ION Krakow - DNSSEC Panel Introduction
•Download as PPTX, PDF•
0 likes•1,051 views
ION Krakow, 30 September 2013: Introductory slides from the "Slaying the Two-headed Beast: Challenges and Triumphs of DNSSEC" panel.
Recommended
Recommended
More Related Content
What's hot
What's hot (15)
Viewers also liked
Viewers also liked (6)
Similar to ION Krakow - DNSSEC Panel Introduction
Similar to ION Krakow - DNSSEC Panel Introduction (20)
More from Deploy360 Programme (Internet Society)
More from Deploy360 Programme (Internet Society) (20)
Recently uploaded
Recently uploaded (20)
ION Krakow - DNSSEC Panel Introduction
- 1. www.internetsociety.org/deploy360/ Slaying the Two-Headed Beast: Challenges and Triumphs of DNSSEC
- 2. www.internetsociety.org/deploy360/ About Deploy360 The Challenge: – The IETF creates protocols based on open standards, but some are not widely known or deployed – People seeking to implement these protocols are confused by a lack of clear, concise deployment information The Deploy360 Solution: – Provide hands-on information on IPv6, DNSSEC and routing resiliency/security to advance real-world deployment – Work with first adopters to collect and create technical resources and distribute these resources to fast following networks
- 3. www.internetsociety.org/deploy360/ Web Portal (Online Knowledge Repository) • Technical documents • Audience-specific information • Blogs & social media Social Media (Constant Audience Engagement) • Twitter • Facebook • Google+ • YouTube • RSS Feeds Speaking Engagements (Come Meet Us or Invite Us to Speak) • Consumer Electronics Show • IPv6 Summits • Interop • Network Operators’ Groups ION Conferences (Hands-on Educational Events) • Slovenia • India • USA • Canada • Argentina Deploy360 Components
- 5. www.internetsociety.org/deploy360/ Our Panel Moderator: • Dan York, Internet Society Panelists: • Frederic Cambus, StatDNS • Krzysztof Olesik, NASK • Patrik Wallström, OpenDNSSEC
- 6. www.internetsociety.org/deploy360/ The Two Parts of DNSSEC Signing Validating ISPs Enterprises Applications DNS Hosting Registrars Registries
- 7. www.internetsociety.org/deploy360/ DNSSEC Signing - The Individual Steps Registry Registrar DNS Hosting Provider Domain Name Registrant • Signs TLD • Accepts DS records • Publishes/signs records • Accepts DS records • Sends DS to registry • Provides UI for mgmt • Signs zones • Publishes all records • Provides UI for mgmt • Enables DNSSEC (unless automatic)
- 8. www.internetsociety.org/deploy360/ A Normal DNS Interaction Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 10.1.1.123 4 example.com NS .com NS example.com?
- 9. www.internetsociety.org/deploy360/ Attacking DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 1 25 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 192.168.2.2 4 Attacking DNS Svr example.co m 192.168.2.2 example.com NS .com NS example.com?
- 10. www.internetsociety.org/deploy360/ A Poisoned Cache Web Server Web Browser https://example.com/ web page DNS Resolver 1 2 3 4 192.168.2.2 Resolver cache now has wrong data: example.com 192.168.2.2 This stays in the cache until the Time-To-Live (TTL) expires! example.com?
- 11. www.internetsociety.org/deploy360/ Attempting to Spoof DNS Web Server Web Browser https://example.com/ web page DNS Resolver 10.1.1.123 DNSKEY RRSIGs 1 25 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 SERVFAIL 4 Attacking DNS Svr example.co m 192.168.2.2 DNSKEY RRSIGs example.com NS DS .com NS DS example.com?
- 12. www.internetsociety.org/deploy360/ The Typical TLS (SSL) Web Interaction Web Server Web Browser https://example.com/ TLS-encrypted web page DNS Resolver 10.1.1.1231 2 5 6 DNS Svr example.co m DNS Svr .com DNS Svr root 3 10.1.1.123 4 Is this encrypted with the CORRECT certificate? example.com?
- 13. www.internetsociety.org/deploy360/ DANE Web Server Web Browser w/DANE https://example.com/ TLS-encrypted web page with CORRECT certificate DNS Server 10.1.1.123 DNSKEY RRSIGs TLSA 1 2 Firewall (or attacker) https://example.com/ TLS-encrypted web page with NEW certificate (re-signed by firewall) Log files or other servers DANE-equipped browser compares TLS certificate with what DNS / DNSSEC says it should be. example.com?
- 14. www.internetsociety.org/deploy360/ DNSSEC Deployment – Top-Level Domains
- 15. www.internetsociety.org/deploy360/ Resources To learn more about DNSSEC and how to get started: http://www.internetsociety.org/deploy360/dnssec/basics/ http://www.internetsociety.org/deploy360/resources/dane/ Specific resources that may be of interest: • SURFnet whitepaper about deploying validating servers • DNSSEC HOWTO • NIST "Secure DNS Deployment Guide"
- 16. www.internetsociety.org/deploy360/ Three Requests For Network Operators 1. Deploy DNSSEC-validating DNS resolvers 2. Sign your own domains where possible 3. Help promote support of DANE protocol • Allow usage of TLSA record. Let browser vendors and others know you want to use DANE. Help raise awareness of how DANE and DNSSEC can make the Internet more secure.
- 17. www.internetsociety.org/deploy360/ Internet Society Deploy360 Programme Can You Help Us With: • Case Studies? • Tutorials? • Videos? How Can We Help You? 10/9/2013 www.internetsociety.org/deploy360/
- 18. www.internetsociety.org/deploy360/ york@isoc.org http://www.internetsociety.org/deploy360/ Dan York Senior Content Strategist Internet Society Thank You!