DNSSEC for the Domain
description
Transcript of DNSSEC for the Domain
1
DNSSEC for the .edu Domain
Becky GrangerDirector, Information Technology
and Member ServicesEDUCAUSE
April 29, 2010
2
Agenda
Review DNS How DNSSEC augments DNS What DNSSEC doesn’t do Why DNSSEC matters to you DNSSEC Adoption Getting started: Between now and July 2010 Going live: Anticipated in July 2010
3
DNS: A Review
Illustration courtesy of Niranjan Kunwar / Nirlog.com
4
DNS Caching
DNS Servers cache data to improve performance
But…what happens if the cached data is wrong?
5
DNS is Fundamentally Flawed
More detailed explanation: http://www.iana.org/about/presentations/davies-cairo-vulnerability-081103.pdf
6
DNS Cache Poisoning Gets Easier
Article explaining vulnerability: http://www.wired.com/techbiz/people/magazine/16-12/ff_kaminsky Photo by Dave Bullock / eecue
7
DNSSEC: DNS Security Extensions
Validate the origin of a DNS response Trust that the data came from the expected source
Validate the integrity of a DNS response Trust that the data itself is correct
Validate denial of existence Trust a “no records to return” response
8
DNS with DNSSEC implemented
Illustration courtesy of Niranjan Kunwar / Nirlog.com
9
DNSSEC Augments DNS
Use public key cryptography to “sign” DNS data
New DNS resource records carry signatures DNSKEY, RRSIG, NSEC, DS
Publish signatures to parent zone Domain to namespace, namespace to root
DNS resolvers validate signature matches
Good explanation: http://ispcolumn.isoc.org/2006-08/dnssec.html
10
What DNSSEC Doesn’t Do
Encrypt data – that’s SSL Protect your servers from denial of service attacks Keep you from visiting phishing sites
DNSSEC protects you from forged DNS data
11
Why You Care: Hypothetical Case Study
Photo by Bart Everson
12
DNSSEC Adoption
13
Adoption is Critical
Can’t require validation yet – would reject most internet traffic
In the interim, will need a browser warning for non-validated lookups (like SSL “lock” today)
Validation will likely be required at some point
14
Adoption is Increasing Quickly
Data from SecSpider: http://secspider.cs.ucla.edu Graph courtesy of Eric Osterweil
15
Many Top Level Domains are Signing
Signed TLDs bg, br, ch, cz, li, lk, na, nu, pm, pr, pt, se, th, tm, uk, us arpa, gov, museum, org
Coming soon edu anticipated in July 2010 net anticipated in late 2010 com anticipated in early 2011
TLD data courtesy of Shinkuro, Inc.
16
Current DNSSEC Adoption in .edu
7 signed .edu domains berkeley.edu, merit.edu, penn.edu, psc.edu, upenn.edu,
internet2.edu, ucaid.edu
64 signed .edu sub-domains Many are computer science departments or DNS
research projects
Data from SecSpider: http://secspider.cs.ucla.edu Slide courtesy of Shumon Huque, University of Pennsylvania
17
Getting Started: Between now and July 1, 2010
18
If you are…
CIO or IT leader Get DNSSEC on your staff’s radar now Add DNSSEC to your summer maintenance schedule
Technical staff If an ISP hosts your DNS
Ask the ISP when they will support DNSSEC
If you host your DNS Learn about signing Get DNSSEC-aware DNS software Sign your zone
19
Learn About Signing
Study the RFCs RFC 4033 – DNSSEC introduction and requirements RFC 4034 – Resource records for DNSSEC RFC 4641 – DNSSEC operational practices
NIST Secure DNS Deployment Guide
20
Get DNSSEC-aware DNS Software
Need DNSSEC-aware software on published DNS servers and all intermediate resolvers BIND 9.6 or greater ZKT OpenDNSSEC Windows 2008 Server R2 Signing appliances Many more…
Find these packages and more at http://www.dnssec.net/software
21
Sign Your Zone
Generate a KSK and one or more ZSKs http://tools.ietf.org/html/rfc4641#section-3.1
Practice key rollovers & establish processes for managing keys http://tools.ietf.org/html/rfc4641#section-4.2
22
Going Live: July 2010 (anticipated)
23
Chain of Trust Can Be Established
Original illustration courtesy of Niranjan Kunwar / Nirlog.com
24
Publish Your Signatures to .edu Zone
Enter DS record data into the .edu Domain Administration website
.edu Domain Administration website: http://www.educause.edu/edudomain
25
Many Resources Available to Help You
RFCs http://tools.ietf.org/rfc/index
DNSSEC.NET website http://www.dnssec.net/
Your .edu colleagues – subscribe to EDUCAUSE DNSSEC deployment listserv http://listserv.educause.edu/archives/dnssec.html
26
Questions?