5 DNS Security Extensions DNSSEC
|
|
|
- Julie O’Connor’
- 6 years ago
- Views:
Transcription
1 Information Security 1 (InfSi1) 5 DNS Security Extensions DNSSEC Prof. Dr. Andreas Steffen Institute for Internet Technologies and Applications (ITA) Andreas Steffen, , 5-DNSSEC.pptx 1
2 Information Security 1 (InfSi1) 5.1 Kaminsky Attack on the Domain Name Service Andreas Steffen, , 5-DNSSEC.pptx 2
3 DNS Resolution via Recursive Nameserver Andreas Steffen, , 5-DNSSEC.pptx 3
4 DNS Request Andreas Steffen, , 5-DNSSEC.pptx 4
5 DNS Response Andreas Steffen, , 5-DNSSEC.pptx 5
6 Simple DNS Cache Poisoning Andreas Steffen, , 5-DNSSEC.pptx 6
7 Guessing Query ID and UDP Source Port Andreas Steffen, , 5-DNSSEC.pptx 7
8 The Dan Kaminsky DNS Vulnerability July 2008 Andreas Steffen, , 5-DNSSEC.pptx 8
9 Information Security 1 (InfSi1) 5.2 DNS Root Servers Andreas Steffen, , 5-DNSSEC.pptx 9
10 DNS Root Servers IPv4 IPv6 Operator # A :503:BA3E::2:30 VeriSign Inc. 8 B :478:65::53 Information Sciences Institute, USC 1 C Cogent Communications 8 D :500:2D::D University of Maryland 2 E NASA Ames Research Center 12 F :500:2F::F Internet Systems Consortium Inc. 56 G US DoD Network Information Center 6 H :500:1::803F:235 US Army Research Lab 2 I :7FE::53 Netnod 43 J :503:C27::2:30 VeriSign Inc. 69 K :7FD::1 RIPE NCC 17 L :500:3::42 ICANN 146 M :DC3::35 WIDE Project 6 Total number of servers: 376 Andreas Steffen, , 5-DNSSEC.pptx 10
11 Global Map of Root Servers Andreas Steffen, , 5-DNSSEC.pptx 11
12 Information Security 1 (InfSi1) 5.3 DNS Security Resource Records Andreas Steffen, , 5-DNSSEC.pptx 12
13 DNSSEC Chain of Trust root ch. switch.ch. * root DNSKEY () root DNSKEY () / ch. DS ch. DNSKEY () ch. DNSKEY () switch.ch. DS / * explicit import e.g. via trusted web site switch.ch. DNSKEY () switch.ch. DNSKEY () / switch.ch. NS ns1/ns2 A x.x.x.x Andreas Steffen, , 5-DNSSEC.pptx 13
14 DNSSEC Resource Records I - DNSKEY DNSKEY - DNS Public Key Contains a public key used to sign the RRsets of a zone switch.ch IN DNSKEY AwEAAeCDWwjJO4mXBzayiKf4p7waJ7Ew eunstsawkxpfelci4iavdbugzypfszig 9R6TIPky3LoPAPmIjCc2fbFkKnrGI7hJ jxagmrwrjibprfx4bxzssjsvgb6mgc+e xhslxw== ;{id = (zsk), size = 768b} Flags field 256 -> Zone Signing Key () 257 -> Key Signing Key () with secure entry point (SEP) flag set Algorithm field 5 -> SHA-1 with RSA 7 -> SHA-1 with RSA & NSEC3 with SHA-1 8 -> SHA-256 with RSA 10 -> SHA-512 with RSA Andreas Steffen, , 5-DNSSEC.pptx 14
15 DNSSEC Resource Records II - RRSIG RRSIG - Resource Record Signature Contains a public key signature over a resource record set (RRset) merapi.switch.ch IN A merapi.switch.ch IN RRSIG A switch.ch. 3KW9YjxdL08FqVYKFSn9 Q4+8U1iYrVCun+J1Ny8Y IiMC+6oQS/GZwRn2mr+H MruwEjNB9s7bWGzRmRiR TATPvS67gxjCiJkSP58P kgj1dw3wbaz6r1fegnvz KhHLhvRe ;{id = 64608} Signature Expiration and Inception Fields The signature is not valid before Inception and after Expiration date. Key Tag Field Contains the key tag of the key which signed the RRset. Andreas Steffen, , 5-DNSSEC.pptx 15
16 DNSSEC Resource Records III - DS DS - Delegation Signer Signed hash computed over of child zone switch.ch IN DS dcfca519cf8b cc switch.ch IN DS cef df83311a92b48ae7f19 1ae e38b1ab7b3d0966b9ee55 switch.ch IN RRSIG DS ch. LPh8RgXQSqPcdQz6s1PJOjTuopO9RxQg s1yycy/cnhyahxb6ndnbj7qp20ekn+91 /ULjN4Ep/k9Pgtos979i5OfEXpfLcWcv rkp1xgvqw4pjp+mt1pds6ukiseuqgboq p7+nkkzjy+ysdbxttv+/8uhcsnnmxomm SqPms3G0aw4= ;{id = 31034} Andreas Steffen, , 5-DNSSEC.pptx 16
17 DNSSEC Resource Records IV - NSEC NSEC Next Owner Name Authenticated denial of existence of an owner name merapi.switch.ch. 180 IN NSEC mercury.switch.ch. A PTR AAAA LOC RRSIG NSEC merapi.switch.ch. 180 IN RRSIG NSEC switch.ch. kw1snxwojkwoheg1p3ini83eoguq GujwvBT/MSWVQ+ms/2DXxjQcpt1Z P07+XI51cc0t7erUUG31KZdmUpXZ tqzpujh49jjlh9atjrih1xghlxv5 af+n95jdykrgsoaq ;{id = 64608} Proof that there is no name between merapi.switch.ch. and mercury.switch.ch. Allows enumeration of complete zone data!!! Andreas Steffen, , 5-DNSSEC.pptx 17
18 DNSSEC Resource Records V - NSEC3 NSEC3 Next Owner Name in Hashed Order Hashed Authenticated Denial of Existence h9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 691 IN NSEC d399eaab h9rsfb7fpf2l8hg35cmpc765tdk23rp6 NS SOA RRSIG DNSKEY NSEC3PARAM ; flags: optout h9p7u7tr2u91d0v0ljs9l1gidnp90u3h.org. 691 IN RRSIG NSEC org. a+cc37hrm7ycfbazn2sergy9h247gxptcubyf45twaor xvbwtaxpt+uwz/4hxwc2v7ar7zz8uominjvysl59efw8 Xtgws4/Aih0fJ2/O8yUHwI695fRf9PrpxXEpqzStjSZP 5arJ1oldDAHcnxgLqdAMW6wnK1FNrslfJblJlmU= ;{id = 5273} Proof that there is no name between org. and???.org. Does not allow straight enumeration of zone data! Dictionary attacks are possible but expensive. Andreas Steffen, , 5-DNSSEC.pptx 18
19 Information Security 1 (InfSi1) 5.4 DANE Andreas Steffen, , 5-DNSSEC.pptx 19
20 DNS-based Authentication of Named Entities DANE (RFC 6698, August 2012) DANE defines a TLSA Resource Record Cert. Usage Selector Matching Type Certificate Association Data Certificate Usage 0 CA Certificate Constraint 1 Server Certificate Constraint 2 Trust Anchor Assertion for Private CA 3 Domain Issued Certificate Selector 0 Full Certificate 1 Public Key Info (Public Key plus Key Type Information) Matching Type 0 Exact Match on Selected Content 1 SHA-256 Hash of Selected Content 2 SHA-512 Hash of Selected Content Andreas Steffen, , 5-DNSSEC.pptx 20
21 DANE Verifying Server and CA Certificates TLS Server private key DNS Server hsr.ch Kool CA check server certificate TLSA SHA-256 Hash TLS Client Kool CA Kool CA or check CA certificate TLSA SHA-512 Hash Andreas Steffen, , 5-DNSSEC.pptx 21
22 DANE Getting CA Certificate or Public Key TLS Server private key DNS Server hsr.ch HSR CA TLS Client get CA certificate or get CA public key TLSA HSR CA HSR CA TLSA Andreas Steffen, , 5-DNSSEC.pptx 22
23 DANE Verifying Self-Signed Server Certificates TLS Server private key DNS Server hsr.ch Self check server certificate TLSA SHA-256 Hash TLS Client Andreas Steffen, , 5-DNSSEC.pptx 23
24 DANE Verifying Raw RSA Keys TLS Server private key DNS Server hsr.ch check server public key TLSA SHA-256 Hash TLS Client Andreas Steffen, , 5-DNSSEC.pptx 24
25 DANE Getting Server Certificate or Public Key TLS Server private key DNS Server hsr.ch TLS Client get server certificate or get server public key TLSA Self TLSA Andreas Steffen, , 5-DNSSEC.pptx 25
26 Information Security 1 (InfSi1) 5.5 DNS Root Signing Process Andreas Steffen, , 5-DNSSEC.pptx 26
27 DNSSEC Root Zone Signing Process DS Records TLD Operator ICANN Vetting and Processing DS Records DS Records DS Records DoC NTIA VeriSign Authorization of Changes Editing and Signing of Root Zone Root Root Servers (A,..., M) Andreas Steffen, , 5-DNSSEC.pptx 27
28 DNSSEC Root Zone Signing Key Signing Process Private Key VeriSign Management KSR Key Signing Request ICANN Management Private Key SKR Signed Key Response Published on Web Site Andreas Steffen, , 5-DNSSEC.pptx 28
29 ICANN Key Ceremonies Tier 1 Facility Access Control by Data Center Tier 2 Facility Access Control by Data Center Tier 3 Facility Access Control by Data Center Tier 4 Cage Access Control by Data Center Tier 5 Safe Room Access Control by ICANN Tier 6 Safe #1 Tier 6 Safe #2 Tier 7 HSM Tier 7 Safe Deposit Box Private Keys Key Ceremony Computer Crypto Officers Credentials Andreas Steffen, , 5-DNSSEC.pptx 29
30 ICANN Key Ceremonies Andreas Steffen, , 5-DNSSEC.pptx 30
31 Periodic Key Rollover T-10 T+0 T+10 T+20 T+30 T+40 T+50 T+60 T+70 T+80 T+90 Rollover (every 90 days) post-publish pre-publish pre-publish post-publish Optional Rollover (every 2-5 years or on demand) publish+sign publish+sign publish+sign publish publish+sign publish publish+sign publish publish+sign publish publish+sign publish revoke+sign publish+sign revoke+sign publish+sign publish+sign publish+sign RRSIG Validity Period (10 days + 50% overlap) Andreas Steffen, , 5-DNSSEC.pptx 31
32 DNSSEC Deployment (October 22, 2013) TLDs signed by root zone: 13 gtlds: arpa asia biz cat com edu gov info mil museum net org post 81 cctlds: ac af ag am at be bg br bz ca cc ch cl co cr cx cz de dk eu fi fo fr gi gl gn gr gs hn in io is jp kg ki kr la lb lc li lk lt lu lv me mm mn my na nc nf nl nu nz pl pm pr pt pw re ru sb sc se sh si su sx tf th tm tt tv tw tz ua ug uk us wf yt 8 IDN cctlds: xn--kprw13d xn--kpry57d ( 台湾 Taiwan) xn--mgbx4cd0ab مليسيا) Malaysia) xn--3e0b707e ( 한국 South Korea) xn--o3cw4h (ไทย Thailand) xn-l1acc (мон Mongolia) xn-h2brj9c (भ रत India) xn--p1ai (рф Russia) Signing of major gtlds: net: December 2010 com: March 2011 Andreas Steffen, , 5-DNSSEC.pptx 32
DNSSEC Workshop. Dan York, Internet Society ICANN 53 June 2015
DNSSEC Workshop Dan York, Internet Society ICANN 53 June 2015 First, a word about our host... 2 Program Committee Steve Crocker, Shinkuro, Inc. Mark Elkins, DNS/ZACR Cath Goulding, Nominet Jean Robert
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS
12 DNS Security Extensions DNS resolution via recursive nameserver DNS request/response format Simple DNS cache poisoning The Dan Kaminsky DNS vulnerability DNS root servers DNSSEC chain of trust DNSSEC
DNSSEC for the Root Zone. IETF 76 Hiroshima November 2009
DNSSEC for the Root Zone IETF 76 Hiroshima November 2009 Jakob Schlyter Richard Lamb, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
THE BRUTAL WORLD OF DNSSEC
THE BRUTAL WORLD OF DNSSEC Patrik Fältström Head of Technology Netnod 1 Security Issues with DNS Zone Administrator Bad Data False Master Caching Resolver Zonefile Master Slave slave slave False Cache
The State and Challenges of the DNSSEC Deployment. Eric Osterweil Michael Ryan Dan Massey Lixia Zhang
The State and Challenges of the DNSSEC Deployment Eric Osterweil Michael Ryan Dan Massey Lixia Zhang 1 Monitoring Shows What s Working and What needs Work DNS operations must already deal with widespread
DNSSEC for the Root Zone. NZNOG Hamilton, NZ January 2010
DNSSEC for the Root Zone NZNOG Hamilton, NZ January 2010 Joe Abley, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
DNSSEC for the Root Zone. IETF 76 8 November 2009
DNSSEC for the Root Zone IEPG @ IETF 76 8 November 2009 Richard Lamb, ICANN Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010
DNS Security and DNSSEC in the root zone Luzern, Switzerland February 2010 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers Recap DNS originally not designed with
Practices on DNS Management and Domain Name Emerging Topics. Jirasak Jullawat July 14, 2016
Practices on DNS Management and Domain Name Emerging Topics Jirasak Jullawat July 14, 2016 TABLE OF CONTENTS 1. Definition of Domain Name 2. Domain Name Structure 3. Why Domain Name? 4..th Management 5.
DNSSEC for the Root Zone. ICANN 37 Nairobi March 2010
DNSSEC for the Root Zone ICANN 37 Nairobi March 2010 Kim Davies, ICANN This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA Design Design Requirements
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder. System and Network Engineering July 2014
Hoda Rohani Anastasios Poulidis Supervisor: Jeroen Scheerder System and Network Engineering July 2014 DNS Main Components Server Side: Authoritative Servers Resolvers (Recursive Resolvers, cache) Client
DNS/DNSSEC Workshop. In Collaboration with APNIC and HKIRC Hong Kong. Champika Wijayatunga Regional Security Engagement Manager Asia Pacific
DNS/DNSSEC Workshop In Collaboration with APNIC and HKIRC Hong Kong Champika Wijayatunga Regional Security Engagement Manager Asia Pacific 22-24 January 2018 1 DNSSEC 2 2 DNS: Data Flow Zone administrator
DNSSEC Trust tree: (A) ---dnslab.org. (DS keytag: 9247 dig (DNSKEY keytag. ---org. (DS keytag: d
DNSSEC Trust tree: www.dnslab.org. (A) ---dnslab.org. (DNSKEY keytag: 7308 alg ---dnslab.org. (DNSKEY keytag: 9247 ---dnslab.org. (DS keytag: 9247 dig DNSSEC ---org. (DNSKEY keytag: 24209 a Domain Name
DNS security. Karst Koymans & Niels Sijm. Tuesday, September 18, Informatics Institute University of Amsterdam
DNS security Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Tuesday, September 18, 2012 Karst Koymans & Niels Sijm (UvA) DNS security Tuesday, September 18, 2012 1 / 38 1 Chain
Signing the Root. MENOG 7 Istanbul, Turkey October 2010
Signing the Root MENOG 7 Istanbul, Turkey October 2010 Mehmet Akcin AS SEEN IN ROOT and my T-Shirt. IN DS 19036 8 2 49AAC11D7B6F6446702E54A 1607371607A1A41855200FD 2CE1CDDE32F24E8FB5 Since July 15, 2010
DNSSEC All You Need To Know To Get Started
DNSSEC All You Need To Know To Get Started Olaf M. Kolkman RIPE NCC A Semi Technical Introduction Why do we need DNSSEC What does DNSSEC provide How does DNSSEC work Question: www.ripe.net A Reminder:
Toward Unspoofable Network Identifiers. CS 585 Fall 2009
Toward Unspoofable Network Identifiers CS 585 Fall 2009 The Problem DNS Spoofing Attacks (e.g., Kaminsky) At link (Ethernet) and IP layers, either: Software sets the source address in the packet, or Software
Table of Contents. DNS security. Alternative DNS security mechanism. DNSSEC specification. The long (and winding) road to the DNSSEC specification
Table of Contents DNS security Karst Koymans Informatics Institute University of Amsterdam (version 1.19, 2011/09/27 14:18:11) Friday, September 23, 2011 The long (and winding) road to the DNSSEC specification
Scott Rose, NIST Winter JointTechs Meeting Jan 30, 2011 Clemson University
Scott Rose, NIST scottr@nist.gov 2011 Winter JointTechs Meeting Jan 30, 2011 Clemson University Special Thanks to RIPE NCC who provided the base slides for this tutorial. DNS is not secure Known vulnerabilities
SOFTWARE ARCHITECTURE 9. NAME RESOLUTION.
1 SOFTWARE ARCHITECTURE 9. NAME RESOLUTION Tatsuya Hagino hagino@sfc.keio.ac.jp lecture URL https://vu5.sfc.keio.ac.jp/slide/ 2 OSI Reference Model Open Systems Interconnect ISO defined around 1984. Application
Table of Contents. DNS security basics. What DNSSEC has to offer. In what sense is DNS insecure? Why DNS needs to be secured.
Table of Contents DNS security basics The basics Karst Koymans (with Niels Sijm) Informatics Institute University of Amsterdam (version 2.3, 2013/09/13 11:46:36) Tuesday, Sep 17, 2013 Why DNS needs to
DNSSEC for the Root Zone. IEPG IETF 77 Anaheim, USA March 2010
DNSSEC for the Root Zone IEPG IETF 77 Anaheim, USA March 2010 Joe Abley, ICANN Matt Larson, VeriSign 1 This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC
Assessing and Improving the Quality of DNSSEC
Assessing and Improving the Quality of DNSSEC Deployment Casey Deccio, Ph.D. Sandia National Laboratories AIMS-4 CAIDA, SDSC, San Diego, CA Feb 9, 2012 Sandia is a multiprogram laboratory operated by Sandia
ARIN Support for DNSSEC and RPKI. ION San Diego 11 December 2012 Pete Toscano, ARIN
ARIN Support for DNSSEC and ION San Diego 11 December 2012 Pete Toscano, ARIN 2 DNS and BGP They have been around for a long time. DNS: 1982 BGP: 1989 They are not very secure. Methods for securing them
DNS and SMTP. James Walden CIT 485: Advanced Cybersecurity. James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31
DNS and SMTP James Walden CIT 485: Advanced Cybersecurity James WaldenCIT 485: Advanced Cybersecurity DNS and SMTP 1 / 31 Table of contents 1. DNS 2. DNS Protocol Packets 3. DNS Caching 4. DNS Cache Poisoning
An Overview of DNSSEC. Cesar Diaz! lacnic.net!
An Overview of DNSSEC Cesar Diaz! cesar@ lacnic.net! 1 DNSSEC??? The DNS Security Extension (DNS SEC) attach special kind of information called criptographic signatures to the queries and response that
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION
DNSSEC DNS SECURITY EXTENSIONS INTRODUCTION TO DNSSEC FOR SECURING DNS QUERIES AND INFORMATION Peter R. Egli 1/10 Contents 1. Security Problems of DNS 2. Solutions for securing DNS 3. Security with DNSSEC
CS 356 Using Cryptographic Tools to Secure the Domain Name System (DNS) Spring 2017
CS 356 Using Cryptographic Tools to Secure the Domain Name System (DNS) Spring 2017 Background Motivation Overview Network Infrastructure Security DNS and DNS Vulnerabilities The DNS Security Extensions
DNS Mark Kosters Carlos Martínez ARIN - LACNIC
DNS Workshop @CaribNOG8 Mark Kosters Carlos Martínez ARIN - LACNIC DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and integrity
Root Servers. Root hints file come in many names (db.cache, named.root, named.cache, named.ca) See root-servers.org for more detail
What is DNS? Systems to convert domain names into ip addresses: For an instance; www.tashicell.com 118.103.136.66 Reverse: 118.103.136.66 www.tashicell.com DNS Hierarchy Root Servers The top of the DNS
Domain Name System Security
Slide title 70 pt APITALS Domain Name System Security e subtitle um 30 pt Bengt Sahlin Ericsson Research NomadicLab Bengt.Sahlin@ericsson.com Objectives Provide DNS basics, essential for understanding
DNSSECfor the Root ZoneIEPG IETF 77 Anaheim, USA March 2010
DNSSECfor the Root ZoneIEPG IETF 77 Anaheim, USA March 2010 Joe Abley, ICANN Matt Larson, VeriSign This design is the result of a cooperation between ICANN & VeriSign with support from the U.S. DoC NTIA
DNS Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO
DNS Workshop @CaribNOG12 Mark Kosters Carlos Martínez {ARIN, LACNIC} CTO DNS Refresher and Intro to DNS Security Extension (DNSSEC) Outline Introduction DNSSEC mechanisms to establish authenticity and
DNS. dr. C. P. J. Koymans. September 16, Informatics Institute University of Amsterdam. dr. C. P. J. Koymans (UvA) DNS September 16, / 46
DNS dr. C. P. J. Koymans Informatics Institute University of Amsterdam September 16, 2008 dr. C. P. J. Koymans (UvA) DNS September 16, 2008 1 / 46 DNS and BIND DNS (Domain Name System) concepts theory
DNSSEC. Lutz Donnerhacke. db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec e164.arpa. naptr
DNSSEC Lutz Donnerhacke db089309: 1c1c 6311 ef09 d819 e029 65be bfb6 c9cb dig +dnssec 1.6.5.3.7.5.1.4.6.3.9.4.e164.arpa. naptr 1 A protocol from better times An ancient protocol People were friendly and
Some Lacunae in APNIC DNS Measurement. George Michaelson CAIDA WIDE Workshop Marina Del Ray 2006
Some Lacunae in APNIC DNS Measurement George Michaelson CAIDA WIDE Workshop Marina Del Ray 2006 Backtracking Same DNS measurement since 2001/2.. Re-installation of nameservers forced reinstallation of
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014!
DANE Demonstration! Duane Wessels, Verisign! ICANN 49 DNSSEC Workshop! March 26, 2014! Outline! What is DANE?! The TLSA Record! TLSA Browser Plugin! Generating the TLSA Record! Other uses for DANE! 2!
Domain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot September 2010 Bengt Sahlin 2011/09/27 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
SecSpider: Distributed DNSSEC Monitoring and Key Learning
SecSpider: Distributed DNSSEC Monitoring and Key Learning Eric Osterweil UCLA Joint work with Dan Massey and Lixia Zhang Colorado State University & UCLA 1 Who is Deploying DNSSEC? Monitoring Started From
ICANN proposal to sign the root. ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb
ICANN proposal to sign the root ICANN DNSSEC Workshop November 5, 2008, Cairo Dr. Richard Lamb richard.lamb@icann.org protects the lookup like HTTPS/SSL protects the conversation is about security not
Afilias DNSSEC Practice Statement (DPS) Version
Afilias DNSSEC Practice Statement (DPS) Version 1.07 2018-02-26 Page 1 of 8 1. INTRODUCTION 1.1. Overview This document was created using the template provided under the current practicing documentation.
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover
A Look at RFC 8145 Trust Anchor Signaling for the 2017 KSK Rollover Duane Wessels DNS-OARC 26 San Jose, CA September 29, 2017 Background 2 2017 Root Zone KSK Rollover October 11, 2017! Root zone DNSKEY
IDN query trends seen at JP and Root. Kazunori Fujiwara, JPRS 2016/4/3, IEPG meeting
IDN query trends seen at JP and Root Kazunori Fujiwara, JPRS fujiwara@jprs.co.jp 2016/4/3, IEPG meeting Is IDN use increasing? It is said that IDN is important for non- English speakers IDN implementations
DNSSEC at Scale. Dani Grant CloudFlare
DNSSEC at Scale Dani Grant DNS @ CloudFlare CloudFlare - Authoritative DNS provider (includes DNSSEC for free) - 4M+ domains - 40+ billion queries per day - 76 edge locations in 40 countries (growing)
Rolling the Root Zone KSK. Matt Larson ICANN56 (Helsinki ) June 2016
Rolling the Root Zone KSK Matt Larson ICANN56 (Helsinki ) June 2016 matt.larson@icann.org 1 DNSSEC in the Root Zone Managed Jointly ICANN (IANA Functions Operator) Manages the KSK, same key since operations
6 March 2012
6 March 2012 richard.lamb@icann.org www.majorbank.se=? 1.2.3.4 Get page Login page Username / Password Account Data DNS Resolver ISP www.majorbank.se = 1.2.3.4 DNS Server webserver www @ 1.2.3.4 Majorbank
APNIC DNSSEC APNIC DNSSEC. Policy and Practice Statement. DNSSEC Policy and Practice Statement Page 1 of 12
APNIC DNSSEC Policy and Practice Statement DNSSEC Policy and Practice Statement Page 1 of 12 Table of Contents Overview 4 Document name and identification 4 Community and applicability 4 Specification
Domain Name System Security
Domain Name System Security T-110.4100 Tietokoneverkot October 2008 Bengt Sahlin 2008/10/02 Bengt Sahlin 1 Objectives Provide DNS basics, essential for understanding DNS security
Understanding and Deploying DNSSEC. Champika Wijayatunga SANOG29 - Pakistan Jan 2017
Understanding and Deploying DNSSEC Champika Wijayatunga SANOG29 - Pakistan Jan 2017 Agenda 1 2 3 Background Why DNSSEC? How it Works? 4 5 Signatures and Key Rollovers DNSSEC Demo 2 3 Background DNS in
DNS SECurity Extensions technical overview
The EURid Insights series aims to analyse specific aspects of the domainname environment. The reports are based on surveys, studies and research developed by EURid in cooperation with industry experts
By Paul Wouters
By Paul Wouters Overview presentation Theory of DNSSEC Using bind with DNSSEC Securing Ò.nlÓ with SECREG Securing Ò.orgÓ with VerisignLabs Deploying DNSSEC on large scale Audience participation
I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist?
RRSIG: I certify that this DNS record set is correct Problem: how to certify a negative response, i.e. that a record doesn t exist? NSEC: I certify that there are no DNS records (of type X) whose record
TMCH Report March February 2017
TMCH Report March 2013 - February 2017 Contents Contents 2 1 Trademark Clearinghouse global reporting 3 1.1 Number of jurisdictions for which a trademark record has been submitted for 3 2 Trademark Clearinghouse
The Performance of ECC Algorithms in DNSSEC: A Model-based Approach
Master Thesis The Performance of ECC Algorithms in DNSSEC: A Model-based Approach Faculty: Group: Electrical Engineering, Mathematics and Computer Science Design and Analysis of Communication Systems Author
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011
Shared cctld DNSSEC Signing Platform Bill Woodcock and Rick Lamb ICANN San Francisco March 2011 ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards of security
Algorithm for DNSSEC Trusted Key Rollover
Algorithm for DNSSEC Trusted Key Rollover Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, FRANCE {gilles.guette, bernard.cousin, david.fort}@irisa.fr Abstract.
DNS Fundamentals. Steve Conte ICANN60 October 2017
DNS Fundamentals Steve Conte ICANN60 October 2017 Names and Numbers IP addresses easy for machines but hard for people IPv4: 192.0.2.7 IPv6: 2001:db8::7 People need to use names In the early days of the
Securing Domain Name Resolution with DNSSEC
White Paper Securing Domain Name Resolution with DNSSEC diamondip.com by Timothy Rooney Product management director BT Diamond IP Resolution with DNSSEC Introduction By Tim Rooney, Director, Product Management
A Security Evaluation of DNSSEC with NSEC Review
A Security Evaluation of DNSSEC with NSEC Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being
3. The DNSSEC Primer. Data Integrity (hashes) Authenticated Denial of Existence (NSEC,
3. The DNSSEC Primer Authentication (keys, signatures) Data Integrity (hashes) Chain of Trust (root zone, when signed) Authenticated Denial of Existence (NSEC, NSEC3) DNS Authoritative ROOT SERVERS TLD
CIRA DNSSEC PRACTICE STATEMENT
CIRA DNSSEC PRACTICE STATEMENT 1. Introduction This DNSSEC Practice Statement ( DPS ) is a statement of security practices and provisions made by the Canadian Internet Registration Authority (CIRA). These
Table of Contents DNS. Short history of DNS (1) DNS and BIND. Specification and implementation. A short history of DNS. Root servers.
Table of Contents Specification and implementation DNS Karst Koymans Informatics Institute University of Amsterdam (version 1.11, 2010/10/04 10:03:37) Tuesday, September 14, 2010 A short history of DNS
Implementing DNSSEC with DynDNS and GoDaddy
Implementing DNSSEC with DynDNS and GoDaddy Lawrence E. Hughes Sixscape Communications 27 December 2017 DNSSEC is an IETF standard for adding security to the DNS system, by digitally signing every resource
Table of Contents DNS. Short history of DNS (1) DNS and BIND. Specification and implementation. A short history of DNS.
Table of Contents Specification and implementation DNS dr. C. P. J. Koymans Informatics Institute University of Amsterdam September 14, 2009 A short history of DNS Root servers Basic concepts Delegation
Introduction to the DANE Protocol
Introduction to the DANE Protocol ICANN 46 April 10, 2013 Internet Society Deploy360 Programme Providing real-world deployment info for IPv6, DNSSEC and other Internet technologies: Case Studies Tutorials
DNSSEC at ORNL. Paige Stafford Joint Techs Conference, Fairbanks July 2011
DNSSEC at ORNL Paige Stafford Joint Techs Conference, Fairbanks July 2011 Outline Background Brief review of DNSSEC ORNL before DNSSEC was implemented Implementation experience Signer appliance Validation
Domain Name Service. DNS Overview. October 2009 Computer Networking 1
Domain Name Service DNS Overview October 2009 Computer Networking 1 Why DNS? Addresses are used to locate objects (contain routing information) Names are easier to remember and use than numbers DNS provides
DNSSEC at Penn. Shumon Huque University of Pennsylvania ESCC/Internet2 Joint Techs Conference July 20th 2009
DNSSEC at Penn Shumon Huque University of Pennsylvania ESCC/Internet2 Joint Techs Conference July 20th 2009 1 DNSSEC at a glance DNS Security Extensions A system to verify the authenticity of DNS data
Expires: June 16, 2004 VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003
DNS Extensions Internet-Draft Expires: June 16, 2004 R. Arends Telematica Instituut M. Larson VeriSign R. Austein ISC D. Massey USC/ISI S. Rose NIST December 17, 2003 Protocol Modifications for the DNS
Hands-on DNSSEC with DNSViz. Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016
Hands-on DNSSEC with DNSViz Casey Deccio, Verisign Labs RIPE 72, Copenhagen May 23, 2016 Preparation Demo and exercises available at: http://dnsviz.net/demo/ Includes links to the following: VirtualBox
DNSSEC. CS 161: Computer Security Prof. David Wagner. April 11, 2016
DNSSEC CS 161: Computer Security Prof. David Wagner April 11, 2016 DNSSEC Last lecture, you invented DNSSEC. Well, the basic ideas, anyway: Sign all DNS records. Signatures let you verify answer to DNS
DNS and cctld Management. Save Vocea and Champika Wijayatunga Apia Samoa July 2015
DNS and cctld Management Save Vocea and Champika Wijayatunga Apia Samoa 14-15 July 2015 Agenda 1 2 3 Intro to ICANN DNS Concepts Root Server Operation 4 5 6 Managing Zones cctld Management Security, Stability
The basics. Karst Koymans. Tuesday, September 9, 2014
.. DNS The basics Karst Koymans Informatics Institute University of Amsterdam (version 4.7, 2014/09/11 13:54:31) Tuesday, September 9, 2014 Karst Koymans (UvA) DNS Tuesday, September 9, 2014 1 / 64 .1
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson
Keeping DNS parents and children in sync at Internet Speed! Ólafur Guðmundsson olafur@cloudflare.com How long does it take to? Post a new selfie on Facebook and all your friends to be notified few seconds
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016
Rolling the Root Zone DNSSEC Key Signing Key Edward Lewis AFRINIC25 November 2016 edward.lewis@icann.org 1 Motivation for this talk ICANN is about to change an important configuration parameter in DNSSEC
Shifting Sands. PLNOG March Andrzej Wolski Training Department
Shifting Sands PLNOG March 2014 Andrzej Wolski Training Department RIPE NCC 2 Began operating in 1992 Not-for-profit membership organisation 10,000 members (Local Internet Registries) Neutral, Impartial,
2017 Root DNSSEC KSK Rollover. NANOG 70 June 6, 2017
2017 Root DNSSEC KSK Rollover Punky.Duero@iana.org NANOG 70 June 6, 2017 What is the Root Zone DNSSEC KSK? KSK The Root Zone DNSSEC Key Signing Key KSK is the top most cryptographic key in the DNSSEC hierarchy
Network Working Group Request for Comments: 5702 Category: Standards Track October 2009
Network Working Group J. Jansen Request for Comments: 5702 NLnet Labs Category: Standards Track October 2009 Abstract Use of SHA-2 Algorithms with RSA in DNSKEY and RRSIG Resource Records for DNSSEC This
DNS Security. Wolfgang Nagele DNS Services Manager
DNS Security Wolfgang Nagele DNS Services Manager DNS: the Domain Name System Specified by Paul Mockapetris in 1983 Distributed Hierarchical Database Main purpose: Translate names to IP addresses Since
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House
AfriNIC 14 Shared cctld DNSSEC Signing Platform June 9, 2011 Bill Woodcock Research Director Packet Clearing House ICANN - Common Goals ICANN Goals: Accelerate DNSSEC deployment Maintain the highest standards
Chapter 2 Application Layer. Lecture 5 DNS. Computer Networking: A Top Down Approach. 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012
Chapter 2 Application Layer Lecture 5 DNS Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Application Layer 2-1 Chapter 2: outline 2.1 principles
Documentation. Name Server Predelegation Check
Name Server Predelegation Check Doc. version: 1.4.1 Doc. status: Final Doc. date: 01.12.2015 Doc. name: Name Server Predelegation Check- -DNS Services-V1.4.1-2015-12-01 Copyright 2015 DENIC eg Imprint
GDS Resource Record: Generalization of the Delegation Signer Model
GDS Resource Record: Generalization of the Delegation Signer Model Gilles Guette, Bernard Cousin, and David Fort IRISA, Campus de Beaulieu, 35042 Rennes CEDEX, France {gilles.guette, bernard.cousin, david.fort}@irisa.fr
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting
DNSSEC in Switzerland 2 nd DENIC Testbed Meeting Frankfurt, 26. January 2010 Samuel Benz samuel.benz@switch.ch About SWITCH The SWITCH foundation operates the national research network since 1987 SWITCH
DNSSec Operation Manual for the.cz and e164.arpa Registers
DNSSec Operation Manual for the.cz and 0.2.4.e164.arpa Registers version 1.9., valid since 1 January 2010 Introduction This material lays out operational rules that govern the work of the CZ.NIC association
ROOT SERVERS MANAGEMENT AND SECURITY
ROOT SERVERS MANAGEMENT AND SECURITY WSIS African regional meeting 01/29/05 ALAIN PATRICK AINA aalain@trstech.net What is DNS(1)? Addresses are used to locate objects Names are easier to remember than
Step by step DNSSEC deployment in.se. Anne-Marie Eklund Löwinder Quality & Security
Step by step DNSSEC deployment in.se Anne-Marie Eklund Löwinder Quality & Security Manager,.SE amel@iis.se @amelsec www.iis.se Timeline 2005 signing of the.se zone. 2006 allowing DS records from friendly
Session J9: DNSSEC and DNS Security
Session J9 and Security InfoSec World 2008 Session J9: and Security Steve Pinkham, Maven Security Consulting What is? slide 2 Easy answer: Stands for Domain Name System System for converting names to/from
DNSSECbis Lookaside Validation. Peter Losher Internet Systems Consortium (November 2006)
DNSSECbis Lookaside Validation Peter Losher Internet Systems Consortium (November 2006) Topics Introduction DNS Delegation and Resolution DNSSECbis Data and Traversal DLV Overview
DNS Security. Wolfgang Nagele DNS Group Manager
DNS Security Wolfgang Nagele DNS Group Manager DNS: the Domain Name System Specified by Paul Mockapetris in 1983 Distributed Hierarchical Database Main purpose: Translate names to IP addresses Since then:
Root Zone DNSSEC KSK Rollover
Root Zone DNSSEC KSK Rollover 51 51 KSK Rollover: An Overview ICANN is in the process of performing a Root Zone DNS Security Extensions (DNSSEC) Key Signing Key (KSK) rollover The Root Zone DNSSEC Key
CSE 265: System & Network Administration
CSE 265: System & Network Administration DNS The Domain Name System History of DNS What does DNS do? The DNS namespace BIND software How DNS works DNS database Testing and debugging (tools) DNS History
# ICANN/ISOC cctld workshop # October 2006 # Sofia, Bulgaria. # implementing IDNs. Andrzej Bartosiewicz
# ICANN/ISOC cctld workshop # 24-26 October 2006 # Sofia, Bulgaria # implementing IDNs Andrzej Bartosiewicz andrzejb@nask.pl # schedule for.pl. August the 11 th, 2003: NASK s IETF draft September the 11
Deploying New DNSSEC Algorithms
Deploying New DNSSEC Algorithms ICANN 53 DNSSEC Workshop June 24, 2015 Buenos Aires, Argentina Dan York, Internet Society DNSSEC Algorithms Used to generate keys for signing DNSKEY Used in DNSSEC signatures
RSA and ECDSA. Geoff Huston APNIC. #apricot2017
RSA and ECDSA Geoff Huston APNIC It s all about Cryptography Why use Cryptography? Public key cryptography can be used in a number of ways: protecting a session from third party eavesdroppers Encryption
DNSSEC the.se way: Overview, deployment and lessons learned. Anne-Marie Eklund Löwinder Quality & Security Manager
DNSSEC the.se way: Overview, deployment and lessons learned Anne-Marie Eklund Löwinder Quality & Security Manager My agenda Getting Started Finding out about.se Finding out what DNS does for you Why DNSSEC?
RIR Update. A Joint Presentation Prepared By APNIC, ARIN, RIPE NCC. 17 March 2002 IEPG - Minneapolis
RIR Update A Joint Presentation Prepared By APNIC, ARIN, RIPE NCC Overview Joint Efforts RIR Specific Statistics Questions RIR Co-ordination IPv6 policy development Joint tutorial & presentation at AfNOG
DNS. Karst Koymans & Niels Sijm. Tuesday, September 7, Informatics Institute University of Amsterdam
DNS Karst Koymans & Niels Sijm Informatics Institute University of Amsterdam Tuesday, September 7, 2012 Karst Koymans & Niels Sijm (UvA) DNS Tuesday, September 7, 2012 1 / 62 1 DNS: what does it do and
More on DNS and DNSSEC
More on DNS and DNSSEC CS 161: Computer Security Prof. Raluca Ada Popa March 6, 2018 A subset of the slides adapted from David Wagner Domain names Domain names are human friendly names to identify servers
DNSSEC for ISPs workshop João Damas
DNSSEC for ISPs workshop João Damas (joao@isc.org) 1 Outline of workshop Brief intro to DNSSEC Overview of zone signing DNSSEC validation trust anchors validation impact of enabling validation debugging