IANA!and!DNSSEC!at!the!Root. APRICOT!2009!Manila February!25,!2009
|
|
|
- Kerry Pitts
- 5 years ago
- Views:
Transcription
1 IANA!and!DNSSEC!at!the!Root APRICOT!2009!Manila February!25,!2009
2 Questions DNSSEC!what!is!it! Why!do!I!care How!will!it!effect!me Why!is!IANA!involved What!I!want
3 What!is!it? Protecting!the!Internet s!phonebook Just!like!your!Web!site!certificate!is!signed!by!your! Certificate!Authority!and!whose!certificate!is!stored! and!trusted!by!your!operating!system!vendor, you!have!the!public!keys!used!to!sign!your!domain! signed!by!the!registry!you!got!your!domain!name! from!whose!public!key!is!stored!and!trusted!by!your! nameserver. www yourbank! yourbank se! se root A,RRSIG,DNSKEY!! DS,!RRSIG,DNSKEY!! DS,RRSIG,DNSKEY! DS,RRSIG,DNSKEY
4 Why!do!I!care? DNS!cache!poisoning!in!less!than!a!second!w/o!patch! thank!you!kaminsky,!dickenson,!and!others ~6hr!after!patch.!!Many!resolvers!un"patched Its!coming community!pressure,!ccnso report,!.se,!.pr,!.bg,!.br,!.cz,!.museum.org,!.gov,!.uk,!.ca! I!hear!you!can!do!cool!things!with!it.!!E.g.,! alternate/free!source!of!trust!for!dkim,!certs,!ssl,! ipsec,!and!who!knows.but!you!tell!me
5 Press need!to!make!dnssec!deployable!today "DNSSEC!is!the!key!to!fixing!the!persistent! authentication!problems!plaguing!real"world,!cross" organizational!business!for!years,
6 How!will!it!effect!me? Registrant!/!domain!name!operator Cost?!!(extra!½ time!job/year:!swedbank) Complexity!but!tools!continue!to!be!developed Deployment!experience!building!(e.g.!.se,!.uk,!.cz, ) Lessons!learned!! automation!is!key!(e.g.,!auto! key!gen/sign) ve_ pdf
7 How!will!it!effect!me? Registries!(e.g.,!nz)!and!Registrars!(e.g.,! GoDaddy) handle!ds!records!in!addition!to!ns!records!and! other!info possibly!manage!keys!and!signing!operations!on! behalf!of!customers slow!uptake!and!time!may!be!on!our!side zone!walking!issue!" NSEC3!is!a!solution!(.ORG)
8 How!will!it!effect!me? ISP s! 3"12!x!bandwidth,!validation!processing,!memory!! need!to!maintain!a!trust!anchor!(for!signed!root)! or!multiple!trust!anchors!(for!unsigned!root)!in! their!validating!recursive!resolver. Secure!trust!anchor!delivery.!!Maybe!ISP s!(or!a! designated!organization)!part!of!key!generation! ceremony?
9 How!will!it!effect!me? End!user O/S!resolvers!(i.e.!Windows!desktop/server) Need!to!make!applications!aware.!!e.g.!fallback!behavior Securing!the!last!DNSSEC!mile. resilience!of!dnssec"" handling!new!failure!modes!(key! expiry,!middleboxes like!firewalls!and!proxies!that!don't! handle!the!extra!data!properly) application!awareness:!what!do!you!do!with!dnssec!data,! especially!if!you!want!to!know!why/how!validation!failed!if! it!did?
10 Why!is!IANA!involved? We!have!been!asked!by!the!community! (APNIC,!RIPE,!ccTLDs,! ).!Start!the!ball!rolling.! No!excuses. We!are!here!to!serve!and!are!responsible!for! managing!the!root
11 Who!cares!about!a!signed!root? Simplifies!DNSSEC!configuration Compromise!recovery.reason!for!root!(or! ITAR) Maintaining!trust!from!TLD!operator!to!root
12 DNS!flaw! discovered! by!belovin 1990!(shhh) DNSSEC! becomes! topic!in! IETF 1995 Proto! finished.!! BIND! implements! it,!but!too! hard!1999! to!operate New!RFCs publisheded rfc Calls!from! community!to! get!the!root! signed!2005" now.se!signs! 2/2007 VRSN"ICANN! agreement! contemplates! root!movement! for!dnssec!2006 IANA! testbed 6/2007 ccnso publishes! report! 12/2007 Kaminsky talks!to! vendors! 2/2008 Kaminsky publishes! attack! lots! of!press! 8/2008 ITAR!! work! starts! 4/2008 ICANN! pubs! paper! 7/2008 USG! mandates! dnssec 8/2008 ICANN! submits! proposal! 9/2008 NTIA!starts! NOI!10/2008! ~!12/2008 ICANN:!20!to! Verisign:0 12/2008 SSL!MD5! crack 12/30/2 008 Sequence of Events.cz signs! 9/2008.org!2010.br signs! 6/2007.bg signs! 10/2007.pr!signs! 8/2006.museum! signs! 9/2008 DNSSEC! practices!doc! from!nist! 5/2006.gov 2010
13 Goal:!Trust!and!Accountability Important!elements!of!a!root"signing!solution!are! transparency,!public!consultation,!broad!stakeholder! participation!(e.g.!key!ceremony),!flexibility,!reliability,! and!trust;! Solution!has!to!balance!various!concerns,!but!must! provide!for!a!maximally!secure!technical!solution!and! one!that!provides!the!trust!promised!by!dnssec; An!open,!transparent!and!international!participatory! process!will!allow!for!root!zone!management!to!adapt! to!changing!needs!over!time!as!dnssec!is!deployed! throughout!the!internet!and!as!new!lessons!are! learned.
14 ICANN s root!signing!proposal No!change!in!administrative!control!of!content Accept!no!compromises!in!security:!preserve!chain!of!trust Designed!by!Community!for!Community Broad!and!continual international!participation Root! key controlled!by!internet!community! not!icann Regular!auditing!and!reporting Timely!deployment!building!on!existing!signed!root!and! experience Maximum!reliability!through!automation Flexible!to!support!evolving!technologies!and!policies All!Open!Source
15 vet,!sign!" together Community selected stakeholders Key Ceremony HSM 1 Generate KSK HSM 2 Sign Keyset Physically co-located with IANA to maintain security but may be controlled by other organizations IANA Change Request TLD Operator Authenticate TLD data (DS, NS, etc) Edit database and Compile zone Generate ZSK Sign Zone /w ZSK HSM 3 Distribute Zone Root Zone Distributor A... M Transfer and validate keys and other data via established trust relationships Content Authorize and Audit Auditor Digitally Signed (protected) Root Zone
16 Behind!our!testbed SIGNER SIGNER HSM!KSK HSM!ZSK NS! NS TEST!A TEST!M ADMIN RZM ROOT!DB CLASS!5!GSA! NSA!SAFE DUPLICATE!TO! 2"3! INSTANCES I"TAR TLD! OPERATORS ns.iana.org pch"test.iana.org Anycast SIGNER,!NS:! DELL!1950!/w! 2xPS,!2XSAS,! 2xCPU HSM:!!AEP! KEYPER!FIPS! 140"2!Level!4! (Disposable) System!status!at:! test (DS:!.se,!.br,!.bg,!.pr,!.cz,!.museum,!.gov.) 24!hr!manned! multiple!biometric! controlled!facility,!! NSA!NSTISSP!#10,! GSA!Class!5! Container! (approved!for!top! Secret) X X TLD! DATA! VETTING! PROCESS F/W 2"factor!auth!for!RZM BOS AMS MIA LAX MONITORING!SITES TSIG TLD!OPERATORS! AND/OR! GOVERNMENTS EXISTING!TRUST! RELATIONSHIPS !!public! recursive!resolver iana"testbed.odvr.dns"oarc.net ,! ,! ,! Iana*.dyntld.net Anycast
17 Some!Features Based!on!trailblazing!work!of!.SE! much!help!and!continue!to!enlist! generous!help!from!dnssec!deployment!experts Flexibility!to!changing!policies!and!tech!,!e.g.,!common!standards! PKCS11!in!crypto!boxes. Highest!level!security!for!key!handling! FIPS!140"2!level!4 Looking!into!multiple!non"US!mirror!sites No!compromise!in!security.!!no!weak!links!in!trust!or!accountability!or!in! chain! Draw!on!all!deployment!efforts.!Benefit!from!lessons!learned!from!dnssec deployment!so!far! e.g.,!maximize!automation Ready!to!deploy! fast!a!possible!as!requested!by!noi!but!timely! slow! takeup is!our!friend Fully!funded!and!budgeted! ICANN!is!serious!about!this!work! eg stood! up!operational!group!to!deal!with!this Naturally!open!source!
18 Go!ahead! test!it! Public!recursive!validating!DNSSEC!resolver!at! !!Thank!you!OARC!/!Duane! Masters:! !(ns.iana.org)!and!Anycast !(pch"test.iana.org).!!Thank!you! PCH! More!Anycast masters:!! ,! ,! ,! ! Thank!you!dynect.com!
19 What!are!we!waiting!for? Waiting!on!NTIA!(Department!of!Commerce)! decision Technically!ready.!Almost!two!years!of! operational!public!testbed (USG!HowTo)
20 Press
21 Interim Trust Anchor Repository - ITAR THANK YOU Kim Davies!! richard.lamb@icann.org
22 Interim Trust Anchor Repository - ITAR THANK YOU Kim Davies!!
23 Press
24 By Dan K, courtesy D. Burkov
25 Whats next Meanwhile! continue!to!educate,!discuss!and!exchange!ideas!with! those!deploying!dnssec!and!operationalize our!dnssec! infrastructure New!DNS!Group!headed!up!by!Joe!Abley Part!of!overall!IT!operations!headed!up!by!DRC Expanding!operational!capabilities Responsible!for!DNSSEC,!L"root,!and!other!DNS Some!efforts Second!safe,!backup!location,!deploy!it,!publish!all!operational and! design!documents Publicize!DNSSEC!efforts Study!gTLD +!DNSSEC!+!IPv6!effects!on!root! perfect!storm Fleshing!out!the!current!root!signer!testbed /w!kirei (responsible!for!.se!and!follow!on.!processes,!security,!key!dist,!ceremony,!etc)
26 Misc I"TAR!and!signed!root! EV+PGP!.vs.!ceremony/hints!file? discuss.arpa (IAB),!in"addr.arpa,!ip6.arpa!(pulling!in! sub),!iris.arpa,!urn.arpa,!uri.arpa,!.int,! iana.org,!icann.org.com+.net by!2011!
27 What!do!I!want? To!thank!the!APNIC!community!for!its!past! support. And!look!to!your!direction,!comments,! feedback!and!continued!support! its!your! root.
28 Thanks!to!APNIC,!Roy!Arends (.uk),!patrik Falstrom,!Olaf!Kolkman,!Jakob Schlyter (.se),! John!Dickinson,!David!Soltero (.pr),!kim! Davies,!David!Miller,!Don!Davis,!Andy!Linton! and!so!many!others!from!the!internet!and! security!communities!! Questions?
ICANN proposal to sign the root. ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb
ICANN proposal to sign the root ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb richard.lamb@icann.org protects the lookup like HTTPS/SSL protects the conversation is about security not
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Recap DNS originally not designed with
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
Update on IANA Seoul, Republic of Korea October 2009
Update on IANA Seoul, Republic of Korea October 2009 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Documenting Processes Documenting IANA processes Technical
6 March 2012
6 March 2012 richard.lamb@icann.org www.majorbank.se=? 1.2.3.4 Get page Login page Username / Password Account Data DNS Resolver ISP www.majorbank.se = 1.2.3.4 DNS Server webserver www @ 1.2.3.4 Majorbank
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
15 September ICANN Proposal to DNSSEC-Sign the Root Zone
Page 1 ICANN Proposal to DNSSEC-Sign the Root Zone Executive Summary This document asks and proposes answers to three questions related to DNSSEC signing of the root zone: 1. Why should the root zone be
Root Zone DNSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 51 51 KSK Rollover: An Overview ICANN is in the process of performing a Root Zone DNS Security Extensions (DNSSEC) Key Signing Key (KSK) rollover The Root Zone DNSSEC Key
DNSSEC the.se way: Overview, deployment and lessons learned. Anne-Marie Eklund Löwinder Quality & Security Manager
DNSSEC the.se way: Overview, deployment and lessons learned Anne-Marie Eklund Löwinder Quality & Security Manager My agenda Getting Started Finding out about.se Finding out what DNS does for you Why DNSSEC?
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011 ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards of security
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
DNSSEC: A game changing example of multi-stakeholder cooperation. ICANN Meeting, Singapore 21 June 2011
DNSSEC: A game changing example of multi-stakeholder cooperation ICANN Meeting, Singapore 21 June 2011 richard.lamb@icann.org ICANN ICANN is a global organization that coordinates the Internet s unique
DNSSEC in Sweden: Five Years of Practical Experience. Anne-Marie Eklund Löwinder Quality and Security Manager
DNSSEC in Sweden: Five Years of Practical Experience Anne-Marie Eklund Löwinder Quality and Security Manager Amel@iis.se http://www.iis.se What s the problem Up until recently, DNSSEC looked like a solution
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards
DNSSEC for the Root Zone. NZNOG Hamilton, NZ January 2010
DNSSEC for the Root Zone NZNOG Hamilton, NZ January 2010 Joe Abley, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
DS TTL shortening experience in.jp
DS TTL shortening experience in.jp APRICOT2014 DNS Session 27 Feb 2014 Yoshiro YONEYA Copyright 2014 Japan Registry Services Co., Ltd. 1 What is DS? Establish a DNSSEC chain
2017 Root DNSSEC KSK Rollover. NANOG 70 June 6, 2017
2017 Root DNSSEC KSK Rollover Punky.Duero@iana.org NANOG 70 June 6, 2017 What is the Root Zone DNSSEC KSK? KSK The Root Zone DNSSEC Key Signing Key KSK is the top most cryptographic key in the DNSSEC hierarchy
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How do you attack the DNS? A typical DNS query
Root KSK Roll Update Webinar
Root KSK Roll Update Webinar Matt Larson, VP of Research 11 October 2017 1 Who has KSK-2017 configured as a trust anchor? Until recently, there was no way to know which trust anchors validators have configured
APRICOT 2012 New Delhi, India February 21 - March 2
APRICOT 2012 New Delhi, India February 21 - March 2 richard.lamb@icann.org !! Fast pace of deployment at the TLD level!! Stable deployment at root!inevitable widespread deployment across core infrastructure
3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
IANA ccnso Update Kim Davies ICANN 55, 8 March 2016
IANA ccnso Update Kim Davies ICANN 55, 8 March 2016 Agenda Introduction to IANA Performance Overview Implementing new post-transition performance metrics Framework of Interpretation RDAP Update Other Work
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
DNSSEC PLNOG 5. Eric Ziegast Internet Systems Consortium. Zbigniew Jasinski NASK.PL. Deck Version 0.2
DNSSEC PLNOG 5 Zbigniew Jasinski NASK.PL Eric Ziegast Internet Systems Consortium Deck Version 0.2 We help make the Internet work better. SIE Changing how the Security Communities Productively Collaborate
Ad-hoc trust associations with Trust Anchor Repositories
Ad-hoc trust associations with Trust Anchor Repositories Stefan Roelofs stefan.roelofs@os3.nl July 2, 2009 Supervisor: Yuri Demchenko Abstract This project report presents the results of the research done
One Namespace, Many Circles. Dr. Paul Vixie, CEO Farsight Security, Inc.
One Namespace, Many Circles Dr. Paul Vixie, CEO Farsight Security, Inc. DNS Works Only Because of Voluntary Cooperation Every Internet host chooses Recursive DNS servers Can either believe ISP settings,
DNSSec Operation Manual for the.cz and e164.arpa Registers
DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers version 1.9., valid since 1 January 2010 Introduction This material lays out operational rules that govern the work of the CZ.NIC association
ROOT SERVERS MANAGEMENT AND SECURITY
ROOT SERVERS MANAGEMENT AND SECURITY WSIS African regional meeting 01/29/05 ALAIN PATRICK AINA aalain@trstech.net What is DNS(1)? Addresses are used to locate objects Names are easier to remember than
5 DNS Security Extensions DNSSEC
Information Security 1 (InfSi1) 5 DNS Security Extensions DNSSEC Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) Andreas Steffen, 22.10.2013, 5-DNSSEC.pptx 1 Information
Rolling the Root Zone KSK. Matt Larson ICANN56 (Helsinki ) June 2016
Rolling the Root Zone KSK Matt Larson ICANN56 (Helsinki ) June 2016 matt.larson@icann.org 1 DNSSEC in the Root Zone Managed Jointly ICANN (IANA Functions Operator) Manages the KSK, same key since operations
In the Domain Name System s language, rcode 0 stands for: no error condition.
12/2017 SIMPLE, FAST, RESILIENT In the Domain Name System s language, rcode 0 stands for: no error condition. If a DNS server answers a query with this result code, the service is running properly. This
Afilias DNSSEC Practice Statement (DPS) Version
Afilias DNSSEC Practice Statement (DPS) Version 1.07 2018-02-26 Page 1 of 8 1. INTRODUCTION 1.1. Overview This document was created using the template provided under the current practicing documentation.
Root KSK Roll Delay Update
Root KSK Roll Delay Update PacNOG 21 Patrick Jones, Sr. Director, Global Stakeholder Engagement 4 December 2017 1 Background When you validate DNSSEC signed DNS records, you need a Trust Anchor. A Trust
DNSSEC Policy and Practice Statement. Anne-Marie Eklund Löwinder Quality and Security Manager
DNSSEC Policy and Practice Statement Anne-Marie Eklund Löwinder Quality and Security Manager amel@iis.se What is a DNSSEC Policy and Practice Statement (DPS)? A document that contains the DNSSEC Policy
President s Report 2009
President s Report 2009 Paul Twomey, President and CEO Public Forum 2 March 2009 At Large Summit New gtld Program IDN cctld Fast Track 2010 Operating Plan and Budget Improving Institutional Confidence
Signing the Root. MENOG 7 Istanbul, Turkey October 2010
Signing the Root MENOG 7 Istanbul, Turkey October 2010 Mehmet Akcin AS SEEN IN ROOT and my T-Shirt. IN DS 19036 8 2 49AAC11D7B6F6446702E54A 1607371607A1A41855200FD 2CE1CDDE32F24E8FB5 Since July 15, 2010
DNSSEC PRACTICE STATEMENT FOR TOP-LEVEL DOMAINS
MAY 28, 2016 DNSSEC PRACTICE STATEMENT FOR TOP-LEVEL DOMAINS ABSTRACT THIS DOCUMENT IS A STATEMENT OF SECURITY PRACTICES AND PROVISIONS WHICH ARE APPLIED TO THE ADMINISTRATION AND OPERATION OF DNS SECURITY
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
DNSSEC Policy and Practice Statement. Anne-Marie Eklund Löwinder Quality and Security Manager
DNSSEC Policy and Practice Statement Anne-Marie Eklund Löwinder Quality and Security Manager amel@iis.se What is a DNSSEC Policy and Practice Statement (DPS)? contains Policy and Practice Statements for
DNSSEC Deployment in the.gov TLD
DNSSEC Deployment in the.gov TLD Scott Rose, NIST scott.rose@nist.gov LISA 2012, San Diego CA Dec. 14, 2012 What This Talk Will Cover DNSSEC deployment drivers in the US Federal government How did deployment
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
DNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
DNSSEC deployment. Phil Regnauld Hervey Allen
DNSSEC deployment Phil Regnauld Hervey Allen Overview We will talk about: the problems that DNSSEC addresses the protocol and implementations the practical problems tied to real-world deployment We will
CIRA DNSSEC PRACTICE STATEMENT
CIRA DNSSEC PRACTICE STATEMENT 1. Introduction This DNSSEC Practice Statement ( DPS ) is a statement of security practices and provisions made by the Canadian Internet Registration Authority (CIRA). These
RIPE NCC DNS Update. Wolfgang Nagele DNS Services Manager
RIPE NCC DNS Update Wolfgang Nagele DNS Services Manager DNS Department Services Reverse DNS for RIPE NCC zones Secondary for other RIRs K-root F-reverse (in-addr.arpa & ip6.arpa) Secondary DNS for cctlds
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016 edward.lewis@icann.org 1 Motivation for this talk ICANN is about to change an important configuration parameter in DNSSEC
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
Root KSK Roll Delay Update
Root KSK Roll Delay Update Data is good! David Conrad, CTO (channeling Roy Arends, ICANN Principal Research Scientist) 12 November 2017 1 Background When you validate DNSSEC signed DNS records, you need
Richemont DNS Inc. DNS Practice Statement for the PANERAI Zone. Version 0.2
Richemont DNS Inc. DNS Practice Statement for the PANERAI Zone Version 0.2 1 Table of contents 1 INTRODUCTION...6 1.1 Overview... 6 1.2 Document Name and Identification... 6 1.3 Community and Applicability...
2017 DNSSEC KSK Rollover. DSSEC KSK Rollover
2017 DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover APNIC 44 Edward.Lewis@icann.org FIRST TC September 11, 2017 13 September 2017 DNSSEC Signing vs. Validation DNS Security Extensions Digital
2017 DNSSEC KSK Rollover. Guillermo Cicileo LACNIC March 22, 2017
2017 DNSSEC KSK Rollover Guillermo Cicileo LACNIC March 22, 2017 Purpose of this Talk 1 2 3 To publicize the new Root Zone DNSSEC KSK Provide status, upcoming events, and contact information Provide helpful
DNSSEC KSK-2010 Trust Anchor Signal Analysis
DNSSEC KSK-2010 Trust Anchor Signal Analysis MAPRG @ IETF102 1 Overview Background: DNSSEC KSK rollover and plan Problems with the KSK rollover Case study analysis: difficulty in identifying old Trust
Algorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
ccnso IANAWG: DNSSEC BRIEFING and Root Zone Signing (Part I) Date: 4th February 2008
ccnso IANAWG: DNSSEC BRIEFING and Root Zone Signing (Part I) Date: 4th February 2008 Summary This document is the first part of a briefing from the ccnso IANA Working Group about DNSSEC, provided in response
DNSSEC Practice Statement (DPS) for.lat TLD
DNSSEC Practice Statement (DPS) for.lat TLD Network Information Center Mexico Ave Eugenio Garza Sada 427 Loc. 4, 5 y 6 - C. P. 64840 Monterrey, NL, Mexico 1 Table of Contents 1. Introduction... 6 1.1.
Root KSK Rollover Update (or, We're really doing it this time)
Root KSK Rollover Update (or, We're really doing it this time) Andres Pavez IANA LACNIC 29 / LACNOG 4 May 2018 What is the DNSSEC KSK? Two Components ("Keys") with a special mathematical bond Private KSK
By Paul Wouters
By Paul Wouters Overview presentation Theory of DNSSEC Using bind with DNSSEC Securing Ò.nlÓ with SECREG Securing Ò.orgÓ with VerisignLabs Deploying DNSSEC on large scale Audience participation
Experience from a Swedish Agency and a Nordic operator
Experience from a Swedish Agency and a Nordic operator fredrik@xpd.se Overview Skatteverket (Swedish Tax Agency) End user perspective TDC Registrar perspective Skatteverket Why DNSSEC? How to deploy? What
Scott Rose, NIST Winter JointTechs Meeting Jan 30, 2011 Clemson University
Scott Rose, NIST scottr@nist.gov 2011 Winter JointTechs Meeting Jan 30, 2011 Clemson University Special Thanks to RIPE NCC who provided the base slides for this tutorial. DNS is not secure Known vulnerabilities
DNSSEC Sample Implementation Module 1. CaribNOG 3 12 June 2012, Port of Spain, Trinidad
DNSSEC Sample Implementation Module 1 CaribNOG 3 12 June 2012, Port of Spain, Trinidad richard.lamb@icann.org DNSSEC: Where we are Deployed on 87/313 TLDs (.uk,.fr,.asia,.in,.lk,.kg,.tm,.am,.tw 台灣台湾,.jp,.cr,.com,
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
Madison, Wisconsin 9 September14
1 Madison, Wisconsin 9 September14 2 Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN Engineering 3 Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard
DNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
THE BRUTAL WORLD OF DNSSEC
THE BRUTAL WORLD OF DNSSEC Patrik Fältström Head of Technology Netnod 1 Security Issues with DNS Zone Administrator Bad Data False Master Caching Resolver Zonefile Master Slave slave slave False Cache
APNIC DNSSEC APNIC DNSSEC. Policy and Practice Statement. DNSSEC Policy and Practice Statement Page 1 of 12
APNIC DNSSEC Policy and Practice Statement DNSSEC Policy and Practice Statement Page 1 of 12 Table of Contents Overview 4 Document name and identification 4 Community and applicability 4 Specification
Service Levels for Root Zone Management CENTR Helsinki, June Kim Davies Internet Assigned Numbers Authority
Service Levels for Root Zone Management CENTR Helsinki, June 2007 Kim Davies Internet Assigned Numbers Authority Agenda What brought this on? What do we measure? What are our obligations today? What are
Unintended Consequences
Unintended Consequences Obfuscated Attacks on TLDs Eberhard W Lisse & Alejandra Reynoso Namibian Network Information Center & Universidad del Valle de Guatemala 2017-06-26 Lisse & Reynoso (Johannesburg)
DEPLOY A DNS SERVER IN A SECURE WAY
DEPLOY A DNS SERVER IN A SECURE WAY BIND (Berkeley Internet Name Domain) is one of the more widely used DNS servers. This article guides readers on how to deploy a BIND DNS server in a secure way by implementing
DNS Security. APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga
DNS Security APNIC42 Colombo Sri Lanka 01 October 2016 Champika Wijayatunga 2 Brief Overview of DNS What is the Domain Name System? A distributed database primarily used to obtain
IANA Developments ccnso, Wellington Kim Davies Internet Assigned Numbers Authority
IANA Developments ccnso, Wellington 2006 Kim Davies Internet Assigned Numbers Authority Coming up: Brief Update IANA Development Work Goals Very Brief Update on IANA Operations Yoshiko Chong joined our
Table of Contents. DNS security basics. What DNSSEC has to offer. In what sense is DNS insecure? Why DNS needs to be secured.
Table of Contents DNS security basics The basics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.3, 2013/09/13 11:46:36) Tuesday, Sep 17, 2013 Why DNS needs to
That KSK Roll. Geoff Huston APNIC Labs
That KSK Roll Geoff Huston APNIC Labs The DNS may look simple But with the DNS, looks are very deceiving So lets talk DNSSEC DNSSEC introduces digital signatures into the DNS It allows a DNS resolver to
DNSSEC en.mx. Network Information Center México
DNSSEC en.mx Network Information Center México 2 Agenda 1. About NIC México 2..mx DNSSEC test bed 3. Education about DNSSEC 4. NSEC zone walking 3 About NIC México cctld operator of.mx (México). National
Stichting NLnet Labs NLnet Labs
Stichting NLnet Labs NLnet Labs To develop Open Source Software and Open Standards for the benefits of the Internet. Paraphrased Article 1 of the Foundations Charter Areas of Interest DNS IP and Routing
Draft Applicant Guidebook, v4
Draft Applicant Guidebook, v4 Module 5 Please note that this is a discussion draft only. Potential applicants should not rely on any of the proposed details of the new gtld program as the program remains
Securing Routing: RPKI Overview. Mark Kosters Chief Technology Officer
Securing Routing: RPKI Overview Mark Kosters Chief Technology Officer Why are DNSSEC and RPKI important? Two of the most critical resources DNS Routing Hard to tell when resource is compromised Focus of
E. Lewis ARIN September 23, KEY RR Secure Entry Point Flag draft-ietf-dnsext-keyrr-key-signing-flag-09. Status of this Memo
DNS Extensions Internet-Draft Expires: March 23, 2004 O. Kolkman RIPE NCC J. Schlyter E. Lewis ARIN September 23, 2003 Status of this Memo KEY RR Secure Entry Point Flag draft-ietf-dnsext-keyrr-key-signing-flag-09
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution
SYSADMIN DNSSEC Sergey Ilin, Fotolia Trusted name resolution with DNSSEC CHAIN OF TRUST Some Internet exploits target name resolution servers. DNSSEC uses cryptography to protect the name resolution service.
DNS SECurity Extensions technical overview
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research developed by EURid in cooperation with industry experts
Impact of Rolling the Root KSK. Ed Lewis NetNod October 2015
Impact of Rolling the Root KSK Ed Lewis NetNod October 2015 edward.lewis@icann.org Agenda Background on DNS, DNSSEC ICANN as the KSK maintainer Valida=on of DNSSEC Impact of a Key Roll Note I have more
Security and Stability Advisory Committee!! Activities Update! ICANN Los Angeles Meeting! October 2014! #ICANN51
Security and Stability Advisory Committee!! Activities Update! ICANN Los Angeles Meeting! October 2014! 1 Agenda 1. Overview (5 minutes) 2. Recent Achievements (5 minutes) 3. IANA Functions Stewardship
Root Zone DNSSEC KSK Rollover. DSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 2017 Edward Lewis DSSEC KSK Rollover ENOG 15 Edward.Lewis@icann.org FIRST TC September 11, 2017 5 June 2018 The Basics This talk is related to the Domain Name System, in particular,
DNSSEC for Humans and BIND 10. Paul Vixie Internet Systems Consortium June 9, 2011
DNSSEC for Humans and BIND 10 Paul Vixie Internet Systems Consortium June 9, 2011 Agenda BIND and DNSSEC Why do I want DNSSEC? Why DNSSEC for Humans? BIND 9.7 Features More DNSSEC for Humans Why BIND 10?
MAGPI: Advanced Services IPv6, Multicast, DNSSEC
MAGPI: Advanced Services IPv6, Multicast, DNSSEC Shumon Huque MAGPI GigaPoP & Univ. of Pennsylvania MAGPI Technical Meeting April 19th 2006, Philadelphia, PA 1 Outline A description of advanced services
DNS and SMTP. James Walden CIT 485: Advanced Cybersecurity. James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31
DNS and SMTP James Walden CIT 485: Advanced Cybersecurity James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31 Table of contents 1. DNS 2. DNS Protocol Packets 3. DNS Caching 4. DNS Cache Poisoning
Root Management Update
Root Management Update San Francisco, USA March 2011 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers IANA NOI Notice of Inquiry IANA Contract expires later in 2011
RIPE Network Coordination Centre. K-root and DNSSEC. Wolfgang Nagele RIPE NCC.
K-root and DNSSEC Wolfgang Nagele RIPE NCC RIPE NCC One of the five Regional Internet Registries Provides IP address and AS number resources to Europe and Middle-East regions DNS related work - Parent
Rolling the Root. Geoff Huston APNIC Labs March 2016
Rolling the Root Geoff Huston APNIC Labs March 2016 Use of DNSSEC Validation in Today s Internet Why is this relevant? Because the root zone managers are preparing to roll the DNS Root Zone Key Signing
Impact on Root Server Operations and Provisioning
Impact on Root Server Operations and Provisioning Due to New Joe Abley & Kim Davies 2012 Impact'on'Root'Server'Operations'and'Provisioning'Due'to'New'gTLDS'June'2012' ' ' Table&of&Contents& Management&Summary&...&4!
A Security Evaluation of DNSSEC with NSEC Review
A Security Evaluation of DNSSEC with NSEC Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being
Understanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
Draft Applicant Guidebook, v3
Draft Applicant Guidebook, v3 Module 5 Please note that this is a discussion draft only. Potential applicants should not rely on any of the proposed details of the new gtld program as the program remains
Security Overlays on Core Internet Protocols DNSSEC and RPKI. Mark Kosters ARIN CTO
Security Overlays on Core Internet Protocols DNSSEC and RPKI Mark Kosters ARIN CTO Why are DNSSEC and RPKI Important Two critical resources DNS Routing Hard to tell if compromised From the user point of
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012
ICANN DNSSEC Workshop Comcast s Operational Experiences 14 March 2012 NATIONAL ENGINEERING & TECHNICAL OPERATIONS DNSSEC Deployment Status We began working on this in 2008 (see Bmeline) We completed our