Verisign, Inc. · NASDAQ:VRSN
Verisign — Technical Presentation (February 2015)
13 slides from Verisign's technical presentation, Feb 11, 2015
Slide 1: Removing Impediments to DNSSEC Deployment
Removing Impediments to DNSSEC Deployment! Duane Wessels & Casey Deccio! February 11, 2015!
Slide 2: A Problem
A Problem! ! For some, the Registry-Registrar-Registrant model is an impediment to scalable deployment of DNSSEC.! ! Verisign Public! 2!
Slide 3: DS Records
DS Records! • DNSSEC “glue” between zones.! • Cryptographic hash of the child zone Key Signing Key.! • Not understandable by humans.! • Which of the following DS records are valid?! example.com. !86400 !IN !DS !31689 8 2 CDE0D742D6998AA554A92D890F8184C698CFAC8A26FA59875A990C03 E576343C! example.com.
Slide 4: Entering a DS Record via Registrar
Entering a DS Record via Registrar! Verisign Public! 4!
Slide 5: Key Rollovers Are Hard
Key Rollovers Are Hard! • RFC 6781: “Regardless of whether a zone uses periodic key rollovers or only rolls keys in case of an irregular event, key rollovers are a fact of life when using DNSSEC.”! • In some cases, rollovers are avoided entirely due to the complexity.! • A KSK rollover requires inte
Slide 6: Third-Party DNS Operators
Third-Party DNS Operators! • DNS services are often outsourced to third-party operators.! • Operators are not a party to the RRR model and not allowed to interact with the Registry.! • Although sometimes the Registrar is the DNS Operator.! • Today, operators rely on Registrants to publish DS and oth
Slide 7: In Other Words…
In Other Words…! ! To increase DNSSEC Deployment, we should explore solutions to streamline the processing of crypto data! Verisign Public! 7!
Slide 8: What If...
What If...! Verisign Public! 8!
Slide 9: What if… Registrants weren't required to submit crypto data through Registrars
What if… Registrants weren’t required to submit crypto data through Registrars! • A simpler, and more stable, alternative to DS records?! • Perhaps a name or a “pointer.”! • Easy to understand! • Changes infrequently! • But which is treated like a DS record.! • Authoritative in the parent! • Signed!
Slide 10: What if… Registries could take data directly from Registrants
What if… Registries could take data directly from Registrants! • RFC 7344 “Automating DNSSEC Delegation Trust Maintenance.”! • draft-ietf-dnsop-child-synchronization: “Child To Parent Synchronization in DNS.”! • Bootstrapping problem because child zones must be signed.! Verisign Public! 10!
Slide 11: What if… Registries could accept data directly from DNS Operators
What if… Registries could accept data directly from DNS Operators! • Bring Operators into the ecosystem.! • Beneficial to more than just DNSSEC.! • Work in progress along these lines.! • Good for Registrants using third-party operators, but what about everyone else?! Verisign Public! 11!
Slide 12: In Summary
In Summary! • A few different, but complementary, approaches to making DNSSEC easier for end users and Registrants.! • Different tradeoffs and benefits.! • All require protocol or process changes.! • Would like your input and feedback.! Verisign Public! 12!
Slide 13: © 2013 VeriSign, Inc. All rights reserved. VERISIGN and other trademarks, service marks, and
© 2013 VeriSign, Inc. All rights reserved. VERISIGN and other trademarks, service marks, and designs are registered or unregistered trademarks of VeriSign, Inc. and its subsidiaries in the United States and in foreign countries. All other trademarks are property of their respective owners.!