September 2001 - techsec-wg - mailman.ripe.net

Re: Agenda for the Techsec WG
by Yuri Demchenko 01 Oct '01

01 Oct '01

Hi, Henk I would like to give update on TF-CSIRT activity and development. Last TF-CSIRT was in Manchester on Sept. 27-28, 2001 It will take aprox. 15 min. Yuri P.S. For more information about TF-CSIRT http://www.terena.nl/task-forces/tf-csirt/ http://www.terena.nl/task-forces/tf-csirt/tf-csirt010928agenda-draft.txt > * Subject: Agenda for the Techsec WG > * From: "Henk Uijterwaal $RIPE-NCC$" <henk(a)ripe.net> > * Date: Wed, 26 Sep 2001 11:19:59 +0200 (CEST) > ------------------------------------------------------------------------ > > Dear Colleagues, > > The Techsec WG will meet next week in Prague on > > TUESDAY, October 2, 14:45 > > Meeting hall IV > > NOTE that this is DIFFERENT from the schedule that is currently on the > meeting website. The agenda hasn't changed: > > 1. Administrativia > 2. Discussion of charter > 3. Discussion of workplan for the group > 4. DISI project, status and plans > 5. AOB > > and there is still room for other presentations. > > Hope to see you all next week, > > Henk > > -- ----------------------------------------------------------------------- Yuri Demchenko, TERENA, Singel 468D, 1017 AW Amsterdam, The Netherlands Tel: +31 20 530 4488 Fax: +31 20 530 4499 E-mail: demchenko(a)terena.nl -----------------------------------------------------------------------

2 1

Agenda for the Techsec WG
by Henk Uijterwaal (RIPE-NCC) 26 Sep '01

26 Sep '01

Dear Colleagues, The Techsec WG will meet next week in Prague on TUESDAY, October 2, 14:45 Meeting hall IV NOTE that this is DIFFERENT from the schedule that is currently on the meeting website. The agenda hasn't changed: 1. Administrativia 2. Discussion of charter 3. Discussion of workplan for the group 4. DISI project, status and plans 5. AOB and there is still room for other presentations. Hope to see you all next week, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 0

New version of Net::DNS
by Olaf Kolkman 18 Sep '01

18 Sep '01

L.S. A new version DNSSEC extensions to the Perl Net::DNS is available from the DISI web pages at http://www.ripe.net/disi . The additional features w.r.t. Net::DNS are listed in the README.DNSSEC file which I've appended below. The DNSSEC extensions are available as a patch against the development version of Net::DNS: http://www.ripe.net/disi/SRC/patch-0.19-DNSSEC-0.4. A full tar ball of Net::DNS including DNSSEC is also available from the website at: http://www.ripe.net/disi/SRC/Net-DNS-0.19-DNSSEC-0.4.tar.gz Related is a presentation I gave on the subject on Yet Another Perl Conference (YAPC), slides are available at: http://www.ripe.net/disi/Talks/YAPC2001/index.htm. These slides might be a good start if you want to start using the package. Please let me know if you use the package, if you found any bugs or have feature requests. --Olaf ----------------------------------------------------- Olaf M. Kolkman | RIPE NCC DISI Project ----------- | --------------- RIPE NCC | Phone: +31 20 535 4444 Singel 258 | Fax: +31 20 535 4445 1016 AB Amsterdam | http://www.ripe.net/disi The Netherlands | OKolkman(a)ripe.net README.DNSSEC _________________________________________________________________________ + General info. + Since this file is available in your distribution You have extended the Net::DNS package with DNSSEC functionality. DNSSEC is defined in RFC 2535 and related packages. The extensions provide the following additional features on top of the original Net::DNS package (version 0.19). - SIG, KEY and NXT records. These are all implemented as RR objects. The cryptography has been implemented using Crypt::DSA, Crypt::RSA and related modules. - EDNS0 support: Implemented using the OPT pseudo RR object. - DS support: Experimental implementation of DS record. To play with the DS record on the Network you have to assign a QTYPE. You can do this by uncommenting line 77 in Net/DNS.pm This will assign QTYPE 93 to the DS RR. - CERT support: Courtesy of Mike Schiraldi <raldi(a)research.netsol.com> for VeriSign _________________________________________________________________________ + Bug reports and feature requests. + We do not maintain the Net::DNS package. Only the DNSSEC extensions described above. If you find bugs in the extensions or have DNSSEC feature request please mail to okolkman(a)ripe.net. _________________________________________________________________________ + Update + Please see www.ripe.net/disi for the latest versions. _________________________________________________________________________ + Dependencies. + The patches are dependent on the following CPAN modules. FileHandle => 2.00, IO::Socket => 1.26, IO::Select => 1.14, Socket => 1.72, MIME::Base64 => 2.11, Digest::MD5 => 2.12, Digest::HMAC_MD5 => 1.00, Crypt::RSA => 1.37, Crypt::DSA => 0.12, _________________________________________________________________________ + Version history. + 0.19-DNSSEC-0.4: Added CERT support: Courtesy of Mike Schiraldi <raldi(a)research.netsol.com> for VeriSign BUG Fixed MANIFEST file. make dist will result in proper module tar ball 0.19-DNSSEC-0.3: Solved patch problems that where due to the $Id: README.DNSSEC,v 1.2 2001/09/17 19:31:02 olaf Exp $ in headers not being from the original distribution. Added DSA signature creation Added DS support You have to uncomment line 77 in Net/DNS.pm to fully enable DS This will assign QTYPE 93 to the DS RR. That value is not assigned by IANA. Added this README.DNSSEC file Added t/09-dnssec.t to the test script with a number of consistency checks. after patching the original distribution direction perl Makefile.PL make test will call this function among other things. BUG KeyID set to 0 for null keys. BUG Sorting of canonical RDATA; Data over which SIG was created was not sorted properly (RFC2535 sect 8.3) causing signature verification errors for RDATA within a RRset having different length (e.g. some NS RRsets would not verify.) 0.19-DNSSEC-0.2: First somewhat public release.

1 0

fwd: RIPE 40 TechSec-WG Agenda / DISI Progress Report
by Henk Uijterwaal (RIPE-NCC) 17 Sep '01

17 Sep '01

---------- Forwarded message ---------- Date: Mon, 17 Sep 2001 15:43:01 +0200 To: Technical Security Deployment WG <techsec-wg(a)ripe.net> From: Daniel Karrenberg <Daniel.Karrenberg(a)ripe.net> Subject: RIPE 40 TechSec-WG Agenda / DISI Progress Report Dear Colleagues, below you can find an informal progress report form the DISI project in preparation for the meeting in Praha. I am not sure whether this and the charter warrants a full meeting slot or whether we need a meeting at all. This is for the chair to decide. Certainly a full slot looks like way too much time at present. Please propose any additional agenda points quickly in case we are asked to give up meeting time for other WGs. Daniel ------------------------------ RIPE NCC DISI Progress Report - DNSSEC developments The biggest hurdle in DNSSEC deployment is the delegation of signing authority over zone boundaries. Currently things work technically. However the interactions between zone administrators at delegation points are too numerous and complex to be deployable by the RIPE community, or anyone for that matter, in a large scale. We are actively contributing to work in this area. We are confident that the proposed delegation signer (DS) resource record [1] will solve these deployability concerns. Deployment of DNSSEC at the RIPE NCC has been stalled until this problem is shown to be solved. - Tools To enable development of tools to maintain DNSSEC we have extended the Perl Net::DNS library with DNSSEC functionality. - Workshops and tutorials We have been raising awareness about DNSSEC by giving tutorials. Course material is being developed and made available through the DISI web pages. The tutorials help us to understand where the operational difficulties lie and which tools are needed for operational deployment. One such operational problem and a possible solution are presented in the IETF dnsop workingroup [2]. The next tutorial will be October 8 in Prague. - Plans We will continue to actively contribute to the IETF activities around operations of DNSSEC by participate in early adoption and early implementation. We will continue to organize workshops and develop tools which will be needed for operational implementation. On the longer term we plan operational deployment of DNSSEC on the reverse tree as soon as a solution to the delegation of signing authority over zone boundaries has made his way into the standards track. - References [1] ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsext-delegation-signer-0.2.… [2] ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsop-resolver-rollover-00.txt

1 1