Speakers added to DNSSEC FOSE program

New speakers have been added to the Initiative’s daylong session What’s Next in DNSSEC at the FOSE conference and expo in March in Washington, DC.   New speakers include representatives from Afilias, BlueCat Networks, Data Mountain Solutions, F5 Networks, Nominum, Secure64 and Xelerance.

No Comments

Preview: DNSSEC workshop at ICANN Nairobi meeting

ICANN’s Security and Stability Advisory Committee will convene a DNSSEC workshop at the Nairobi meeting on Wednesday, March 10, from 9:00 am to 12 noon.  The program, intended for “anyone with an interest in the deployment of DNSSEC, especially registry and registrar representatives from technical, operational, and strategic planning roles,” is still in development.  Thus far, updates are expected on these topics:

  • Implementation of DNSSEC at the Root
  • Operational issues with DNSSEC, including technical presentations on transfers and key rollovers
  • Adoption Issues, including experience with hurdles and incentives
  • Activities from the region
  • Extending DNSSEC deployment

To register or learn more about the ICANN Nairobi meeting, go here.

No Comments

AFNIC urges readiness for a signed root

AFNIC, the registry of the database of .fr (France) and .re (Reunion Island) Internet domain names, has issued this announcement to network administrators, inviting them to prepare for the advent of DNSSEC deployment at the root and offering preparation steps, links to resources and more.

No Comments

Deployment watch: Nominet to sign .UK March 1

Nominet, the Internet registry for .UK domain names, has announced it will implement DNSSEC in zones it manages, beginning March 1, 2010 with the .UK top-level domain. The announcement notes:

With the signing of the root so close (scheduled for mid-2010), we have taken the decision not to include the keys in the major DNSSEC key stores…Instead, we will use the period as an extended operational test, waiting until the root goes live before publishing our trust anchor in the root zone.

The next phase will include signing .co.uk and other SLDs, Nominet said.

, , ,

No Comments

DNSSEC signed answers from L root server

The first root server (L) has started to serve up a signed version of the root zone. This is the first step in the live testing that will lead to a production signed root by the middle of the year.  For information on the status of the root signing process visit: http://www.root-dnssec.org/

The root is intentionally publishing bogus signing keys, so the answers are not verifiable. Once the testing completes the actual keys will be published.

Current DNSKEY set advertised:

. 86400 IN DNSKEY 256 3 8 AwEAAa1Lh++++++++++++++++THIS/IS/AN/INVALID/KEY/AND/SHOULD/NOT/BE/USED/CONTACT/ROOTSIGN/AT/ICANN/DOT/ORG/FOR/MORE/INFORMATION+++
+++++++++++++++++++++++++++++++++++++++++++++++8
. 86400 IN DNSKEY 257 3 8 AwEAAawBe++++++++++++++++THIS/IS/AN/INVALID/KEY/AND/SHOULD/NOT/BE/USED/CONTACT/ROOTSIGN/AT/ICANN/DOT/ORG/FOR/MORE/INFORMATION+++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++8=
. 86400 IN RRSIG DNSKEY 8 0 86400 20100204235959 20100121000000 19324 . NO9bHgWYB3wQlVZXQKwDGUjTgIyfz1i8aWH8nBlT5isnYbr6PTfR4fWlSx8+avFfR0fVekauaQelKOyiUav4H9Y1AZ2OBguu7RjozQu1qErKboWd1NglIIOGar0Ol4Ur9+
4bo2LSxjp/X4ESypW0lX04z5uB6DZZei1zafzRGUnLIMdV9xdKEOJrm9UCKvYK5g8bjRq8KA8vT+
pidexZMrBQ3ie8R9daf/s6VK7zUJK0jF1vqhPbZFSQmBpJUlxh4VnOv7nnhcq4Moj49wqmNxKRqfvSwHAJBG6dEgShnlu/rfVsdxfFUCjIGX8YnSC7lYqODwgUGh+i/arA AK+bzg==

,

No Comments

Deployment watch: 15,000 Czech domains signed “in one go”

The Czech registry CZ.NIC announced yesterday that nearly 15,000 Czech domains (14,236) were signed yesterday, all at once.  WEB4U, one of the largest Czech registrars with 21,000 registered .CZ domains, decided to implement DNSSEC in all its registered domains, automatically and free of charge. 

The CZ.NIC Association launched DNSSEC in October 2008 and says it registered 1414 DNSSEC-protected domains by the end of 2009.   CEO Ondrej Filip said:  

We greatly appreciate WEB4U’s decision because it will significantly contribute to the security of not only the Czech Internet. By doing so, we also point the way to other countries which are currently launching the technology. DNSSEC is important in particular for those who seek the highest possible security of their information on the Internet. Among these are banks or e-shops on whose websites the visitors often enter sensitive personal data such as user names and passwords, credit card numbers etc.

No Comments

DNSSEC session at FOSE adds speakers

Picture1We’re adding new speakers every day: Follow this link to see the updated program for the DNSSEC Deployment Coordination Initiative’s special session at the FOSE conference and exhibition. ” What’s Next in DNSSEC: Securing the Domain Name System,” will take place on Wednesday, March 24, 2010, from 10:30 a.m. to 4:30 p.m.  The conference attracts U.S. government information technology professionals in Washington, D.C.  In addition to the session, the FOSE Expo will include a special DNSSEC Pavilion with booths from the Initiative as well as other DNSSEC-related exhibitors. 

Registration for FOSE is free for U.S. government employees, government contractors and U.S. military, and registration for the Expo is $50.  Go here to register for FOSE.  To exhibit in the DNSSEC Pavilion at FOSE, contact Don Berey, Show Director at 703-876-5073 or email [email protected].

No Comments

U.S. federal DNSSEC deployment lags behind deadline

Based on monitoring data from Secure64, Network World reported today that only 20 percent of U.S. federal agencies have deployed DNSSEC in time to meet a mandate from the White House Office of Management and Budget.  From the article, Initiative partner Steve Crocker, CEO of Shinkuro, Inc., said:

Missing the mark by one year is pretty good news in this business…There is a gradual tightening of security going on up and down the Internet protocol stack. DNSSEC isn’t the be-all-and-end-all, but it’s an important piece. The technical community has been working on DNSSEC for 20 years. The top part of .gov is signed, and now we’re seeing the other pieces coming along.

U.S. federal deployment will be the topic of the DNSSEC Deployment Coordination Initiative’s special one-day program at FOSE 2010 on March 24. Go here to see an updated program and links to register or exhibit.

No Comments

Deployment watch: Malaysia targets 4th quarter

Malaysia’s .my registry is targeting the fourth quarter of 2010 for its deployment, following a testbed and a public trial. Norsuzana Harun, technology and innovation manager at .myDomainRegistry, writes this update in TechCentral:

In Malaysia, .myDomainRegistry is also preparing for DNSSEC deployment. Following the completion of a closed testbed, the organisation will be conducting the DNSSEC Public Trial, which aims to provide first-hand experience on the workings of DNSSEC, encourage adoption of the technology and improve current DNSSEC policies and end-user manuals.  .myDomainRegistry targets for DNSSEC deployment in Q4 this year. Key stakeholders play a very important part in creating a trusted network that will ensure the success of DNSSEC.

No Comments

Educause factsheet highlights DNSSEC

educauseEducause has just published a two-page factsheet on 7 things you should know about DNSSEC, aimed at college and university information technology officials. Noting that “DNSSEC can be an important part of a broad-based cybersecurity strategy,” the fact sheet explains that security has special implications for institutions of higher education:

Colleges and universities are expected to be “good Internet citizens” and to lead by example in efforts to improve the public good. Because users tend to trust certain domains, including the .edu domain, more than others, expectations for the reliability of college and university websites are high. To the extent that institutions of higher education depend on their reputations, DNSSEC is an avenue to avoid some of the kinds of incidents that can damage a university’s stature.

No Comments