- dns-wg - mailman.ripe.net

RE: Root Zone DNSSEC Deployment Technical Status Update
by Brett Carr 10 Jun '10

10 Jun '10

Joe, > Subject: [dns-operations] Root Zone DNSSEC Deployment Technical Status > Update > > Root Zone DNSSEC Deployment > Technical Status Update 2010-06-09 > > This is the eighth of a series of technical status updates intended > to inform a technical audience on progress in signing the root zone > of the DNS. > > > RESOURCES > > Details of the project, including documentation published to date, > can be found at <http://www.root-dnssec.org/>. > > We'd like to hear from you. If you have feedback for us, please > send it to rootsign(a)icann.org. > > > PUBLIC NOTICE > > The US Department of Commerce National Telecommunications and > Information Administration (NTIA) has issued a Public Notice regarding > the deployment of DNSSEC in the root zone. > > http://www.ntia.doc.gov/frnotices/2010/FR_DNSSEC_Notice_06092010.pdf > > The Public Notice makes reference to the final report submitted to > NTIA by ICANN and VeriSign which contains a summary of the project > work to date together with a recommendation that full deployment > should proceed. > > http://www.ntia.doc.gov/reports/2010/DNSSEC_05282010.pdf > > The Public Notice includes a public review period. Comments may be > submitted by postal mail, fax or e-mail before 2010-06-21. > Instructions > for the submission of comments are included in the Public Notice. > > > PLANNED DEPLOYMENT SCHEDULE > > Already completed: > > 2010-01-27: L starts to serve DURZ > > 2010-02-10: A starts to serve DURZ > > 2010-03-03: M, I start to serve DURZ > > 2010-03-24: D, K, E start to serve DURZ > > 2010-04-14: B, H, C, G, F start to serve DURZ > > 2010-05-05: J starts to serve DURZ > > To come: > > 2010-06-16: First Key Signing Key (KSK) Ceremony > > 2010-07-15: Distribution of validatable, production, signed root > zone; publication of root zone trust anchor > Congratulations on the progress so far. Apologies if this question has been asked/answered before but do you have a timeline on the acceptance of DS records for publication into the root from TLD operators? Brett Carr Systems Administrator Nominet UK

1 0

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 09 Jun '10

09 Jun '10

Root Zone DNSSEC Deployment Technical Status Update 2010-06-09 This is the eighth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org. PUBLIC NOTICE The US Department of Commerce National Telecommunications and Information Administration (NTIA) has issued a Public Notice regarding the deployment of DNSSEC in the root zone. http://www.ntia.doc.gov/frnotices/2010/FR_DNSSEC_Notice_06092010.pdf The Public Notice makes reference to the final report submitted to NTIA by ICANN and VeriSign which contains a summary of the project work to date together with a recommendation that full deployment should proceed. http://www.ntia.doc.gov/reports/2010/DNSSEC_05282010.pdf The Public Notice includes a public review period. Comments may be submitted by postal mail, fax or e-mail before 2010-06-21. Instructions for the submission of comments are included in the Public Notice. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ 2010-05-05: J starts to serve DURZ To come: 2010-06-16: First Key Signing Key (KSK) Ceremony 2010-07-15: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)

1 0

Draft minutes for RIPE60 - take 2
by Jim Reid 31 May '10

31 May '10

Here are the draft minutes again. I hope the attachment is more easily readable this time. It appears my mail client (Apple Mail) is crippled by a DOS legacy. Sigh. It seems that when the file name of a text attachment doesn't have a .txt suffix, the file gets encoded as application/octet-steam (=> base64 weirdness) instead of a text/plain MIME type. Ho hum. Hopefully this is more readable for you all. Apologies for any trouble and please let me know if there are any problems this time round. Oh and comments on the minutes would be welcome too. :-)

1 0

draft RIPE60 minutes
by Jim Reid 29 May '10

29 May '10

Folks, here are the draft minutes from Prague. Please let me know if there are any errors or omissions.

1 0

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 18 May '10

18 May '10

Root Zone DNSSEC Deployment Technical Status Update 2010-05-17 This is the seventh of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. CHANGE IN DEPLOYMENT SCHEDULE The date for the publication of the root zone trust anchor and the distribution of a validatable, signed root zone originally planned for 2010-07-01 has been changed. This final stage of root DNSSEC deployment is now scheduled to take place on 2010-07-15. The schedule change is intended to allow ICANN and VeriSign an additional two weeks for further analysis of the DURZ rollout, to finalise testing and best ensure the secure, stable and resilient implementation of the root DNSSEC production processes and systems. Prior to 2010-07-15 the U.S. Department of Commerce (DoC) will issue a public notice announcing the publication of the joint ICANN-VeriSign testing and evaluation report as well as the intent to proceed with the final stage of DNSSEC deployment. As part of this notice the DoC will include a public review and comment period prior to taking any action. This change has been reflected in the deployment plan and other documentation, and updated documents will be published at <http://www.root-dnssec.org/>. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ 2010-05-05: J starts to serve DURZ To come: 2010-06-16: First Key Signing Key (KSK) Ceremony 2010-07-15: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)

1 0

RIPE - ARIN cooperation when registering signed legacy reverse zones?
by Chris Thompson 11 May '10

11 May '10

I hope this is the appropriate place to raise this. There are legacy network allocations whose reverse zone is managed via RIPE, but actually delegated from higher level reverse zones run by ARIN. To take a specific example, 131.111/16 is allocated to the University of Cambridge, we manage the delegation info for 111.131.in-addr.arpa via RIPE, but 131.in-addr.arpa belongs to ARIN. Now 111.131.in-addr.arpa is signed (since September 2009), and currently registered at dlv.isc.org. Along with the other high-level ARIN reverse zones, 131.in-addr.arpa is also signed, and https://www.arin.net/resources/dnssec/ indicates that they may be accepting signed delegations Fairly Soon Now (depending on what you think "the first part of 2010" means). Is it understood yet how (or even if) this will work for legacy network allocations? Ideally, this would just be a matter of supplying RIPE with the "ds-rdata" attributes as described in https://www.ripe.net/rs/reverse/dnssec/registry-procedure.html and they would get transferred seamlessly into the ARIN zones (and signed there). -- Chris Thompson University of Cambridge Computing Service, Email: cet1(a)ucs.cam.ac.uk New Museums Site, Cambridge CB2 3QH, Phone: +44 1223 334715 United Kingdom.

8 11

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 05 May '10

05 May '10

Root Zone DNSSEC Deployment Technical Status Update 2010-05-05 This is the sixth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. ** The final transition to a signed root zone took place today ** on J-Root, between 1700--1900 UTC. ** ** All root servers are now serving a signed root zone. ** ** All root servers will now generate larger responses to DNS ** queries that request DNSSEC information. ** ** If you experience technical problems or need to contact ** technical project staff, please send e-mail to rootsign(a)icann.org ** or call the ICANN DNS NOC at +1 310 301 5817, e-mail preferred ** if possible. ** ** See below for more details. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org. DEPLOYMENT STATUS The incremental deployment of DNSSEC in the Root Zone is being carried out first by serving a Deliberately Unvalidatable Root Zone (DURZ), and subsequently by a conventionally signed root zone. Discussion of the approach can be found in the document "DNSSEC Deployment for the Root Zone", as well as in the technical presentations delivered at RIPE, NANOG, IETF and ICANN meetings. All of the thirteen root servers have now made the transition to the to the DURZ. No harmful effects have been identified. The final root server to make the transition, J-Root, started serving the DURZ in a maintenance window between 1700--1900 UTC on 2010-05-05. Initial observations relating to this transition will be presented and discussed at the DNS Working Group meeting at RIPE 60 in Prague on 2010-05-06. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ 2010-05-05: J starts to serve DURZ To come: 2010-07-01: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.)

1 0

DNSMON - New user Interface
by Mirjam Kuehne 04 May '10

04 May '10

Dear colleagues, We (thanks to the RIPE NCC Information Services Team) are working on a new user interface for DNSMON. You can find a description on RIPE Labs: http://labs.ripe.net/content/dnsmon-new-user-interface Please take a look and give us your feedback. Kind Regards, Mirjam Kühne RIPE NCC

1 0

Root Zone DNSSEC Deployment Technical Status Update
by Joe Abley 03 May '10

03 May '10

Root Zone DNSSEC Deployment Technical Status Update 2010-05-03 This is the fifth of a series of technical status updates intended to inform a technical audience on progress in signing the root zone of the DNS. ** The final transition to the DURZ will take place on ** J-Root, on 2010-05-05 between 1700--1900 UTC. ** ** After that maintenance all root servers will be serving the ** DURZ, and will generate larger responses to DNS ** queries that request DNSSEC information. ** ** If you experience technical problems or need to contact ** technical project staff, please send e-mail to rootsign(a)icann.org ** or call the ICANN DNS NOC at +1 310 301 5817, e-mail preferred ** if possible. ** ** See below for more details. RESOURCES Details of the project, including documentation published to date, can be found at <http://www.root-dnssec.org/>. We'd like to hear from you. If you have feedback for us, please send it to rootsign(a)icann.org. DEPLOYMENT STATUS The incremental deployment of DNSSEC in the Root Zone is being carried out first by serving a Deliberately Unvalidatable Root Zone (DURZ), and subsequently by a conventionally signed root zone. Discussion of the approach can be found in the document "DNSSEC Deployment for the Root Zone", as well as in the technical presentations delivered at RIPE, NANOG, IETF and ICANN meetings. Twelve of the thirteen root servers have already made the transition to the DURZ. No harmful effects have been identified. The final root server to make the transition, J-Root, will start serving the DURZ in a maintenance window scheduled for 1700--1900 UTC on 2010-05-05. Initial observations relating to this transition will be presented and discussed at the DNS Working Group meeting at the RIPE meeting in Prague on 2010-05-06. PLANNED DEPLOYMENT SCHEDULE Already completed: 2010-01-27: L starts to serve DURZ 2010-02-10: A starts to serve DURZ 2010-03-03: M, I start to serve DURZ 2010-03-24: D, K, E start to serve DURZ 2010-04-14: B, H, C, G, F start to serve DURZ To come: 2010-05-05: J starts to serve DURZ 2010-07-01: Distribution of validatable, production, signed root zone; publication of root zone trust anchor (Please note that this schedule is tentative and subject to change based on testing results or other unforeseen factors.) A more detailed DURZ transition timetable with maintenance windows can be found in the document "DNSSEC Deployment for the Root Zone", the most recent draft of which can be found on the project web page at <http://www.root-dnssec.org/>.

1 0

PGP Key signing Party at RIPE 60
by Wolfgang Nagele 27 Apr '10

27 Apr '10

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, During RIPE 60[1] in Prague, I would like to organise a PGP key signing party[2] to take place after the working group sessions on Thursday and before the RIPE Dinner. We will meet at the elevators on the first floor on Thursday, 6 May 2010 at 18:00. The process for the signing will be: 1. Add your public key to the keyring[3]. In order for me to be able to print the list, the deadline for this is Thursday, 6 May 2010 at 12:00. 2. You will be provided with a printout of the keyring. It is important that you verify your own fingerprint on it with a trusted copy of your key fingerprint. 3. After we are all gathered, we will take it in turns to read our own key fingerprint so everyone else can verify it on the printout provided. It is best to check off the fingerprints you have verified on the list. 4. Next we will verify the identity of the key owner by using a legal document (passport, driver's license, etc.). For each identity you have verified you can add another checkmark on the printout. 5. Now the official part of the party is finished and once you get back home you can download the keyring[3] and sign each key that you validated. It is easy to identify those by having two checkmarks on the printout. You should then provide the owner of that key with your signed version and possibly upload it to a key-server. If you have any questions or problems, please feel free to contact me. You may also spread the word through other information channels. Regards, Wolfgang Nagele System Engineer DNS Services RIPE NCC [1] http://www.ripe.net/ripe/meetings/ripe-60 [2] http://www.cryptnet.net/fdp/crypto/keysigning_party/en/keysigning_party.html [3] http://biglumber.com/x/web?keyring=9155 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkvXEVwACgkQjO7G63Byy8e4rgCgn1PzPuCLMiAgPbi9RhElO6sm 2ngAoJ4602nIjEohgKo5GA40nALiObpv =gjDI -----END PGP SIGNATURE-----

1 0