- dns-wg - mailman.ripe.net

DNSSEC trust anchors for unsigned zones
by Alexander Gall 30 Jan '08

30 Jan '08

Hi The current set of trust anchors distributed by RIPE NCC (<https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys-new.txt>) includes the domains disi.nl example.net pwei.net None of these currently have any DNSSEC resource records (i.e. they are insecure), which effectively brakes those zones for everybody who uses that particular set of trust anchors. I guess this shows one of the operational problems with trust anchor management. These zones are not maintained by RIPE NCC itself and the administrators probably didn't bother to tell them that they've disabled DNSSEC (if they know or remember at all that their keys are distributed by a third party). I guess it would be more prudent for RIPE NCC to only distribute the keys for their own zones (those listed on <https://www.ripe.net/projects/disi//keys/>). -- Alex

5 7

AAAA records to be added for root servers
by Barbara Roseman 07 Jan '08

07 Jan '08

apologies for cross-posting... On 4 February 2008, IANA will add AAAA records for the IPv6 addresses of the four root servers whose operators have requested it. A technical analysis of inserting IPv6 records into the root has been done by a joint working group of ICANN's Root Server System Advisory Committee and Security and Stability Advisory Committee, a report of which can be found at http://www.icann.org/committees/security/ sac018.pdf. Network operators should take whatever steps they feel appropriate to prepare for the inclusion of AAAA records in response to root queries. More information will be posted to the IANA web site during January. Regards, Barbara Roseman IANA General OperationsManager ICANN

3 2

Re: [dnssec-deployment] [dns-wg] RE: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by Holger Zuleger 07 Jan '08

07 Jan '08

> As a developer I have a question about revoke bits. > > In a DNSKEY RRset that revokes A and also has keys B and C. Does A sign > (A+B+C) or does the signature from A only sign A? In theory, only the signing of A is required, but don't care about the additional signing of B+C. > Signing more than simply A is nonsense, since the key is revoked. > And aids storing a presigned-self-revocation for emergency use. > However, that is not standard for RRset signatures. > > Do signatures from B and C sign (A+B+C) or (B+C) ? They have to sign (A+B+C) BTW, be aware of key tag changing if you set the revoke bit. Holger

1 0

RE: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by richard.lamb 07 Jan '08

07 Jan '08

I agree it would be unrealistic to set it for a production zone like .se yet. However, I like the idea of "exercising" the REVOKE bit so that potential developers see it. Would it break anything in BIND resolvers to do so? If not, id like to set it every time I change KSKs in our demo. -----Original Message----- From: DNSSEC deployment [mailto:dnssec-deployment@shinkuro.com] On Behalf Of Holger Zuleger Sent: Friday, January 04, 2008 1:11 AM To: DNSSEC deployment Cc: Patrik Wallstrom; Anne-Marie.Eklund-Lowinder(a)iis.se; dns-wg(a)ripe.net Subject: Re: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE Patrik Wallstrom wrote: > On Thu, 03 Jan 2008, Holger Zuleger wrote: > >>> New key signing key (KSK) for .SE >>> As from today, 2008-01-03 .SE publish and take into use a new KSK for >>> signing the .SE zone file. The key published with start 2006 with key >>> id = 17686 is unvalid since 2008-01-01 and will be removed >>> 2008-02-01. You should have configured the key published with start >> Would it be possible to set the REVOKE Bit on that key, and announce it for >> another 30 days? > > There was no time to fix this for this rollover. Next time. Oh, sure, it's clear that no one want's to add a new functionality on a productive service without testing, even if it is just to set one bit. But I thought that it was a good time to bring rfc5011 in mind... >> Doing so enables a rfc5011 aware validator to discard the key automatically >> from the list of possible trust anchor. > > Which resolvers honors the revocation bit? To my knowledge, no swedish > resolver operators are using such software yet. I think you are right. I guess that actually no one use it. Small question to all the dnssec operators: Please raise your hand if I'm wrong. ;-) And to the bind guys: Honors bind, used as an dnssec validator, the revoke bit? Holger

2 1

Re: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by Patrik Wallstrom 04 Jan '08

04 Jan '08

On Thu, 03 Jan 2008, Holger Zuleger wrote: >> New key signing key (KSK) for .SE >> As from today, 2008-01-03 .SE publish and take into use a new KSK for >> signing the .SE zone file. The key published with start 2006 with key >> id = 17686 is unvalid since 2008-01-01 and will be removed >> 2008-02-01. You should have configured the key published with start > Would it be possible to set the REVOKE Bit on that key, and announce it for > another 30 days? There was no time to fix this for this rollover. Next time. > Doing so enables a rfc5011 aware validator to discard the key automatically > from the list of possible trust anchor. Which resolvers honors the revocation bit? To my knowledge, no swedish resolver operators are using such software yet. -- patrik_wallstrom->foodfight->pawal(a)blipp.com->+46-733173956

2 1

Re: [dnssec-deployment] Ny nyckelsigneringsnyckel (KSK) för .SE - New key signing key (KSK) for .SE
by Holger Zuleger 03 Jan '08

03 Jan '08

> New key signing key (KSK) for .SE > > As from today, 2008-01-03 .SE publish and take into use a new KSK for > signing the .SE zone file. The key published with start 2006 with key > id = 17686 is unvalid since 2008-01-01 and will be removed > 2008-02-01. You should have configured the key published with start Would it be possible to set the REVOKE Bit on that key, and announce it for another 30 days? Doing so enables a rfc5011 aware validator to discard the key automatically from the list of possible trust anchor. Without it, the key ends up in state missing on the validator side. <quote rfc5011> Missing This is an abnormal state. The key remains a valid trust- point key, but was not seen at the resolver in the last validated DNSKEY RRSet. This is an abnormal state because the zone operator should be using the REVOKE bit prior to removal. </quote> So setting the revoke bit, would be one step to make the zone more compatible to RFC5011 (Automated Updates of DNS Security Trust Anchors) which is a way forward in implementing and using DNSSEC even without a signed root (and in absence of an elsewere trustable TAR). BTW: The same is true for all other signed TLDs and the signed zones managed by RIPE as well. Greets Holger

1 0

Bad secure delegation of ris.ripe.net
by Alexander Gall 13 Dec '07

13 Dec '07

Hello DISI The zone ris.ripe.net is bogus. It appears that the DS RR doesn't match the KSK DNSKEY RR. ripe.net is fine (with the newest trust anchors). According to drill: : gall@hadron[gall]; cat /tmp/ripe.key ripe.net. IN DNSKEY 257 3 5 AwEAAZ+vLzvkn0wkjcSmpoZRIOU0Suaw1EegrH9T0vwGOG9EbdgBYs6p 1lyjy2aHfZ4EnhVVVsElpSMBFzKItwzJeR9jxZC23dHw57saKC6enu7K K0m3fUQagzHqcu5RKn/T+0w1Q51UTdsLiBfCpqzQ10+T1oRxCXYWOyIi jApUQCFvybf1U6S/7lOLagzzoSU6lzxcUivWxLEM0SbzYIoV1OWXIjnj X/7/ChvZPqr01iY9th4nXlK52Da0mPaPbunLF353s4LQ6CsmcFG3zCfg 6iYRugF/NE1uMbdpzsff7nV1/K4PdSJjLt/AKsofQbbca8zH6YEolTcA T8o18/H13jE= : gall@hadron[gall]; drill -S -k /tmp/ripe.key ripe.net. soa | tail -5 DNSSEC Trust tree: ripe.net. (SOA) |---ripe.net. (DNSKEY keytag: 62805) |---ripe.net. (DNSKEY keytag: 21238) ;; Chase successful : gall@hadron[gall]; drill -S -k /tmp/ripe.key ris.ripe.net. soa | tail -5 ris.ripe.net. (SOA) |---ris.ripe.net. (DNSKEY keytag: 51156) |---ris.ripe.net. (DNSKEY keytag: 21022) No trusted keys found in tree: first error was: No DNSSEC public key(s) ;; Chase failed. The keytag of the DS record is 56179 : gall@hadron[unbound]; dig ris.ripe.net. ds +short 56179 5 1 B8F1169306DA0679416580D5AC3F43572B3318B6 -- Alex

2 1

DNSSEC deployed in the e164.arpa (ENUM) zone
by Anand Buddhdev 26 Nov '07

26 Nov '07

Dear Colleagues, Earlier today, the RIPE NCC signed the e164.arpa (ENUM) zone. The Key-Signing Keys (KSKs) for all zones signed by the RIPE NCC, including the e164.arpa zone, are available at the following secure URL: https://www.ripe.net/projects/disi/keys/ripe-ncc-dnssec-keys-new.txt Details of the key maintenance procedure are available at: http://www.ripe.net/rs/enum/key-maint.html If you have any questions, please send an e-mail to <dns-help(a)ripe.net>. Regards, Anand Buddhev DNS Services Manager, RIPE NCC

1 0

Deployment of DNSSEC in the e164.arpa zone
by Anand Buddhdev 20 Nov '07

20 Nov '07

Dear Colleagues, As previously announced, the RIPE NCC will sign the e164.arpa (ENUM) zone on 26 November 2007. Details of the key maintenance procedure are available at: http://www.ripe.net/rs/enum/key-maint.html The Key Signing Key (KSK) will be published on 26 November 2007 at the following secure URL: https://www.ripe.net/projects/disi/keys/ If you have any questions, please send an e-mail to <dns-help(a)ripe.net>. -- Anand Buddhdev, DNS Services Manager, RIPE NCC

1 0

Re: [dns-wg] (off topic) DNS test protocol
by Austin Kinsella 14 Nov '07

14 Nov '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Both this message and the following one repeated the problem, but enabled me to identify it. It is related to the PGP signature, and seems to be occurring when Mail attempts an auto-verification. The hang does not occur if I open the message with no network connection. I will fire up ethereal and see if I can spot what is happening. Thanks for your help. AK At 12:04 on 13 Nov 2007 Patrik Wallstrom wrote: > I signed the message with PGP/MIME, I can send you a test message and > see if we could repeat the problem. > > -- > patrik_wallstrom->foodfight->pawal(a)blipp.com->+46-733173956 __ Austin Kinsella, Lecturer, Networks & Programming, Institute of Technology, Carlow, Ireland. +353 59 9170417 pgp public key is at http://w3.itcarlow.ie/pgpkey.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (Darwin) iD8DBQFHObdyYoy2ek64z4cRAvolAKCq8iorc6bY/dnMdgvbQ5eI5eLw0gCgoSYN RS3h3hGYAKqZssDbmvpegQM= =8kqR -----END PGP SIGNATURE-----

3 3