Category: ICANN

Do you have an idea for a better way to work with DNSSEC?  Have you created a new tool or service for DNSSEC or DANE that you would like to present to the wider community?  Could you provide a “case study” of how you implemented DNSSEC within your organization?  Have you started using DANE to secure your email communication?

If you would be interested in speaking about any of those points – or any of the other topics we have listed below, WE WOULD LIKE TO HEAR FROM YOU!  We’re working on creating the program for the ICANN 51 DNSSEC Workshop that will be held in Los Angeles on October 15, 2014.  As you’ll note in the full call for participation included below, we are in particular seeking participants on three topics:

• DANE / DNSSEC as a way to secure email
• Potential impacts of Root Key Rollover
• Experiences from new gTLD registries and administrators

If you have any ideas, or would like to ask questions about what is involved with the workshop, please email us at dnssec-losangeles@isoc.org.  Initially, we don’t need a full abstract – just a couple of sentences about what you would like to speak about is perfectly fine.

Thanks,
Dan

Call for Participation — ICANN DNSSEC Workshop 15 October 2014

The DNSSEC Deployment Initiative and the Internet Society Deploy360 Programme, in cooperation with the ICANN Security and Stability Advisory Committee (SSAC), are planning a DNSSEC Workshop at the ICANN 51 meeting in Los Angeles, California, on 15 October 2014. The DNSSEC Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments.

For reference, the most recent session was held at the ICANN meeting in London on 25 June 2014. The presentations and transcripts are available at: http://london50.icann.org/en/schedule/wed-dnssec.

We are seeking presentations on the following topics;

1. DNSSEC activities in the North America region

For this panel we are seeking participation from those who have been involved in DNSSEC deployment in the North America region and also from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment. In particular, we will consider the following questions:

• What can DNSSEC do for you?
• What doesn’t it do?
• What are the internal tradeoffs to implementing DNSSEC?
• What did you learn in your deployment of DNSSEC?

We are interested in presentations from both people involved with the signing of domains and people involved with the deployment of DNSSEC-validating DNS resolvers.

2. DANE / DNSSEC as a way to secure email

The DNS-based Authentication of Named Entities (DANE) protocol is an exciting development where DNSSEC can be used to provide a strong additional trust layer for traditional SSL/TLS certificates. We are both pleased and intrigued by the growing usage of DANE and DNSSEC as a means of providing added security for email. Multiple email servers have added support for DANE records to secure TLS/SSL connections. Some email providers are marketing DNSSEC/DANE support. We would like to have a panel at ICANN 51 focusing on this particular usage of DANE. Are you a developer of an email server or client supporting DANE? Do you provide DANE / DNSSEC support in your email service? Can you provide a brief case study of what you have done to implement DANE / DNSSEC? Can you talk about any lessons you learned in the process?

3. Potential impacts of Root Key Rollover

Given many concerns about the need to do a Root Key Rollover, we would like to bring together a panel of people who can talk about what the potential impacts may be to ISPs, equipment providers and end users, and also what can be done to potentially mitigate those issues. In particular, we are seeking participation from vendors, ISPs, and the community that will be affected by distribution of new root keys. We would like to be able to offer suggestions out of this panel to the wider technical community. If you have a specific concern about the Root Key Rollover, or believe you have a method or solution to help address impacts, we would like to hear from you.

4. New gTLD registries and administrators implementing DNSSEC

With the launch of the new gTLDs, we are interested in hearing from registries and operators of new gTLDs about what systems and processes they have implemented to support DNSSEC. As more gTLDs are launched, is there DNSSEC-related information that can be shared to help those launches go easier?

5. The operational realities of running DNSSEC

Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC?

• What is the best practice around key rollovers?
• How often do you review your disaster recovery procedures?
• Is there operational familiarity within your customer support teams?
• What operational statistics have we gathered about DNSSEC?
• Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones?

6. DNSSEC automation

For DNSSEC to reach massive deployment levels it is clear that a higher level of automation is required than is currently available. Topics for which we would like to see presentations include:

• What tools, systems and services are available to help automate DNSSEC key management?
• Can you provide an analysis of current tools/services and identify gaps?
• Where are the best opportunities for automation within DNSSEC signing and validation processes?
• What are the costs and benefits of different approaches to automation?

7. When unexpected DNSSEC events occur

What have we learned from some of the operational outages that we have seen over the past 18 months? Are there lessons that we can pass on to those just about to implement DNSSEC? How do you manage dissemination of information about the outage? What have you learned about communications planning? Do you have a route to ISPs and registrars? How do you liaise with your CERT community?

8. DANE and DNSSEC applications

There is strong interest for DANE usage within web transactions as well as for securing email and Voice-over-IP (VoIP). We are seeking presentations on topics such as:

• What are some of the new and innovative uses of DANE and other DNSSEC applications in new areas or industries?
• What tools and services are now available that can support DANE usage?
• How soon could DANE and other DNSSEC applications become a deployable reality?
• How can the industry use DANE and other DNSSEC applications as a mechanism for creating a more secure Internet?

We would be particularly interested in any live demonstrations of DNSSEC / DANE applications and services. For example, a demonstration of the actual process of setting up a site with a certificate stored in a TLSA record that correctly validates would be welcome. Demonstrations of new tools that make the setup of DNSSEC or DANE more automated would also be welcome.

9. DNSSEC and DANE in the enterprise

Enterprises can play a critical role in both providing DNSSEC validation to their internal networks and also through signing of the domains owned by the enterprise. We are seeking presentations from enterprises that have implemented DNSSEC on validation and/or signing processes and can address questions such as:

• What are the benefits to enterprises of rolling out DNSSEC validation? And how do they do so?
• What are the challenges to deployment for these organizations and how could DANE and other DNSSEC applications address those challenges?
• How should an enterprise best prepare its IT staff and network to implement DNSSEC?
• What tools and systems are available to assist enterprises in the deployment of DNSSEC?
• How can the DANE protocol be used within an enterprise to bring a higher level of security to transactions using SSL/TLS certificates?

10. Guidance for Registrars in supporting DNSSEC

The 2013 Registrar Accreditation Agreement (RAA) for registrars and resellers requires them to support DNSSEC from January 1, 2014. We are seeking presentations discussing:

• What are the specific technical requirements of the RAA and how can registrars meet those requirements?
• What tools and systems are available for registrars that include DNSSEC support?
• What information do registrars need to provide to resellers and ultimately customers?

We are particularly interested in hearing from registrars who have signed the 2013 RAA and have either already implemented DNSSEC support or have a plan for doing so.

11. Implementing DNSSEC validation at Internet Service Providers (ISPs)

Internet Service Providers (ISPs) play a critical role by enabling DNSSEC validation for the caching DNS resolvers used by their customers. We have now seen massive rollouts of DNSSEC validation within large North American ISPs and at ISPs around the world. We are interested in presentations on topics such as:

• What does an ISP need to do to prepare its network for implementing DNSSEC validation?
• How does an ISP need to prepare its support staff and technical staff for the rollout of DNSSEC validation?
• What measurements are available about the degree of DNSSEC validation currently deployed?
• What tools are available to help an ISP deploy DNSSEC validation?
• What are the practical server-sizing impacts of enabling DNSSEC validation on ISP DNS Resolvers (ex. cost, memory, CPU, bandwidth, technical support, etc.)?

12. APIs between the Registrars and DNS hosting operators

One specific area that has been identified as needing focus is the communication between registrars and DNS hosting operators, specifically when these functions are provided by different entities. Currently, the communication, such as the transfer of a DS record, often occurs by way of the domain name holder copying and pasting information from one web interface to another. How can this be automated? We would welcome presentations by either registrars or DNS hosting operators who have implemented APIs for the communication of DNSSEC information, or from people with ideas around how such APIs could be constructed.

13. Hardware Security Modules (HSMs) use cases and innovation

We are interested in demonstrations of HSMs, presentations of HSM-related innovations and real world use cases of HSMs and key management.

In addition, we welcome suggestions for additional topics.

If you are interested in participating, please send a brief (1-2 sentence) description of your proposed presentation to dnssec-losangeles@isoc.org by Friday, 13 August 2014

We hope that you can join us.

Thank you,

Julie Hedlund

On behalf of the DNSSEC Workshop Program Committee:
Steve Crocker, Shinkuro
Mark Elkins, DNS/ZACR
Cath Goulding, Nominet UK
Jean Robert Hountomey, AfricaCERT
Jacques Latour, .CA
Xiaodong Lee, CNNIC
Luciano Minuchin, NIC.AR
Russ Mundy, Sparta/Parsons
Ondřej Surý, CZ.NIC
Yoshiro Yoneya, JPRS
Dan York, Internet Society

We had an outstanding DNSSEC Workshop last Wednesday, June 25 ,2014, at ICANN 50 in London.  This was the “big” session of the DNSSEC activities at ICANN 50 and had a big turnout!  I counted around 120 people in the room at one point, many of whom stayed for most of the day, and we seemed to have 20-25 remote participants in the Adobe Connect room for much of the day.  It was great to have so many people there and there was an excellent amount of interaction and engagement throughout the day – lots of questions and lots of discussions!

The schedule, slides and archived video and audio can be found at:

http://london50.icann.org/en/schedule/wed-dnssec

In the section below, I’ll walk through a bit of what happened during the day.  First, though, here is one photo of what the room looked like:

… and there were more people sitting behind where I took the photo and on the sides.  I have many more photos that at some point I’ll try to get into our Flickr account or somewhere.

Introduction and Challenges/Opportunities for DNSSEC

I (Dan York) began the session with the normal introduction session and review of the latest DNSSEC deployment statistics.  Much of this is drawn from the weekly DNSSEC deployment maps we now generate but we also had a good discussion about how we’d like to go to the next level and start generating more second-level statistics.

I followed that with a 2014 view into the Challenges and Opportunities in DNSSEC Deployment and Usage where I looked back on a presentation I gave in 2012 and assessed how far we’ve come in the time since then. I also covered newer issues that have emerged since that time.

DNSSEC Activities in the European Region

We then had the first panel of the day with Cath Goulding of NominetUK moderating a set of presentations from country-code top-level-domain (ccTLD) operators from across Europe:

• Anne-Marie Eklund-Löwinder, .SE – DNSSEC Deployment in Sweden: How Do We Do It?
• Ondrej Filip, CZNIC – DNSSEC .CZ
• Peter Janssen, EURid – DNSSEC @ .EU
• Vincent Levigneron, AFNIC – AFNIC: Promoting DNSSEC – 2013 Results, 2014 Action Plan
• Alexander Mayrhofer, NIC.AT – DNSSEC (Not Just) for .at
• Sara Monteiro, .PT: Facts and Figures

I think many of us were taking copious notes because these were really case studies of how different ccTLDs were deploying DNSSEC… what they’d done, what they hadn’t done… the success they’d had – or not.   Lots of great info ranging from .CZ’s YouTube videos to Afnic’s deployment guide to .AT’s “bump-in-the-wire” signing service and much, much more.  You can expect to see some of this info turn up in blog posts here on the Deploy360 site!  The discussion was great and the sharing among participants was quite good to see.

DNSSEC Key Rollovers and Transfers

Next up Jim Galvin of Afilias talked about the challenges that with ensuring that a DNSSEC-signed domain remains valid during the transition from one DNS hosting provider to another.  In particular he pointed out the challenge of the “5 day grace period” that comes into play with registrars.  This is a critical challenge  that we will continue to be discussing until we can collectively agree on a solution to make this work.

CloudFlare – DNSSEC and DNS Proxying

Following Jim was the presentation that many of us were very much looking forward to. John Graham-Cumming of CloudFlare spoke about the challenges of using DNSSEC in an environment such as a content-distribution network (CDN) where DNS proxying and redirection plays such a pivotal role. This is important as the lack of DNSSEC support in CDNs is one of the major blockages right now for many content providers to sign their websites with DNSSEC.  John provided some solid information about the challenges they’ve seen, the tools they’ve developed and their plans for the future.

He very clearly stated that CloudFlare will support DNSSEC by the end of 2014 and is aiming to make it as easy for their customers as they have made IPv6 (which initially was a toggle button and now is on by default).

We certainly hope they will follow through on this – and doing so will immediately help secure a great number of web sites… and bring pressure on other CDN providers to follow suit.

Hardware Security Modules (HSMs) Benefits and Challenges

Next up we dove a bit down into crypto geekery and explored different options for the HSMs that are used by some to generate keys for DNSSEC. Roy Arends of NominetUK moderated and the presenters included:

• Richard Lamb, ICANN – Hardware Security Modules (HSMs) Benefits and Challenges
• Mark Southam, Ultra Electronics AEP – Hardware Security Modules (HSMs) Benefits and Challenges
• Roland van Rijswijk-Deij, SURFnet – SoftHSM: A Brief Overview

Rick Lamb kicked off the panel with an overview of why you might want to consider HSMs and what risk they are protecting against.  Mark Southam followed with some info about his Keyper HSM product and then Roland van Rijswijk-Deij talked about the SoftHSM project aimed at letting you do all of this in software without requiring any specific hardware.

Operational Realities of Running DNSSEC

The final presentation before lunch was from Haya Schulman of the Technische Universität Darmstadt. She actually had two presentations although both were in a single slide deck.  Her first presentation focused on measurements of recursive authoritative name servers and the methods that she undertook in her research.  Given that a number of people in the audience were also involved with DNSSEC measurement her presentation generated some good discussion and questions.  Her second presentation was on “Cipher-Suite Negotiation for DNSSEC” and presented ideas around how DNSSEC clients could know a servers algorithms and priorities.  This again generated some good discussion.

Lunch Break

After Haya’s presentations we had lunch in the room, thanks to the generous sponsors of the event (THANK YOU!):

• Afilias
• CIRA
• Dyn
• Microsoft
• .SE
• SIDN

Having the food right there enabled many great conversations to continue – and allowed us to not have to find our way back to the room that was tucked in an odd part of the hotel.

DANE and DNSSEC Applications

After lunch we had our large panel session that involved multiple demos and running code!  I was the moderator and the panelists included:

• Guido Witmond – A Use Case for DNSSEC: Phishing Protection
• Willem Toorop (Presenter), NLNet Labs — getDNS API Implementation
• Willem Toorop, NLNet Labs – Measuring DNSSEC Validating Resolvers Using RIPE ATLAS
• Paul Hoffman – DNSharness for DNSSEC
• Iain Learmonth (Presenter), University of Aberdeen – Demo of DANE-Enhanced Version of Off-the-Record Private Messaging Tool
• Joost Van Dijk, Surfnet – DANE Pilot: Integrating Certificate and Domain Services

Guido Witmond started off providing an overview of the DANE protocol and how it could be used to add a layer of trust to TLS certificates. He then went into a specific use case where he sees DANE and DNSSEC helping prevent phishing.  Next Willem Toorop gave an overview of the getDNS API – this is really an important area and I would strongly encourage people to both view Willem’s slides and also view the getDNS API web site. I think this new API has some real promise to make it much easier for applications to interact with DNS and DNSSEC.

Willem continued with a second presentation around measuring DNSSEC validation using the RIPE Atlas probe network.  This is important as we continue to search for meaningful ways to measure ongoing DNSSEC deployment.  With Geoff Huston of APNIC Labs there in the room, who also does some DNSSEC measurements, there was some good discussion about how best to measure DNSSEC validation.

Paul Hoffman then took us back into application development with his presentation about DNSharness, a framework for testing name server implementations.  While most people in the room were not aware of this open source work funded by VeriSign Labs, a good number expressed their interest in using the test framework when they returned to their regular organizations.

We then entered into that ever-risky segment of live demos with Iain Learmonth going first with a demo of a “Off-the-Record” (OTR) private instant messaging app based on draft-wouters-dane-otrfp. Iain used the dnskeys library for python in a modified version of Gajim’s OTR plugin to have a secure encrypted chat session with Willem sitting right next to him.  It was very cool to see and while the demo was live Iain did provide some slides with screenshots so you can get a sense of what he was doing.

Joost van Dijk of SURFnet closed out the session with a live demo of how they integrated DANE into their service portal for their customers to automatically generate DANE’s TLSA record.  Again, the demo was live but Joost provided a few slides that talk about what they did and some of the challenges they found.

All in all it was a great afternoon session with lots of technical meat for developers!  Always great when you have running code inside of a workshop!

Wrapping Up

Finally, I ended the day thanking the participants and talking about how people in the session can help get DNSSEC deployed in different environments.

And then… after over 6.5 hours of intense focus on DNSSEC… we left the room to go back into all the other madness of a typical ICANN meeting!

On Toward ICANN 51 in Los Angeles on October 15…

With ICANN 51 behind us, the ICANN DNSSEC Workshop Program Committee is already looking forward to the next DNSSEC Workshop that will take place on Wednesday, October 15, 2014, at ICANN 51 in Los Angeles.  The call for participation will be out soon, but I can see that in particular we are going to be looking for people who want to present on:

• NewgTLDs and DNSSEC – case studies, implementation details and more
• Email/SMTP and DANE/DNSSEC – we are seeing a great amount of interest in DANE from email providers and want to bring together people operating email services using DANE and also those involved with developing email servers and applications
• Root Key Rollover Potential Impacts – many of us are very concerned about the need to have a Root Key Rollover happen and want to talk more about potential impacts and also mitigation strategies.

Plus we are always looking for great DNSSEC or DANE case studies, measurements, cool tools or demos and other similar topics.  Stay tuned for the announcement… but in the meantime start thinking about what YOU would like to present at ICANN 51 in LA!

P.S. If you haven’t yet started using DNSSEC, please check our “Start Here” page to find resources to help you out!

Next week (June 23-26, 2014), we’ll be at ICANN 50 in London for the usual excellent DNSSEC sessions, two of which will be streamed live for remote participants.

The three activities are…

DNSSEC For Everybody: A Beginner’s Guide

First up on Monday, June 23, 2014, in the late afternoon from 17:00 – 18:30 BST (London time) will be the DNSSEC For Everybody: A Beginner’s Guide session where we start at the very basic level of why should anyone care about DNSSEC and get into what kind of problem we are trying to solve.  This session includes a skit (seriously!) where we act out DNS and DNSSEC transactions and talk about blue smoke (seriously!).  It’s a good bit of fun and people tell us that it definitely helps them understand DNS and DNSSEC – or maybe they just like watching a bunch of DNS geeks act out in a skit.

You can listen remotely via an audio stream or listen and view the slides via a a virtual meeting room.  Details are on the program page.

DNSSEC Implementers Gathering

Next, on Monday evening from 19:30-21:30 (or later) some of us will join in an “informal gathering of DNSSEC implementers” at a nearby restaurant/bar. This is a time to share experiences, exchange information and just generally interact with other people involved with deploying DNSSEC.  As ICANN’s Julie Hedlund wrote in a note to various email lists:

DNSSEC Implementers are invited to attend an informal gathering to discuss and exchange information on their DNSSEC implementation experiences during the ICANN meeting in London, sponsored by Nominet UK. This is a unique opportunity to meet with and talk to key implementers, such as Nominet UK, CNNIC, JPRS, NZNIC, CIRA, CZNIC, SIDN, and others. We do ask that in order to participate you should come prepared to say a few words about your experiences. This is a peer-to-peer event for implementers.

It’s been a fun time at past events and generated both good conversations and connections for future work activities after the meetings are over.

It should perhaps be obvious but this event will NOT be available for remote participation.  If you will be in London, though, and are interested in interacting with others who are deploying DNSSEC, you are welcome to join us.  As Julie requests, RSVP by close of business on this Thursday, June 19, 2014.

DNSSEC Workshop

The BIG event of the week is the DNSSEC Workshop on Wednesday, June 25, where we meet from 8:30 – 14:45 London time for this detailed session diving into many different aspects of DNSSEC.  I’m on the Program Committee for the workshop and I can tell you that there will be some excellent presentations at this session.  The slides and full agenda will be available soon, but the major areas of discussion will include:

• Introduction and DNSSEC Deployment Around the World
• DNSSEC Activities in the European region
• The Operational Realities of Running DNSSEC
• DANE and DNSSEC Applications
• DNSSEC Automation
• Panel Discussion/Demonstrations on Hardware Security Modules (HSMs)

The workshop continues to attract some of the best technical people involved with DNSSEC and the conversations and discussions that happen there provide outstanding value to those interested in these topics.  If you’re interested in DNSSEC and how it can make the Internet more secure, I highly recommend you tuning in!

You can listen remotely via an audio stream or listen and view the slides via a a virtual meeting room.  Details are on the program page.

Rough Guide To ICANN 50

These DNSSEC events are just a part of all the many activities happening at ICANN 50 that we at the Internet Society are interested in.  To understand all of what is happening at ICANN 50 that lines up with our organization’s priorities, please see the Internet Society Rough Guide to ICANN 50.

Say Hello!

I (Dan York) will be there in London.  Please do say hello – you can find me at any of these events and also around other areas of ICANN. You can also email me at deploy360@isoc.org if you’d like to meet with me.  You can also contact us via Twitter, Facebook or Google+.

Are you planning to attend the ICANN 50 meeting in London in June?  If so, would you like to share your experience with deploying DNSSEC?  As noted below, we are seeking proposals for presentations to be given during the DNSSEC Workshop that will happen on Wednesday, June 25, 2014, during the ICANN week.

The full list of topic areas for which we are seeking proposals is included below. If you have an idea for a presentation, please send a brief (1-2 sentence) description of your proposed presentation to dnssec-london at shinkuro.com as soon as possible – but no later than by Friday, 09 May 2014.  You can send an idea now if you would like… even if you have an idea you are not sure about, you are welcome to send it in and ask if it is appropriate.  These are great sessions and the agenda tends to fill up pretty quickly, so if you want to be included  please do send in a proposal as soon as possible!

Thanks,
Dan

Call for Participation — ICANN DNSSEC Workshop 25 June 2014

The DNSSEC Deployment Initiative and the Internet Society Deploy360 Programme, in cooperation with the ICANN Security and Stability Advisory Committee (SSAC), are planning a DNSSEC Workshop at the ICANN meeting in London on 25 June 2014. The DNSSEC Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN meeting in Singapore on 26 March 2014. The presentations and transcripts are available at: http://singapore49.icann.org/en/schedule/wed-dnssec.

We are seeking presentations on the following topics:

1. DNSSEC Activities in the European region:

For this panel we are seeking participation from those who have been involved in DNSSEC deployment in the European region and also from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment. In particular, we will consider the following questions: What can DNSSEC do for you? What doesn’t it do? What are the internal tradeoffs to implementing DNSSEC?

2. The Operational Realities of Running DNSSEC:

Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? What is the best practice around key rollovers? How often do you review your disaster recovery procedures? Is there operational familiarity within your customer support teams? What operational statistics have we gathered about DNSSEC? Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones?

3. DNSSEC Automation:

For DNSSEC to reach massive deployment levels it is clear that a higher level of automation is required than is currently available. Topics for which we would like to see presentations include:

• What tools, systems and services are available to help automate DNSSEC key management?
• Can you provide an analysis of current tools/services and identify gaps?
• Where in the various pieces that make up DNSSEC signing and validation are the best opportunities for automation?
• What are the costs and benefits of different approaches to automation?

4. When Unexpected DNSSEC Events Occur:

What have we learned from some of the operational outages that we have seen over the past 18 months? Are there lessons that we can pass on to those just about to implement DNSSEC? How do you manage dissemination of information about the outage? What have you learned about communications planning? Do you have a route to ISPs and registrars? How do you liaise with your CERT community?

5. DANE and DNSSEC Applications:

The DNS-based Authentication of Named Entitites (DANE) protocol is an exciting development where DNSSEC can be used to provide a strong additional trust layer for traditional SSL/TLS certificates. There is strong interest for DANE usage within web transactions as well as for securing email and Voice-over-IP (VoIP). We are seeking presentations on topics such as:

• What are some of the new and innovative uses of DANE and other DNSSEC applications in new areas or industries?
• What tools and services are now available that can support DANE usage?
• How soon could DANE and other DNSSEC applications become a deployable reality?
• How can the industry used DANE and other DNSSEC applications as a mechanism for creating a more secure Internet?

We would be particularly interested in any live demonstrations of DNSSEC / DANE applications and services. For example, a demonstration of the actual process of setting up a site with a certificate stored in a TLSA record that correctly validates would be welcome. Demonstrations of new tools that make the setup of DNSSEC or DANE more automated would also be welcome.

6. DNSSEC and DANE In The Enterprise:

Similar to ISPs, enterprises can play a critical role in both providing DNSSEC validation to their internal networks and also through signing of the enterprises’s own domains. We are seeking presentations from enterprises who have implemented DNSSEC on either or both validation and signing and can address questions such as:

• What are the benefits to enterprises of rolling out DNSSEC validation? And how do they do so?
• What are the challenges to deployment for these organizations and how could DANE and other DNSSEC applications address those challenges?
• How should an enterprise best prepare its IT staff and network to implement DNSSEC?
• What tools and systems are available to assist enterprises in the deployment of DNSSEC?
• How can the DANE protocol be used within an enterprise to bring a higher level of security to transactions using SSL/TLS certificates?

7. Guidance for Registrars in Supporting DNSSEC:

The 2013 Registrar Accreditation Agreement (RAA) for Registrars and Resellers requires the support of DNSSEC beginning on January 1, 2014. We are seeking presentations discussing:

• What are the specific technical requirements of the RAA and how can registrars meet those requirements?
• What tools and systems are available for registrars that include DNSSEC support?
• What information do registrars need to provide to resellers and ultimately customers?

We are particularly interested in hearing from registrars who have signed the 2013 RAA and have either already implemented DNSSEC support or have a plan for doing so.

8. Implementing DNSSEC Validation At Internet Service Providers (ISPs):

Internet Service Providers (ISPs) play a critical role by enabling DNSSEC validation for the caching DNS resolvers used by their customers. We have now seen massive rollouts of DNSSEC validation within large North American ISPs and at ISPs around the world. We are interested in presentations on topics such as:

• What does an ISP need to do to prepare its network for implementing DNSSEC validation?
• How does an ISP need to prepare its support staff and technical staff for the rollout of DNSSEC validation?
• What measurements are available about the degree of DNSSEC validation currently deployed?
• What tools are available to help an ISP deploy DNSSEC validation?
• What are the practical server-sizing impacts of enabling DNSSEC validation on ISP DNS Resolvers (ex. cost, memory, cpu, bandwidth, technical support, etc.)?

9. APIs Between the Registrars and DNS Hosting Operators:

One specific area that has been identified as needing focus is the communication between registrars and DNS hosting operators, specifically when these functions are provided by different entities. Right now the communication, such as the transfer of a DS record, occurs primarily by way of the domain name holder copying and pasting information from one web interface to another. How can this be automated? We would welcome presentations by either registrars or DNS hosting operators who have implemented APIs for the communication of DNSSEC information – or from people with ideas around how such APIs could be constructed.

10. Panel Discussion/Demonstrations on Hardware Security Modules (HSMs):

HSMs are a key element in DNSSEC deployment, particularly in maintaining the security of the Zone Signing Key (ZSK). We are interested in demonstrations of HSMs as well as presentations on HSM challenges and benefits.

11. Preparing for Root Key Rollover

For this topic we are seeking input on issues relating to root key rollover. In particular, we are seeking comments from vendors, ISPs, and the community that will be affected by distribution of new root keys.

In addition, we welcome suggestions for additional topics.

If you are interested in participating, please send a brief (1-2 sentence) description of your proposed presentation to dnssec-london at shinkuro.com by Friday, 09 May 2014

We hope that you can join us.

Thank you,
Julie Hedlund

On behalf of the DNSSEC Workshop Program Committee:

• Steve Crocker, Shinkuro
• Mark Elkins, DNS/ZACR
• Cath Goulding, Nominet UK
• Jean Robert Hountomey, AfricaCERT
• Jacques Latour, .CA
• Xiaodong Lee, CNNIC
• Luciano Minuchin, NIC.AR
• Russ Mundy, Sparta/Parsons
• Ondřej Surý, CZ.NIC
• Yoshiro Yoneya, JPRS
• Dan York, Internet Society