dnssec workshop - icann

DNSSEC WorkshopDan York, Internet Society | ICANN 56 | June 2016

| 2

Remote Participation

Slides and audio streams at:• https://meetings.icann.org/en/icann56-

sched

| 3

Program Committee

• Steve Crocker, Shinkuro, Inc.• Mark Elkins, DNS/ZACR• Cath Goulding, Nominet• Jean Robert Hountomey, AfricaCERT• Jacques Latour, CIRA• Xiaodong Lee, CNNIC• Luciano Minuchin, NIC.AR• Russ Mundy, SPARTA, A Parsons Company• Ondřej Surý, CZNIC • Yoshiro Yoneya, JPRS• Dan York, Internet Society• Julie Hedlund and Kathy Schnitt, ICANN

| 4

Luncheon Sponsors

• Afilias• CIRA• Dyn• SIDN

DNSSEC Lunch and Implementer’s Gathering Sponsors

| 5

Support

The DNSSEC Workshop and associated activities at ICANN are an organized activity of the:

• ICANN Security and Stability Advisory Committee (SSAC)

with additional assistance from the:• Internet Society

Deploy360 Programme

| 6

Program

0915-0930–Presentation:DanYork,InternetSociety–DNSSECWorkshopIntroduction,Program,

DeploymentAroundtheWorld–Counts,Counts,Counts0930-1000–Presentation:MeasurementSurveyofServer-SideDNSSECAdoptionDr.MatthäusWander,UniversityofDuisburg-Essen1000-1015–Presentation:AQuickReviewofDNSSECValidationinToday’sInternetGeoffHuston,APNIC1015-1115–PanelDiscussion:DNSSECDeploymentChallengesModerator:RussMundy,ParsonsPanelists:DaniGrant,CloudFlare–LyingMakesNegativeAnswersCheaper

Ari-MattiHusa,FICORA–DNSSECChallengesGeoffHuston,APNIC–DNSSECDeploymentChallenges

MauricioOviedo,NIC.CR

NickShorey,DepartmentforCulture,Media&Sport,UKGovernment

1115-1145–Presentation:KeySigningKeyRolloverandZSKLengthIncreaseMattLarson,ICANNandDuaneWessels,Verisign1145-1200–Discussion:DNSSECEncryptionAlgorithmsOndřejSurý,CZNICandDanYork,InternetSociety1200-1215–Presentation:DNSSECHowCanIHelp?RussMundy,ParsonsandDanYork,InternetSociety1215-1230–TheGreatDNS/DNSSECQuizRoyArends,ICANN1230-1330–SponsoredLunch

DNSSEC Deployment Around the World: Counts, Counts, CountsDan York, Internet Society | ICANN 56 | June 2016

| 88

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=0&r=0&w=7&r=1

| 99

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=0&w=7&r=1

| 1010

http://stats.labs.apnic.net/dnssec/XA?c=XA&x=1&g=1&r=0&w=7&r=1

Note:MinimaluseofGooglePDNS(thismeansDNSSECsupportbylocalISPs)

| 1111

https://rick.eng.br/dnssecstat/

| 1212

https://rick.eng.br/dnssecstat/

Note:OnlyincludestheTLDsforwhichRickLambcangetstatistics.(Example,.GOVisnotlisted.)

| 1313

https://ntldstats.com/dnssec

Notethat.BANKhas100%signed,asdoes.INSURANCE.

| 14

TLD DNSSEC Implementation Status

Experimental – internal experimentsAnnounced – Public commitment to deployPartial – Zone is signed but not in operationDS in RootOperational – Accepting signed delegations

| 15

| 16

| 17

Morocco- .MAMadagascar- .MG

March2016

| 18

Syria- .SYSaudiArabia–

. السعودیةJune2016

| 19

Romania- .ROJune2016

| 20

| 21

| 22

Receiving the DNSSEC Deployment Maps

The DNSSEC Deployment Maps are published via email every Monday morning through the Internet Society Deploy360 Programme. To subscribe, visit:

www.internetsociety.org/deploy360/dnssec/maps/

| 23

DNSSEC Event Calendar

New calendar to track DNSSEC/DANE-related events. Two views – event listing:

https://www.dnssec-deployment.org/events/

Calendar view:

http://www.dnssec-deployment.org/calendar/

Send event submissions to york@isoc.org

| 24

IETF 96 Hackathon

Sat/Sun, July 16/17– Berlin

• https://www.ietf.org/hackathon/96-hackathon.html

• Opportunity to work on new tools or services for DNSSEC / DANE / DNS Privacy

• Join us!

| 25

DNSSEC History Project

The DNSSEC History Project is an ongoing project to collect and record the history of the work that went into bringing about the deployment of DNSSEC. To view – or to contribute – please see:

https://wiki.tools.isoc.org/DNSSEC_History_Project

| 26

GCIG “One Internet” Report

http://ourinternet.org/June 21, 2016

Thank you and Questions

Dan York, Internet Society | ICANN 56 | June 2016