Krit Witwiyaruj Thai Name Server Co., Ltd.th DNSSEC Implementation

.th System Architecture

KeyStore Admin Tool Key parameters for the zone  Key Usage, KSK/ZSK  Key Algorithm, RSA-SHA1/RSA-SHA256  Key Length, 2048/1024 bits  Key Reference Location Keys generation Tool  Key gen. for multiple zones  Key gen. for a zone  Rollover Key gen. for multiple zones  Rollover Key gen. for a zones  Rollover Key deletion

Private Key Private Key store in the.private file  Tracking by KeyStore Admin Tool Reference Location Timestamp  Non Active Key are store in separate directory Public Key store in the.key file and in the KeyStore for easy access  Accessible by KeyStore Admin Tool Reference Location Key content Timestamp  Non Active Key are store in separate directory

Zone Builder Tool Run by Cron job Put DNSKEY and DS records into the zone  Only active keys will be put into the zone. Auto update the serial no. Legacy zone content is included.  The content that is operated by hand.

Zone Signer Run by Zone Builder Tool Sign the zone by corresponding keys  Read signing parameter from KeyStore  Sign zone using BIND’s dnssec-signzone  Sign multiple keys for key rollover when needed

Zone Transfer Signed zones will be loaded into local Nameserver By using the DNS Zone transfer mechanism with TSIG setup, The zone will be transferred to the Outbound Nameserver before transferring to the Primary Nameserver Then will be distributed to the authoritative servers

DS & DNSKEY Tool Client Domain need to send in their keyset (public key)  via. and (in the future, web interface) Registration staff then will verify the key and then run the tool to convert the key to DS records The tool will automatic store DS records to the zone Database For the legacy client, to run the tool, the staff need to create a Keyset file and put the result (DS records) to the zone by hand.

Sign.th zone Experimental Signer box Setup  Intel Quad Core Xeon X GHz  Ram 2GB  OS FreeBSD 6.4-RELEASE  BIND P1.th zones  1 tld, “th”  7 sld, “ac.th”, “co.th”, “go.th”, “in.th”, “mi.th”, “net.th”, “or.th” Key Size  KSK algorithm RSA-SHA bits  ZSK algorithm RSA-SHA bits

Sign.th zone Experimental Sign zone with no DS record ZoneRegistered domains Zone size (K) Time taken (s) Unsigned zoneSigned zone th16, , ac.th5, , co.th34,4121,80710, go.th4, , in.th9, , mi.th net.th or.th

Things To Do Registry-Registrar-Reseller DNSSEC add-on API.  To enable DNSSEC registration  To handle keyset submission  Provide publickey information to the world ….

Krit Witwiyaruj Thai Name Server Co., Ltd Thank You