1. Internet2 DNSSEC Pilot Shumon Huque University of Pennsylvania
ESCC/Internet2 Joint Techs Workshop
Madison, Wisconsin, U.S.A., July 19th 2006
Title Slide

2. Description of the Pilot
Goal: Deploy DNSSEC and gain operational experience
Participants sign at least one of their zones
Exchange keys (trust anchors) that will allow them to mutually validate DNS data
Setup security-aware resolvers
configured with the trust anchors

3. A little background ..
Feb ‘06: DNSSEC Workshop held at Albuquerque Joint Techs
Mar ‘06: mailing list
Apr ‘06: Internet2 Spring Member meeting
Advisory group formed and plans for a pilot project formulated
May ‘06: Pilot group began
Bi-weekly conference calls and progress reports

4. Partner in DNSSEC Deployment Initiative
Co-ordination
Internet2 and Shinkuro
Partner in DNSSEC Deployment Initiative
Some funding from US government

5. DNSSEC Deployment Efforts so far
MAGPI GigaPoP
All zones: magpi.{net,org} & 15 reverse zones
MERIT
radb.net
nanog.org
NYSERNet - test zone
nyserlab.org

6. Deployments in the pipeline ..
University of Pennsylvania
University of California - Berkeley
University of California - Los Angeles
University of Massachusetts - Amherst
Internet2

7. Ongoing work & discussion
To DLV or not? (and if so, which registry?)
“DNSSEC Lookaside Validation”
Deploy NSEC3 or not?
Stub resolver security
Key maintenance & rollover policies
Secure delegations from parents
.edu, .net, .org, .in-addr.arpa

8. More participants welcome!
(participation not restricted to Internet2)
Join mailing list
Participate in con calls
DNSSEC lunchtime today

9. References Internet2 DNSSEC Pilot Mailing list: dnssec@internet2.edu
Mailing list:
Internet2 DNSSEC Workshop

10. References (2) DNSSEC(bis) technical specs: Related:
RFC 4033, 4034, 4035
Related:
Threat analysis of the DNS: RFC 3833
Operational practices
draft-ietf-dnsop-dnssec-operational-practices-08
NSEC3: draft-ietf-dnsext-nsec3-05
DLV: draft-weiler-dnssec-dlv-01
ISC DLV registry:

11. Questions?
Shumon Huque
shuque -at- isc.upenn.edu