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research developed by EURid in cooperation with industry experts
1 Release Notes for BIND Version b1
1 Release Notes for BIND Version 9.12.0b1 1.1 Introduction BIND 9.12.0 is a new feature release of BIND, still under development. This document summarizes new features and functional changes that have
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014!
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014! Outline! What is DANE?! The TLSA Record! TLSA Browser Plugin! Generating the TLSA Record! Other uses for DANE! 2!
Some DNSSEC thoughts. DNSOPS.JP BOF Interop Japan Geoff Huston Chief Scientist, APNIC June 2007
Some DNSSEC thoughts DNSOPS.JP BOF Interop Japan 2007 Geoff Huston Chief Scientist, APNIC June 2007 The DNS is a miracle! You send out a question into the net And an answer comes back! Somehow But WHO
DNS Security. APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga
DNS Security APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga 2 Brief Overview of DNS What is the Domain Name System? A distributed database primarily used to obtain
Expires: June 16, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003
DNS Extensions Internet-Draft Expires: June 16, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003 Protocol Modifications for the DNS
DNSSEC. Lutz Donnerhacke. db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec e164.arpa. naptr
DNSSEC Lutz Donnerhacke db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec 1.6.5.3.7.5.1.4.6.3.9.4.e164.arpa. naptr 1 A protocol from better times An ancient protocol People were friendly and
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Recap DNS originally not designed with
A Security Evaluation of DNSSEC with NSEC Review
A Security Evaluation of DNSSEC with NSEC Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being
DNSSec Operation Manual for the.cz and e164.arpa Registers
DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers version 1.9., valid since 1 January 2010 Introduction This material lays out operational rules that govern the work of the CZ.NIC association
Troubleshooting DNSSEC Visually
Troubleshooting DNSSEC Visually Sandia National Laboratories is a multi-program laboratory operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin company, for the U.S. Department
By Paul Wouters
By Paul Wouters Overview presentation Theory of DNSSEC Using bind with DNSSEC Securing Ò.nlÓ with SECREG Securing Ò.orgÓ with VerisignLabs Deploying DNSSEC on large scale Audience participation
1 Release Notes for BIND Version b2
1 Release Notes for BIND Version 9.12.0b2 1.1 Introduction BIND 9.12.0 is a new feature release of BIND, still under development. This document summarizes new features and functional changes that have
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net
The impact of DNSSEC on k.root-servers.net and ns-pri.ripe.net Olaf M. Kolkman Question What would be the immediate and initial effect on memory, CPU and bandwidth resources if we were to deploy DNSSEC
Algorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
Afilias DNSSEC Practice Statement (DPS) Version
Afilias DNSSEC Practice Statement (DPS) Version 1.07 2018-02-26 Page 1 of 8 1. INTRODUCTION 1.1. Overview This document was created using the template provided under the current practicing documentation.
RSSAC Activities Update. Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015
RSSAC Activities Update Lars Johan Liman and Tripti Sinha RSSAC Chair ICANN-54 October 2015 Agenda 1 2 3 Overview RSSAC002 Implementation Status Update RSSAC003: RSSAC Report on Root Zone TTLs 4 5 6 RSSAC
DNSSEC Policy and Practice Statement. Anne-Marie Eklund Löwinder Quality and Security Manager
DNSSEC Policy and Practice Statement Anne-Marie Eklund Löwinder Quality and Security Manager amel@iis.se What is a DNSSEC Policy and Practice Statement (DPS)? A document that contains the DNSSEC Policy
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
A paper on DNSSEC - NSEC3 with Opt-Out
A paper on DNSSEC - NSEC3 with Opt-Out DNSSEC A Way Forward for TLD Registries Method for faster adoption of DNSSEC Providing greater security with minimal impact on customers, registries and Zone Management
Toward Unspoofable Network Identifiers. CS 585 Fall 2009
Toward Unspoofable Network Identifiers CS 585 Fall 2009 The Problem DNS Spoofing Attacks (e.g., Kaminsky) At link (Ethernet) and IP layers, either: Software sets the source address in the packet, or Software
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
Update on the DLV Shutdown Vicky Risk ISC.org. source: flickr, lic cc 2.0 Marrakech Market by Jacky Jourdren
Update on the DLV Shutdown Vicky Risk ISC.org source: flickr, lic cc 2.0 Marrakech Market by Jacky Jourdren DLV, the DNS Lookaside Validator Created in 2006 To allow use of DNSSEC before root and TLDs
Root Zone DNSSEC KSK Rollover. DSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover ENOG 15 Edward.Lewis@icann.org FIRST TC September 11, 2017 5 June 2018 The Basics This talk is related to the Domain Name System, in particular,
DNSSEC at Scale. Dani Grant CloudFlare
DNSSEC at Scale Dani Grant DNS @ CloudFlare CloudFlare - Authoritative DNS provider (includes DNSSEC for free) - 4M+ domains - 40+ billion queries per day - 76 edge locations in 40 countries (growing)
DNSSEC en.mx. Network Information Center México
DNSSEC en.mx Network Information Center México 2 Agenda 1. About NIC México 2..mx DNSSEC test bed 3. Education about DNSSEC 4. NSEC zone walking 3 About NIC México cctld operator of.mx (México). National
The State and Challenges of the DNSSEC Deployment. Eric Osterweil Michael Ryan Dan Massey Lixia Zhang
The State and Challenges of the DNSSEC Deployment Eric Osterweil Michael Ryan Dan Massey Lixia Zhang 1 Monitoring Shows What s Working and What needs Work DNS operations must already deal with widespread
Experience from a Swedish Agency and a Nordic operator
Experience from a Swedish Agency and a Nordic operator fredrik@xpd.se Overview Skatteverket (Swedish Tax Agency) End user perspective TDC Registrar perspective Skatteverket Why DNSSEC? How to deploy? What
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist?
RRSIG: I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist? NSEC: I certify that there are no DNS records (of type X) whose record
DNSSEC. Training Course
DNSSEC Training Course Training Services RIPE NCC March 2017 Schedule 09:00-09:30 11:00-11:15 13:00-14:00 15:30-15:45 17:30 Coffee, Tea Break Lunch Break End 2 Introduction Name Number on the list Experience
SecSpider: Distributed DNSSEC Monitoring and Key Learning
SecSpider: Distributed DNSSEC Monitoring and Key Learning Eric Osterweil UCLA Joint work with Dan Massey and Lixia Zhang Colorado State University & UCLA 1 Who is Deploying DNSSEC? Monitoring Started From
DNSSEC Basics. Patrik Wallström,
DNSSEC Basics Patrik Wallström, R&D @.SE 1 The DNS Hierarchy. NS E.ROOT-SERVERS.NET. E.ROOT-SERVERS.NET. IN A. NS 192.203.230.10 D.ROOT-SERVERS.NET.. NS A.ROOT-SERVERS.NET.. NS C.ROOT-SERVERS.NET. D.ROOT-SERVERS.NET.
Overview of Open Source Tools for DNSSEC
Overview of Open Source Tools for DNSSEC Russ Mundy Analytic Solutions (aka: SPARTA, Inc. ) June 23, 2010 I need to have a WWW record Simple DNS Illustration Add Zone Administrator Zone Data publish Authoritative
DNSSEC for Humans and BIND 10. Paul Vixie Internet Systems Consortium June 9, 2011
DNSSEC for Humans and BIND 10 Paul Vixie Internet Systems Consortium June 9, 2011 Agenda BIND and DNSSEC Why do I want DNSSEC? Why DNSSEC for Humans? BIND 9.7 Features More DNSSEC for Humans Why BIND 10?
MAGPI: Advanced Services IPv6, Multicast, DNSSEC
MAGPI: Advanced Services IPv6, Multicast, DNSSEC Shumon Huque MAGPI GigaPoP & Univ. of Pennsylvania MAGPI Technical Meeting April 19th 2006, Philadelphia, PA 1 Outline A description of advanced services
Expires: November 15, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004
DNS Extensions Internet-Draft Expires: November 15, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST May 17, 2004 Protocol Modifications for the DNS
GDS Resource Record: Generalization of the Delegation Signer Model
GDS Resource Record: Generalization of the Delegation Signer Model Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, France {gilles.guette, bernard.cousin, david.fort}@irisa.fr
Test cases for domain checks a step towards a best prac5ce. Mats Du(erg,.SE Sandoche Balakrichenan, AFNIC
Test cases for domain checks a step towards a best prac5ce Mats Du(erg,.SE Sandoche Balakrichenan, AFNIC Zonemaster Upcoming tool for test of delegacon of a domain The development of Zonemaster has several
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson olafur@cloudflare.com How long does it take to? Post a new selfie on Facebook and all your friends to be notified few seconds
Root KSK Roll Delay Update
Root KSK Roll Delay Update PacNOG 21 Patrick Jones, Sr. Director, Global Stakeholder Engagement 4 December 2017 1 Background When you validate DNSSEC signed DNS records, you need a Trust Anchor. A Trust
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016 edward.lewis@icann.org 1 Motivation for this talk ICANN is about to change an important configuration parameter in DNSSEC
THE BRUTAL WORLD OF DNSSEC
THE BRUTAL WORLD OF DNSSEC Patrik Fältström Head of Technology Netnod 1 Security Issues with DNS Zone Administrator Bad Data False Master Caching Resolver Zonefile Master Slave slave slave False Cache
Domain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot September 2010 Bengt Sahlin 2011/09/27 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
The ISP Column A column on things Internet. Three DNS articles: 3. Helping Resolvers to help the DNS. RFC8192 Aggressive NSEC Caching
The ISP Column A column on things Internet Geoff Huston November 2017 Three DNS articles: 3. Helping Resolvers to help the DNS In this final article of a trio that looks at today s hot topics in the DNS,
Network Working Group. Category: Informational November 2007
Network Working Group S. Weiler Request for Comments: 5074 SPARTA, Inc. Category: Informational November 2007 Status of This Memo DNSSEC Lookaside Validation (DLV) This memo provides information for the
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018
Identifier Technology Health Indicators (ITHI) Alain Durand, Christian Huitema 13 March 2018 ITHI Principles of Operation Technical focus Problem areas à Metrics à Measurement Current value and trend over
Session J9: DNSSEC and DNS Security
Session J9 and Security InfoSec World 2008 Session J9: and Security Steve Pinkham, Maven Security Consulting What is? slide 2 Easy answer: Stands for Domain Name System System for converting names to/from
A Case for Comprehensive DNSSEC Monitoring and Analysis Tools
A Case for Comprehensive DNSSEC Monitoring and Analysis Tools Casey Deccio Sandia National Laboratories ctdecci@sandia.gov Jeff Sedayao and Krishna Kant Intel Corporation {jeff.sedayao,krishna.kant}@intel.com
Evaluation and consideration of multiple responses. Kazunori Fujiwara, JPRS OARC 28
Evaluation and consideration of multiple responses Kazunori Fujiwara, JPRS fujiwara@jprs.co.jp OARC 28 Past discussion Background DNS is query response based protocol Each query contains one QNAME / QTYPE
Documentation. Name Server Predelegation Check
Name Server Predelegation Check Doc. version: 1.4.1 Doc. status: Final Doc. date: 01.12.2015 Doc. name: Name Server Predelegation Check- -DNS Services-V1.4.1-2015-12-01 Copyright 2015 DENIC eg Imprint
DNSSEC Signing Experiences. Michael Sinatra, UC Berkeley Internet2 Member Meeting 3 November 2010
DNSSEC Signing Experiences Michael Sinatra, UC Berkeley Internet2 Member Meeting 3 November 2010 1 Why deploy DNSSEC? DNS has traditionally been an asecure protocol. More applications rely on security--from
DNSSEC at Penn. Shumon Huque University of Pennsylvania ESCC/Internet2 Joint Techs Conference July 20th 2009
DNSSEC at Penn Shumon Huque University of Pennsylvania ESCC/Internet2 Joint Techs Conference July 20th 2009 1 DNSSEC at a glance DNS Security Extensions A system to verify the authenticity of DNS data
A Longitudinal, End-to-End View of the DNSSEC Ecosystem
A Longitudinal, End-to-End View of the DNSSEC Ecosystem Taejoong (tijay) Chung, Roland van Rijswijk-Deij, Bala Chandrasekaran David Choffnes, Dave Levin, Bruce M. Maggs, Alan Mislove, Christo Wilson 1
DNSSEC for the Root Zone. NZNOG Hamilton, NZ January 2010
DNSSEC for the Root Zone NZNOG Hamilton, NZ January 2010 Joe Abley, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
Overview of Open Source Tools for DNSSEC
Overview of Open Source Tools for DNSSEC Russ Mundy SPARTA, Inc. March 10, 2010 1 I need to have a WWW record Simple DNS Illustration Add Zone Administrator Zone Data publish Authoritative Server Administrator
Network Working Group
Network Working Group R. Arends Request for Comments: 4035 Telematica Instituut Obsoletes: 2535, 3008, 3090, 3445, 3655, 3658, R. Austein 3755, 3757, 3845 ISC Updates: 1034, 1035, 2136, 2181, 2308, 3225,
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
1 Release Notes for BIND Version
1 Release Notes for BIND Version 9.13.5 1.1 Introduction BIND 9.13 is an unstable development release of BIND. This document summarizes new features and functional changes that have been introduced on
Defeating DNS Amplification Attacks. UKNOF Manchester Central, UK January Ralf Weber Senior Infrastructure Architect
Defeating DNS Amplification Attacks UKNOF Manchester Central, UK January 21 2014 Ralf Weber Senior Infrastructure Architect History of DNS Amplification DNS amplification attacks aren't new Periodically
Securing Domain Name Resolution with DNSSEC
White Paper Securing Domain Name Resolution with DNSSEC diamondip.com by Timothy Rooney Product management director BT Diamond IP Resolution with DNSSEC Introduction By Tim Rooney, Director, Product Management