- techsec-wg - mailman.ripe.net

Draft minutes RIPE43
by ted＠tednet.nl 29 Jan '03

29 Jan '03

Hi, I was not in Rhodos at RIPE43, but there was a techsec-wg meeting. No official/approved minutes of that meeting were posted. however, there was a draft going around. In absence of the official/approved minutes, the best we can do is look at the draft, IMHO. -- Ted. -----Original Message----- From: webmaster(a)ripe.net [mailto:webmaster@ripe.net] Sent: 24 September 2002 11:35 To: matthew(a)ripe.net Subject: Re: RIPE 43 TechSec-WG Minutes - 1st draft HI, Are these minutes approved already? -J "Matthew Williams" <matthew(a)ripe.net> writes: * R I P E 4 3 R H O D E S * * Technical-Security Working Group Session * 12-September-2002 Minutes * * * Chair: Daniel Karrenberg * Scribe: Henk Uijterwaal (Matthew Williams) * Participants: ?? * * * 1. Administrativa * * Daniel welcomed us all to the meeting and then handed out the * participants' list. Henk Uijterwaal from the RIPE-NCC volunteered * to take the minutes. * * The agenda for this session and minutes from the previous meeting * at RIPE42 were approved without further ado. * * * 2. Olaf M. Kolkman: DISI Update * * Presentation available at URL: * * http://www.ripe.net/ripe/meetings/archive/ripe-43/presentations/ripe43-t * echsec-disi * * Comments on slide #4: * Bind 9.3s20020722 should not be used in production due to the * protocol bug that Olaf mentioned. In fact, Bind snapshots should * only be used for tests. (Ed Lewis) * * Be careful using tools that ship with earlier versions of Bind. They * may seem to work, but are incompatible with new developments, * i.e. tools from earlier Bind versions do not tell you that they are * incompatible with 2535. (Bill Manning) * * Question regarding slide #12: * Q: Can Bind run as secondary name server to NSD? (Ed Lewis) * * A: Yes. (Daniel Karrenberg) * * After the presentation, Bill Manning noted that when using * key-manipulating * tools one should pay special attention to internal procedures. * * Q: Once keys have been received and stored locally, how does one * guarantee * integrity and authenticity? (Bill Manning) * * A: No handles in the database yet. We are assuming that one can trust * * one's own machines and staff. It is important to simplify the * deployment of DNSSEC by not setting the barriers too high. The * system * should be easy to operate and not require special on-site security * * staff. More features can be added later. Tools alone do not solve * these problems. In the courses we want to make people aware * of security policies and procedures that need to be addressed * while * deploying DNSSEC. (Olaf M. Kolkman) * * Q: Ripe has a high profile here and should incorporate stronger * security * into the system. (Bill Manning) * * A: We are trying do that. There are additional tools, e.g. the * signing appliance, * that can be downloaded by sites that need them. (Olaf M. Kolkman) * * There were no further comments. * * Olaf mentioned that the slides would be available on the meeting * site. * * * 3. AOB * * Q: Is this WG the place where other groups should report on their * efforts in * this area? (Francis Dupont) * * A: Sharing experience and ideas will lead to better operational * procedures * and better understanding. Results may become best current * practices. * (Olaf M. Kolkman) * * Bill Manning has written a document on key management for the root * name * servers. His draft will be distributed on the DNSSEC mailing list * (dnssec(a)cafax.se) He also mentioned that there will be a workshop * prior to the ATLANTA IETF meeting. The details will be posted on * dnssec(a)cafax.se. * * Olaf clarified to the audience that all important info/links * regarding * this topic, including the mailing list above, are mentioned in the * DNSSEC * how-to. * * Finally, the chair closed the meeting at 12:30 pm. * * * Daniel Karrenberg, Henk Uijterwaal, Matthew Williams, September 2002 * * --- * > Matthew Williams-Bywater (MW243-RIPE) * > Customer Liaison Engineer * > RIPE NCC (www.ripe.net) *

1 0

Proposed Agenda for TechSec at RIPE44
by ted＠tednet.nl 17 Jan '03

17 Jan '03

0. Administrativia 1. Minutes of previous meeting 2. DISI status update (Olaf Kolkman) 3. Status DNSSEC at .nl registry (Miek Gieben) 4. DonKey project (Erik Rozendaal) 5. A.O.B. --

1 0

Proposed Agenda for TechSec at RIPE44
by ted＠tednet.nl 13 Jan '03

13 Jan '03

Proposed agenda for RIPE 44: 0. Administrativia 1. Minutes of previous meeting 2. DISI status update (Olaf Kolkman) 3. Status DNSSEC at .nl registry (Miek Gieben) 4. DonKey project (Erik Rozendaal) 5. A.O.B. Any other items, presentations of other wishes? Please reply quickly, as the agenda's need to be printed soon. -- ted

1 0

Agenda points
by ted＠tednet.nl 09 Jan '03

09 Jan '03

Hi, Please send in your agenda points for the upcoming TechSec WG-meeting at RIPE 44. Thanks, -- ted

1 0

ANNOUNCEMENT: DNSSEC TRAINING COURSES
by RIPE NCC Training 20 Dec '02

20 Dec '02

Dear colleagues, [apologies for duplicate postings] As a new service to its members the RIPE NCC offers the DNSSEC training courses. The main objective of the DNSSEC training course is to provide LIRs with sufficient background to be able to deploy DNSSEC in their own organisation as soon as the protocol is standardised. This course also explains the specific procedures set up by the RIPE NCC to to secure the in-addr.arpa zone. The Domain Name System (DNS) is one of the main parts of the Internet infrastructure. At the moment DNS lacks a mechanism to establish the authenticity and integrity of the data it provides. DNSSEC is a set of extensions to provide this end-to-end authenticity and integrity. It is currently being developed within the IETF dnsnext working group. The protocol is about to be finalised and the code implementing the protocol is available in alpha releases. The DNSSEC course consists of two parts: an "Introduction to DNSSEC" and a "real life demonstration" . The "Introduction to DNSSEC" will cover: - DNS security threats - DNSSEC security mechanisms - DNSSEC server protection - DNSSEC data protection - Delegation issues - Key management issues - Current developments Examples are based on the BIND name server. Please note that the DNSSEC is an advanced course, it will: - NOT teach the basics of DNS. - NOT describe how to receive Internet resources from the RIPE NCC nor how to operate a Local Internet Registry (LIR) The target audience of the course are technical staff of LIRs: e.g. network & system operators, engineers, etc. This course is not intended for administrative or management staff (e.g. hostmasters). It is assumed that all attendees are familiar with common DNS terminology, have a practical knowledge in operating DNS servers and are interested in learning the concepts and mechanisms that DNSSEC offers. The DNSSEC course is conducted in the English language and is free of charge, since it is covered by the membership contribution. More information about the DNSSEC training course can be found at: http://www.ripe.net/training/dnssec/ REGISTRATION: You can register for a course at the following URL: http://www.ripe.net/cgi-bin/trainingform.pl.cgi Or by completing the registration form at the end of this email and replying to <training(a)ripe.net> In order to register for a DNSSEC course you must be an employee of an LIR and either : - be an LIR contact - be confirmed by an LIR contact. LIR contacts are those employees of an LIR who are registered with RIPE NCC as authoritative contact persons. It is expected that most of those interested in the "DNSSEC Training Course" will not be an authorative contact persons for their LIR, therefore will be refused by the course registration "robot". In order to be admited to the course, confirmation email need to be send to <training(a)ripe.net>. Please approach the LIR contacts from your organisation personally, since the identity of LIR contacts is confidential, and the RIPE NCC is unable to divulge contact persons for any given LIR. Kind Regards, The RIPE NCC Training Team COURSE DATES AND VENUES ======================== Date: Saturday 1st February 2003 Time: 0900 - 1700 Location: Amsterdam, Netherlands AND: Date: Monday 24th February 2003 Time: 0900 - 1700 Location: Frankfurt, Germany AND: Date: Thursday 27th March 2003 Time: 0900 - 1700 Location: Amsterdam, Netherlands REGISTRATION FORM ================= %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The Course you plan to attend (date and location) # COURSE [ ] %END

2 1

FYI: ISP BGPDNS WG report
by Olaf Kolkman 25 Oct '02

25 Oct '02

FYI The following message posted to the IETF RPSEC WG mailinglist may also be of interest to this groups. http://www1.ietf.org/mail-archive/working-groups/rpsec/current/msg00220.html It contains <quote original posting> a copy of the report from one of the sub-groups spawned by the US Government's initiative to examine security of the Internet among other information infrastructures. This sub-group worked on ISP BGP and DNS Security and the report is a decent articulation of the of the issues. I can't take either credit or blame for this document. Nothing new or earth-shattering, I think, but of interest.' </qoute> --Olaf

1 0

Call for agenda items for RIPE 43
by Henk Uijterwaal (RIPE-NCC) 21 Aug '02

21 Aug '02

---------- Forwarded message ---------- Date: 20 Aug 2002 14:26:37 -0000 From: owner-techsec-wg(a)ripe.net To: techsec-wg-approval(a)ripe.net Subject: BOUNCE techsec-wg(a)ripe.net: Non-member submission from [ted(a)tednet.nl (Ted Lindgreen)] Admin request of type /\bcancel\b/i at line 6 Received: (qmail 14163 invoked by uid 0); 20 Aug 2002 14:26:36 -0000 Received: from birch.ripe.net (193.0.1.96) by postman.ripe.net with SMTP; 20 Aug 2002 14:26:36 -0000 Received: from postman.ripe.net (postman.ripe.net [193.0.0.199]) by birch.ripe.net (8.12.5/8.11.6) with SMTP id g7KEQaF4019711 for <techsec-wg(a)ripe.net>; Tue, 20 Aug 2002 16:26:36 +0200 Received: (qmail 14160 invoked by uid 0); 20 Aug 2002 14:26:36 -0000 Received: from omval.tednet.nl (213.53.69.17) by postman.ripe.net with SMTP; 20 Aug 2002 14:26:36 -0000 Received: by omval.tednet.nl (8.9.1a/8.9.1) id QAA22922 for techsec-wg(a)ripe.net; Tue, 20 Aug 2002 16:26:36 +0200 (MET DST) Message-Id: <200208201426.QAA22922(a)omval.tednet.nl> From: ted(a)tednet.nl (Ted Lindgreen) Date: Tue, 20 Aug 2002 16:26:36 +0200 In-Reply-To: "Ted Lindgreen's message as of Apr 16, 16:33" Reply-To: Ted.Lindgreen(a)tednet.nl X-Organization: TedNet BV X-Address: Omval 56, 1096HV Amsterdam, The Netherlands X-Phone: +31 20 6631060 Fax: +31 20 4684462 X-Mailer: Mail User's Shell (7.2.4 2/2/92) To: techsec-wg(a)ripe.net Subject: Second and last call for agenda items X-RIPE-Spam-Status: NONE ; -34 X-RIPE-Spam-Level: This is the second and last call for agenda items for the TechSec WG at RIPE 43. Until now there are no proposed agenda items. I will not be on Rhodos myself, Henk Uijterwaal will chair the session. But if there are no items, we could also cancel the session? So, if there are agenda points that must be dealt with and/or any reports or presentations, please respond today or tomorrow, otherwise I'll advice Henk to cancel the session. Regards, -- ted

1 0

Minutes from RIPE43
by Henk Uijterwaal (RIPE-NCC) 21 Aug '02

21 Aug '02

---------- Forwarded message ---------- Date: 21 Aug 2002 13:53:25 -0000 From: owner-techsec-wg(a)ripe.net To: techsec-wg-approval(a)ripe.net Subject: BOUNCE techsec-wg(a)ripe.net: Non-member submission from [RIPE NCC WebMaster <webmaster(a)ripe.net>] Received: (qmail 32077 invoked by uid 0); 21 Aug 2002 13:53:24 -0000 Received: from birch.ripe.net (193.0.1.96) by postman.ripe.net with SMTP; 21 Aug 2002 13:53:24 -0000 Received: from ripe.net (penguin.ripe.net [193.0.1.232]) by birch.ripe.net (8.12.5/8.11.6) with ESMTP id g7LDrOBG002147 for <techsec-wg>; Wed, 21 Aug 2002 15:53:24 +0200 Message-Id: <200208211353.g7LDrOBG002147(a)birch.ripe.net> To: techsec-wg(a)ripe.net Subject: Draft Minutes RIPE 42 From: RIPE NCC WebMaster <webmaster(a)ripe.net> X-Organization: RIPE Network Coordination Centre X-Phone: +31 20 535 4444 X-Fax: +31 20 535 4445 Date: Wed, 21 Aug 2002 15:53:24 +0200 Sender: webmaster(a)ripe.net X-RIPE-Spam-Status: NONE ; -985 X-RIPE-Spam-Level: Dear All, On behalf of Rene, here are the Draft minutes of the TechSec Working Group sessions at RIPE 42. ==================================== RIPE42 Techsec working group Minutes ==================================== Agenda; 1st slot: 0. Administrativia 1. Minutes of previous meeting 2. DISI status update 3. NLnet Labs reports on securing .nl 4. TF-CSIRT update, news about IODEF development, 5. IRT object in the RIPE Database: current status 2nd slot 6. Hugh Daniel reports on FreeS/WAN and issues around authentication/privacy and user perceptions. 7. A.O.B. 1. Minutes of previous meeting ------------------------------ ... were approved. 2. Olaf DISI update ------------------- http://www.ripe.net/ripe/meetings/archive/ripe-42/presentations/ripe42-disi… ml Olaf presented an update on the work done in the framework of the DISI project. Comment from Daniel Karrenberg: the idea behind deploying DNSSEC in the the RIPE NCC, the in-addr tree, is to set an example, write up how its done. 3. Miek Gieben .nl.nl experiment -------------------------------- http://www.ripe.net/ripe/meetings/archive/ripe-42/presentations/ripe42-tech… ing-nl.html Miek presented experience with implementing DNSSEC in the .nl zone. The tests were done with a shadow name server, not listed as an official server for the .nl zone. Question: do you sign zones once a day? Answer: signature validity time is one or two days; parent needs to sign often. Randy Bush: should not be so short that operational problems cause key and data to go invalid; make lifetime 3-4 times longer in the beginning 4. Yuri Demchenko TF-CSIRT update --------------------------------- http://www.ripe.net/ripe/meetings/archive/ripe-42/presentations/ripe42-tech… irt/index.html Yuri presented an updated of Terena's TF-CSIRT activity. 5. Andreii Robachesky IRT object in RIPE Database -------------------------------------------------- http://www.ripe.net/ripe/meetings/archive/ripe-42/presentations/ripe42-db-o… -update/sld017.html Andreii reported support for the IRT object has been added to RIPE Database 6. Hugh Daniel Free/SWAN ------------------------ Introduction: General security on the internet: IP and related protocols (DNS, BGP, Snmp, etc.) are _still_ not secured in very meaningfull ways. To secure someting you need to make a set of links from some known axiom to something that gets work done; Currently the known axiom a is a text name typed in to a browser or hard coded into a script, table program etc. On the net we need to start with a DNS name , link that to an IP then link to each packet of data. If either of the links is broken, you do not have security. In Free/SWAN: Use emerging tools dnssec and ipsec to secure tcp/ip packets; dnssec secures name to resource record lookups, ipsec secures the packets from the address that dsnsec returned. Your layer of the infrastructure thus gets secured. Opportunistic Encryption (OE); automatically setup IPsec connections between any two machines on the net when they start talking to each other. whenever an OE host is about to send a packet to a new host it has not talked to recently, it first checks the reverse DNS entry for that IP address; if there is a key there use it to setup an IPSec session. OE works with both DNS and DNSsec, with DNS you are now protected from passive listening attacks with DNSSEC you are protected from active attacks. (protected as best as things can be designed this week and only as well as people run their hosts ...) Questions/Discussion: Q You are using key recoreds? A. Yes, though not perfect; complexity comes whith hosts that do IPsec or OE for themselvev or for a subnet, gateway PCs, security for all stuff behing id. Would need equivalent of MX recored, this is my key, but this is the host who will do IPsec for me. Missing in DNSSEC Randy Bush: AT&T uses this technology internally, ~1000 hosts couple of PCs talk to 500-1000 pcs at emplyoees homes provide 16bit address from emplyoee to office and nothing else. box @home doesn't talkk to anything but AT&T servers gateways, etc. Can have machines @home inside and outside at&t, but no need for leased line. freeSwan running in VPM mode Hugh asks: would it work you in your organisation? comments: - was considering Free/SWAN as frontend, need to encrypt the packets, wavesec - could be interesting, we have two kinds of home users, techies, and others who even with a recipe don't know if they can do it correctly. OE soltuion for AT&T, sigaret size box to do OE 7. A.O.B. No AOB Regards Jeroen Bet RIPE NCC WEBMASTER ==================

1 0

REMINDER DNSSEC, introduction to the concept and current state (fwd)
by Henk Uijterwaal (RIPE-NCC) 15 Aug '02

15 Aug '02

FYI. ---------- Forwarded message ---------- Date: Thu, 15 Aug 2002 12:13:19 +0200 From: RIPE NCC Training <training(a)ripe.net> To: local-ir(a)ripe.net Subject: REMINDER DNSSEC, introduction to the concept and current state * * * Reminder * * * DNSSEC, introduction to the concept and current state Date: Saturday 14 September 2002 Time: 0900 - 1700 Location: Rhodes, Greece AND Date: Tuesday 22 October 2002 Time: 0900 - 1700 Location: Sarajevo, Bosnia AND Date: Thursday 28 November 2002 Time: 0900 - 1700 Location: Paris, France AND Date: Thursday 12 December 2002 Time: 0900 - 1700 Location: Amsterdam, The Netherlands The Domain Name System (DNS) is one of the main parts of the Internet Infrastructure. DNS is trusted by many end-users to give correct results. At the moment, however, DNS lacks a mechanism to establish the authenticity and integrity of the data it provides. DNSSEC is a set of extensions to provide end-to-end authenticity and integrity. This introduction will cover. - DNS security threats; - DNSSEC security mechanisms; + DNSSEC server protection; + DNSSEC data protection; - Delegation issues; - Key management issues; - Current developments; The DNSSEC introduction is intended for those who are familiar with common DNS terminology and are interested in learning about the concepts and mechanisms that DNSSEC offers. Our goal is to provide participants with sufficient background to be able to deploy DNSSEC in their own organization. Examples are based on the BIND name server. More information about the details of the DNSSEC Introduction can be found at: http://www.ripe.net/disi/ Kind regards, Sandra Gijzen RIPE NCC Training Co-Ordinator REGISTRATION ============ To register for these Courses, please complete the registration form below and reply to <training(a)ripe.net>. Please send only the registration form in your reply and edit out all other text. Add a value in the `box' area marked between the square brackets (i.e. "[" and "]" ). Alternatively, you can use the Training Course Request Form at: http://www.ripe.net/cgi-bin/trainingform.pl.cgi If you have any questions about the DNSSEC Introduction, your registration form or the web page, please contact us at <training(a)ripe.net>. -------------------------- %START PART 1 - Registration 1) Your name Enter First name, Last name in full e.g. John Doe Mary-Beth Walton # NAME [ ] 2) Your Registry ID (format: country-code.<name of registry>) # REG [ ] 3) Your e-mail address # EMAIL [ ] 4) Your NIC handle (optional) # NICHANDLE [ ] 5) The Course you plan to attend (date and location) # COURSE [ ] %END

1 0

Agenda item for TechSec at RIPE43
by Henk Uijterwaal (RIPE-NCC) 22 Jul '02

22 Jul '02

---------- Forwarded message ---------- Date: 22 Jul 2002 14:30:07 -0000 From: owner-techsec-wg(a)ripe.net To: techsec-wg-approval(a)ripe.net Subject: BOUNCE techsec-wg(a)ripe.net: Non-member submission from [ted(a)tednet.nl (Ted Lindgreen)] Received: (qmail 17321 invoked by uid 0); 22 Jul 2002 14:30:07 -0000 Received: from birch.ripe.net (193.0.1.96) by postman.ripe.net with SMTP; 22 Jul 2002 14:30:07 -0000 Received: from postman.ripe.net (postman.ripe.net [193.0.0.199]) by birch.ripe.net (8.11.6/8.11.6) with SMTP id g6MEU2110633 for <techsec-wg(a)ripe.net>; Mon, 22 Jul 2002 16:30:02 +0200 Received: (qmail 17280 invoked by uid 0); 22 Jul 2002 14:30:01 -0000 Received: from omval.tednet.nl (213.53.69.17) by postman.ripe.net with SMTP; 22 Jul 2002 14:30:01 -0000 Received: by omval.tednet.nl (8.9.1a/8.9.1) id QAA13904 for techsec-wg(a)ripe.net; Mon, 22 Jul 2002 16:30:01 +0200 (MET DST) Message-Id: <200207221430.QAA13904(a)omval.tednet.nl> From: ted(a)tednet.nl (Ted Lindgreen) Date: Mon, 22 Jul 2002 16:30:01 +0200 In-Reply-To: "Ted Lindgreen's message as of Apr 16, 16:33" Reply-To: Ted.Lindgreen(a)tednet.nl X-Organization: TedNet BV X-Address: Omval 56, 1096HV Amsterdam, The Netherlands X-Phone: +31 20 6631060 Fax: +31 20 4684462 X-Mailer: Mail User's Shell (7.2.4 2/2/92) To: techsec-wg(a)ripe.net Subject: Agenda item for TechSec at RIPE43 X-RIPE-NCC-SpamStatus: Found to be clean X-RIPE-NCC-SpamCheck: SpamAssassin (score=-3.4, required 15, IN_REP_TO) Hi wg, Please send me your agenda items for the TechSec meeting at Ripe 43 (Rhodos). -- ted

1 0