Subject: Re: (no subject)

From: Marius Marian <[email-masked]>
Date: Wed, 14 Jul 1999 15:08:07 +0200

Hello everybody,

Could someone tell from which version are supported the KEY, SIG  and
NXT RRs in BIND. Also, is it actually an existing TSIG RR used by the
resolver and nameserver in the TIS - DNSSEC implementation. If so how
could it be set? Will it be kept in the future releases of BIND?

Another question I have is how will be managed the root servers keys and
what will be a presumable safe period of life for keys.

And finally are there any links to documentation regarding DNSSEC except
the RFCs - since I'm a neophyte in the DNSSEC field :-)

Thanks in advance,
Marius Marian.

---

From: Brian Wellington <[email-masked]>
Date: Wed, 14 Jul 1999 11:32:19 -0400 (EDT)

On Wed, 14 Jul 1999, Marius Marian wrote:

> NXT RRs in BIND.

BIND 8.2 and above have support for KEY and SIG.  No version supports NXT.
These refer to the correct processing of the records, not just handling of
the records.  8.2 can handle NXT records, it just doesn't return them in
negative answers.

> Also, is it actually an existing TSIG RR used by the

What do you mean by "an existing TSIG RR"?  TSIGs are generated on the fly
by the server/resolver sending the packet.  The shared secret used to
generate the TSIG is stored in the server configuration file in BIND 8.2,
and passed as a parameter to the res_nsendsigned() function.  The earlier
TIS/DNSSEC implementations did not include TSIG authentication, and should
be considered obsolete.

> what will be a presumable safe period of life for keys.

The root servers keys will be managed by some Internet governing body
(ICANN or ISI).  The keys will be statically configured into each server
at startup time, and are expected to have a long lifetime.  The lifetime
of keys depends on several factors, including key strength, importance of
the data, etc.  I would expect to see a BCP (Best Current Practice) or
similar document describing recommended key lengths on the future.

> the RFCs - since I'm a neophyte in the DNSSEC field :-)

The only documentation I know of other than RFC and Internet Drafts is a
paper I wrote about 6 months ago:

http://www.nai.com/nai_labs/asp_set/network_security/dns_secure_paper.asp

Brian

[The DNSSEC working group is being merged into the DNSIND working group.
This mailing list should be considered deprecated, and
[email-masked] used instead.]

---

From: Edward Lewis <[email-masked]>
Date: Wed, 14 Jul 1999 12:20:05 -0400

To extend Brian's comments, I've included some claifications.

>BIND 8.2 and above have support for KEY and SIG.  No version supports NXT.

BIND began parsing these records in 4.9.something, but, as Brian says, KEY
and SIG are "working" in 8.2 and on.

>TIS/DNSSEC implementations did not include TSIG authentication, and should

TSIG is a meta record, it does not appear in the cache, configuration
files, or master files.

>similar document describing recommended key lengths on the future.

Watch the work in the DNSOP WG of the IETF.  The mail list for this group
is [email-masked].  (Subscribe via [email-masked].)

>> the RFCs - since I'm a neophyte in the DNSSEC field :-)

Try http://www.nic-se.se/dnssec/.  This has a series of presentations on
the signer code written for a workshop held in Sweden two months ago.

>[email-masked] used instead.]

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda

Opinions expressed are property of my evil twin, not my employer.

---

From: John Gilmore <[email-masked]>
Date: Wed, 14 Jul 1999 11:49:36 -0700

> BIND began parsing these records in 4.9.something, but, as Brian says, KEY

To: dnssec-interest, gnu
Subject: New production BIND release (4.9.5-REL)
Date: Tue, 12 Nov 1996 17:08:03 -0800
From: John Gilmore <[email-masked]>

4.9.5 is the first production release of BIND to include support for
the KEY and SIG records needed for Secure DNS.  It also includes
numerous bug-fixes, as well as some other features like LOC records
(geographical location), better IPv6 support, SOA parameter diagnosis,
and domain name character-set checking.  It is now running on one of
the root servers (d.root-servers.net).  Please upgrade to it as soon
as you can.

The Web page at http://www.isc.org/isc/bind.html hasn't yet been
updated; it incorrectly points its "latest release" link at 4.9.4.
4.9.5 was released on Monday, and is available right next to 4.9.4, in:

	ftp://ftp.vix.com/pub/bind/release/

	John Gilmore
	Electronic Frontier Foundation
[The DNSSEC working group is being merged into the DNSIND working group.
This mailing list should be considered deprecated, and
[email-masked] used instead.]