- techsec-wg - mailman.ripe.net

Pre-Announcement: DNSSEC Workshop
by Olaf Kolkman 30 Jul '01

30 Jul '01

The RIPE NCC will be organising a DNSSEC workshop/tutorial. The workshop will be held in Prague on the Monday after the RIPE Meeting, October 8: 9 am to 5 pm. The workshop will consists of two parts: an introduction to DNSSEC and a hands-on workshop. The goal of the workshop is familiarise the participants with DNSSEC so they can maintain their own secured zone and to identify current difficulties in deployment. To be able to run the program in a day we expect the participants - being able to administer DNS zone files with bind; - to bring their own dummy zone to experiment with; - to bring a laptop running the latest version of bind. - being able to patch bind software if needed; Registration for this workshop will be opened as of mid august, following an announcement to the techsec-wg(a)ripe.net majordomo maillist. The amount of participants will be limited to 25 persons. --Olaf Kolkman ----------------------------------------------------- Olaf M. Kolkman | RIPE NCC DISI Project ----------- | --------------- RIPE NCC | Phone: +31 20 535 4444 Singel 258 | Fax: +31 20 535 4445 1016 AB Amsterdam | http://www.ripe.net/disi The Netherlands | OKolkman(a)ripe.net

1 0

RE: First draft for the charter
by Christian Panigl, ACOnet/VIX/UniVie 11 Jun '01

11 Jun '01

>Date: Wed, 6 Jun 2001 16:30:26 +0200 (CEST) >From: "Henk Uijterwaal (RIPE-NCC)" <henk(a)ripe.net> > >> I guess one of the major concerns of this WG could/should be the >> coordinated fight against (D)DoS attacks, which are attaining scaring >> quality and efficiency those days. > >Probably, this is a mixture of technical stuff and dealing with (ab)users >of the infrastructure. In the latter case, this is more a "user level >security" issue that belongs in Anti-Spam. Dear Henk, security issues will _always_ have to do with abusers, otherwise you won't need security ;-} And I won't play down DDoS as a "user level security" issue any longer because the used techniques are powerful enough to abuse and turn out significant parts of the Internet infrastructure, for some time at least. >However, it is definitely something to be discussed somewhere, so let's >put it on the to-do list for the group and decide later. It's no longer a matter for discussion and deciding later, it's a matter which should be raised to the highest possible awareness, also in the RIPE region, IMHO. And it's definitly a matter for co-ordinated efforts, any input and complements from other groups should be appreciated and advertised, of course. Thanks for the charter, which is apparently wide enough for dealing with most aspects DDoS attacks. CP

2 1

First draft for the charter
by Henk Uijterwaal (RIPE-NCC) 06 Jun '01

06 Jun '01

Dear Colleagues, Below you'll find a first attempt at a charter for this group: --- Technical Security Working Group ================================ The Technical Security Working Group (techsec-wg) has been set up to discuss all security aspects related to the Internet infrastructure. The focus of the group will be on the practical aspects and deployment of Internet security techniques. At the moment, the group will focus on issues related to the deployment of DNSsec in the RIPE area. The group will also act as the place where RIPE NCC will report on the progress of the DISI project. However, in the future, the scope of the group can be expanded to include any new security techniques. This group will limit itself to technical aspects of Internet security. The group will not discuss "user level" security, these topics will be referred to the "anti-spam working group". A workplan for the group will be presented and discussed at RIPE40. --- Comments to the list please, Henk ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 1

RE: First draft for the charter
by Christian Panigl, ACOnet/VIX/UniVie 06 Jun '01

06 Jun '01

Dear Henk, I guess one of the major concerns of this WG could/should be the coordinated fight against (D)DoS attacks, which are attaining scaring quality and efficiency those days. Regards CP PS: nice lullaby ;-( http://grc.com/dos/grcdos.htm

2 1

Re: Announcement TechSec mailing list
by Henk Uijterwaal (RIPE-NCC) 15 May '01

15 May '01

On Tue, 15 May 2001, Henk Uijterwaal (RIPE-NCC) wrote: > Dear Colleagues, > > > > On Tue, 15 May 2001, Henk Uijterwaal (RIPE-NCC) wrote: > > > Minutes of the DISI BoF - RIPE 39, Bologna, May 2 2001, 9:15 > > > > 6. The future > > > > HU asks how to go ahead with this, whether to create a new working group, > > join an existing working group etc. [...] > > The consensus at the meeting was to set up a working group on the > Technical Aspects for Security for the Infrastructure. > > I've meanwhile set up a mailing-list for this group: > > techsec(a)ripe.net Oops, that should be techsec-wg(a)ripe.net Sorry, Henk > > To subscribe, send a "subscribe" message to majordomo(a)ripe.net. > In a couple of days, I'll post a first shot at a charter for the WG to > the techsec list. > > Henk > > > > ------------------------------------------------------------------------------ > Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net > RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk > Singel 258 Phone: +31.20.5354414 > 1016 AB Amsterdam Fax: +31.20.5354445 > The Netherlands Mobile: +31.6.55861746 > ------------------------------------------------------------------------------ > > As long as you don't tell your friends how I played the hand, > then I won't tell my friends how you defended it. (Anonymous) > > ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 0

Minutes DISI BoF @ RIPE39
by Henk Uijterwaal (RIPE-NCC) 15 May '01

15 May '01

Minutes of the DISI BoF - RIPE 39, Bologna, May 2 2001, 9:15 Chair: Henk Uijterwaal (HU) RIPE NCC Scribe: Mark Santcroos Slides are at: http://www.ripe.net/ripencc/pub-services/np/DISI//Talks/0105_DISI HU welcomes everyone. Agenda: 1- What is this BoF about? 2- Administrative matters 3. DISI 4. CSIRS 5. Discussision 6. The future 7. AOB ---- 3. DISI presentation: Olaf Kolkman - RIPE NCC "DISI & DNSSEC on the reverse tree" slides are at: http://www.ripe.net/ripencc/pub-services/np/DISI//Talks/0105_DISI Questions: Q: Why don't you use IPv6? A: Because we want to gain experience first. Q: What about the 192.168.? A: -XXX- Q: What can an end user do to make his ISP secure their zone? A: We want to convince the ISP's to deploy this. Q: What kind of public key system used? A: RSA is recommended, in theory all protocol can be used in parallel. But to get real success we have to choose one. That probably will be RSA. Q: How easily can we go to another encryption protocol, if for example one encryption scheme gets cracked. A: Depending on how long signatures are valid, a change of the protocol can be done within 1 day. But this depends on a lot of parameters. Q: Is there enough experience yet to determine how much effort it is to do actual implementation of this. A: Takes more CPU power for signing. Packet sizes grow. ---- 4. Presentation: Yuri Demchenko - Terena "CSIRS coordination for Europe and extended incident handling standardization" Slides are at: http://www.ripe.net/ripencc/pub-services/np/DISI//Talks/0105_DISI_YD No questions. ------ 6. The future HU asks how to go ahead with this, whether to create a new working group, join an existing working group etc. There are more issues related to security DoS, IPv6, Spam. Q: [chair of Anti-Spam WG] Is a merge going on between the various security-related WG's? A1: Not that we are aware off. A2: We want to keep them seperate. HU asks for a chair. No response. He will setup a mailing list. --- 8. AOB OK offers to give an experimental presentation about DNNSEC. This presentation is still under development and will be given in the future. The attendees welcome that and OK gives his presentation. --- HU thanks all the attendees and closes the WG session. ------------------------------------------------------------------------------ Henk Uijterwaal Email: henk.uijterwaal(a)ripe.net RIPE Network Coordination Centre WWW: http://www.ripe.net/home/henk Singel 258 Phone: +31.20.5354414 1016 AB Amsterdam Fax: +31.20.5354445 The Netherlands Mobile: +31.6.55861746 ------------------------------------------------------------------------------ As long as you don't tell your friends how I played the hand, then I won't tell my friends how you defended it. (Anonymous)

1 0