Just a guy in Vermont trying to connect all the dots...
Dan York
Author's posts
Mar 27
Rough Guide to IETF 95: DNSSEC, DPRIVE, DANE and DNS Security
The most passionate discussions involving “DNS security” at IETF 95 in Buenos Aires may possibly take place not in the “traditional” DNS-related Working Groups, but rather over in the Using TLS in Applications (UTA) Working Group on Monday, April 4, 2016, at 14:00 ART where what looks like a vigorous discussion is shaping up about how to protect and secure email communication. Yes, email! On the UTA agenda there is not one but three different proposals for securing email – and all three include some discussion of DNSSEC and DANE (particularly after the publication of RFC 7672 in October about securing email with the DANE protocol). Based on the lengthy threads on the UTA mailing list, I expect a strong amount of discussion.
A second strong thread of activity will be around efforts to increase the security of DNSSEC through the use of elliptic curve cryptography. This will be discussed in both the DNSOP working group and also a new focused working group called CURDLE. It’s also the topic of a recent Internet-Draft I published with a number of others about the steps needed to implement elliptic curve cryptography.
The DPRIVE Working Group will also be meeting to continue its work on securing the connection between DNS clients and recursive resolvers. The DNSSD and TRANS groups will also be meeting and a new Birds-of-a-Feather (BOF) session on ARCING will also meet. The DANE Working Group will not be meeting in BA, but as mentioned above, there will be a good discussion related to DANE as part of the broader UTA discussions on Monday.
Beyond UTA, here are how some of the other groups are looking at IETF95…
DNS Operations (DNSOP)
The DNS Operations (DNSOP) Working Group meets twice: first for an hour on Wednesday (in the timeslot previously scheduled for DANE) and then again for two hours on Friday. Two pieces of DNSSEC work in the new business area of the DNSOP agenda: a draft from Warren Kumari about speeding up negative answers from NSEC records at the root of DNS; and then a draft from Paul Wouters and Ondrej Sury about requirements and usage guidance for DNSSEC cryptographic algorithms. This second draft is interesting because the intent is to phase out usage of older cryptographic algorithms. Beyond that, DNSOP typically winds up with discussions that affect the overall performance and operations of DNS that make for an interesting time.
DNS PRIVate Exchange (DPRIVE)
The DPRIVE Working Group will be meeting on Wednesday morning to continue the discussions about DNS over TLS and DNS over DTLS. All of this DPRIVE work is focused on securing the connection between DNS clients and the recursive resolvers that people use (such as those typically at an Internet Service Provider (ISP) or on the edge of a network) to add a layer of confidentiality. We see this as an important part of the overall encryption work being done by the IETF to protect against the pervasive monitoring that we’ve seen on the Internet. Mechanisms such as what DPRIVE is developing will raise the overall amount of trust in Internet-based communication.
CURves, Deprecating and a Little more Encryption (CURDLE)
The CURDLE Working Group potentially wins the award for biggest stretch of a name to fit an acronym… but on a serious level the group is focused on an extremely important area of work – increasing the cryptographic security of a number of common protocols, including DNSSEC. On the CURDLE agenda are two drafts from Ondrej Sury and Robert Edmonds that specify new algorithms for DNSSEC.
DNS Service Discovery (DNSSD)
We haven’t covered the DNS Service Discovery (DNSSD) Working Group too often in the past, but at IETF 95 the DNSSD agenda has two interesting drafts up for discussion: one is related to the overall threat model and the other about privacy extensions. This WG is looking at how you “discover” services on a network using DNS when that “network” is bigger than just your own local network. For instance, how do you discover a printer that might be at, say, your parents’ house? And of course, how do you do all that securely? DNSSEC is not directly part of these discussions, but they are part of the broader “DNS security” area of our interest.
Other Working Groups
The TRANS WG focused on “certificate transparency” (CT), a mechanism for tracking changes in TLS certificates, is meeting on Monday and has a draft out about the attack model and threats on CT. This isn’t exactly related to DNS, but we’ll pay attention because it is looking at the same “securing TLS for the Web” area that is applicable to DANE. We’ll also of course be monitoring the TLS WG (because of the connection to DANE), the Security Area open meeting and other similar sessions. There is also a BOF called “Alternative Resolution Contexts for Internet Naming (ARCING)” that doesn’t directly affect “DNS security”, per se, but is looking at the larger issue of “alternate” systems of name resolution on the Internet. For example, the naming resolution that happens within the Tor onion routing system. More info can be found on the BOF page and also in the ARCING mailing list archive.
It will be a busy week – but the outcomes of all these sessions should go far to make the DNS – and the overall Internet – more secure!
Please see the main Rough Guide to IETF 95 page to learn about more of what we are paying attention to in Buenos Aires.
P.S. For more information about DNSSEC and DANE and how you can get them deployed for your networks and domains, please see our Deploy360 site:
- http://www.internetsociety.org/deploy360/dnssec/
- http://www.internetsociety.org/deploy360/resources/dane/
Relevant Working Groups at IETF 95:
UTA (Using TLS in Applications) WG
Monday, 4 April 2016, 1400-1530 ART, Room Antlico C
Agenda: https://datatracker.ietf.org/meeting/95/agenda/uta/
Documents: https://datatracker.ietf.org/wg/uta/
Charter: http://tools.ietf.org/wg/uta/charters/
TRANS (Public Notary Transparency) WG
Monday, 4 April 2016, 1550-1720 ART, Room Quebracho A
Agenda: https://datatracker.ietf.org/meeting/95/agenda/trans/
Documents: https://datatracker.ietf.org/wg/trans/
Charter: http://tools.ietf.org/wg/trans/charters/
DNSSD (Extensions for Scalable Service Discovery) WG
Monday, 4 April 2016, 1550-1720 ART, Room Buen Ayre B
Agenda: https://datatracker.ietf.org/meeting/95/agenda/dnssd/
Documents: https://datatracker.ietf.org/wg/dnssd/
Charter: http://tools.ietf.org/wg/dnssd/charters/
CURDLE (CURves, Deprecating and a Little more Encryption) WG
Tuesday, 5 April 2016, 1620-1720 ART, Room Buen Ayre B
Agenda: https://datatracker.ietf.org/meeting/95/agenda/curdle/
Documents: https://datatracker.ietf.org/wg/curdle/
Charter: http://tools.ietf.org/wg/curdle/charters/
DPRIVE (DNS PRIVate Exchange) WG
Wednesday, 6 April 2016, 1000-1230 ART, Room Atlantico C
Agenda: https://datatracker.ietf.org/meeting/95/agenda/dprive/
Documents: https://datatracker.ietf.org/wg/dprive/
Charter: http://tools.ietf.org/wg/dprive/charters/
DNSOP (DNS Operations) WG
Wednesday, 6 April 2016, 1620-1720 ART, Room Atlantico B
Friday, 8 April 2016, 1000-1200 ART, Room Buen Ayre C
Agenda: https://datatracker.ietf.org/meeting/95/agenda/dnsop/
Documents: https://datatracker.ietf.org/wg/dnsop/
Charter: http://tools.ietf.org/wg/dnsop/charters/
Follow Us
There’s a lot going on in Buenos Aires, and whether you plan to be there or join remotely, there’s much to monitor. To follow along as we dole out this series of Rough Guide to IETF blog posts, follow us on the Internet Technology Matters blog, Twitter, Facebook, Google+, via RSS, or see https://www.internetsociety.org/tag/ietf95/.
The post Rough Guide to IETF 95: DNSSEC, DPRIVE, DANE and DNS Security appeared first on Internet Society.
Mar 24
Video: The Controversial Physics of Curling (Smarter Every Day 111)
Have you ever wondered why a curling stone curls? And what is it that brooms actually do, anyway? Destin, the host of the “Smarter Every Day” video series, explored this question back in 2014 with this intriguing video:
Want to learn more about curling and help bring it to the Monadnock region? Let us know you are interested!
Mar 24
Video: The Controversial Physics of Curling (Smarter Every Day 111)
Have you ever wondered why a curling stone curls? And what is it that brooms actually do, anyway? Destin, the host of the “Smarter Every Day” video series, explored this question back in 2014 with this intriguing video:
Want to learn more about curling and help bring it to the Monadnock region? Let us know you are interested!
Mar 24
Madagascar Signs .MG With DNSSEC As Part Of “Internet Day”
Last week the island country of Madagascar became the latest country-code top-level domain (ccTLD) to sign their .MG domain with DNSSEC. As we note in the steps for signing a domain, having a signed TLD is critical so that your domain can tie into the global “chain of trust” that provides the added security of DNSSEC.
Now that this step has been completed, the next steps will involve the registrars and DNS hosting providers for .MG domains making DNSSEC signing accessible to .MG domain registrants.
I’ll note that the DNSSEC signing of .MG was part of a broader set of activities that took place on March 17, 2016, as part of “Internet Day 2016” withing Madagascar. My colleague Michuki Mwangi was there and wrote about the activities that also included the launch of an Internet exchange point (IXP). Judging by his photos, it looks like an interesting event!
We congratulate the .MG team for the signing! It’s great to see the Africa part of our DNSSEC Deployment Maps get a bit more green – and we look forward to seeing even more ccTLDs sign their domains.
If you are interested in gaining the added level of trust in your domain that comes with DNSSEC, please visit our Start Here page to begin!
P.S. Madagascar will start appearing in our weekly DNSSEC deployment maps as green beginning next Monday, March 28, 2016.
Mar 23
Want To Learn To Curl? Try out curling on March 26 in Petersham, MA
Want to give curling a try? On this coming Saturday, March 26, 2016, the folks down at the Petersham Curling Club, about 45 minutes south of Keene, NH, in Petersham, MA, will be offering two 3-hour “Learn To Curl” clinics fro 10am – 1pm and from 2-5pm.
SPACE IS LIMITED!
From the post to the Petersham CC Facebook page:
They are happening March 26th and there are 2 slots — 10AM-1PM and 2PM-5PM. You get on-ice instruction from experienced curlers, use of curling equipment and a lot of fun (even get in a game!). Just remember to wear sneakers or shoes with a sturdy flat sole. The cost is just $40, and if you decide to join the club, this amount will be deducted from your membership dues. Respond to this post and I’ll put you on the list, as each slot is limited. Feel like an Olympian for a day — try out curling! See you on the ice!
For $40 you get 3 hours of instruction and the chance to try out the sport!
To sign up you can reply to the post on the Petersham Curling Club Facebook page or send an email to Ted Paul.
We hope some folks from the Monadnock region will try it out! And if you’re excited about curling, please let us know you are interested! We’ve got some ideas for the future…
Mar 23
Want To Learn To Curl? Try out curling on March 26 in Petersham, MA
Want to give curling a try? On this coming Saturday, March 26, 2016, the folks down at the Petersham Curling Club, about 45 minutes south of Keene, NH, in Petersham, MA, will be offering two 3-hour “Learn To Curl” clinics fro 10am – 1pm and from 2-5pm.
SPACE IS LIMITED!
From the post to the Petersham CC Facebook page:
They are happening March 26th and there are 2 slots — 10AM-1PM and 2PM-5PM. You get on-ice instruction from experienced curlers, use of curling equipment and a lot of fun (even get in a game!). Just remember to wear sneakers or shoes with a sturdy flat sole. The cost is just $40, and if you decide to join the club, this amount will be deducted from your membership dues. Respond to this post and I’ll put you on the list, as each slot is limited. Feel like an Olympian for a day — try out curling! See you on the ice!
For $40 you get 3 hours of instruction and the chance to try out the sport!
To sign up you can reply to the post on the Petersham Curling Club Facebook page or send an email to Ted Paul.
We hope some folks from the Monadnock region will try it out! And if you’re excited about curling, please let us know you are interested! We’ve got some ideas for the future…
Mar 18
“… that tiny pea, pretty and blue…”
It suddenly struck me that that tiny pea, pretty and blue, was the Earth. I put up my thumb and shut one eye, and my thumb blotted out the planet Earth. I didn’t feel like a giant. I felt very, very small.
– Neil Armstrong
Mar 16
US Congress Hearing on “Privatizing IANA” – Thursday, March 17 (Live Video Feed Available) (Featured Blog)
On Thursday, March 17, 2016, a U.S. Congressional committee will hold a hearing on the topic of "Privatizing the Internet Assigned Numbers Authority" (IANA) starting at 10:15am US EDT (UTC-4). You can learn about the hearing and view the written testimony at and watch live on the included pages. The hearing is before the Communications and Technology Subcommittee of the U.S. House of Representatives Energy and Commerce Committee. More...
