SaudiNIC's Experience in Deploying DNSSEC
SaudiNIC Experience in
Deploying DNSSec
AbdulRahman Al-Ghadir
SaudiNIC - CITC
MENOG 16
The Start
•
SaudiNIC was observing the growth of DNSSec
development till it got mature.
•
SaudiNIC staff conducted a study that consist of:
–
What is DNSSEC?
–
In depth study of some pioneer DNSSEC
implementations:
•
Netherland
•
New Zealand
–
A road map for DNSSEC deployment by SaudiNIC
Road Map
Start of the project
Creating startup team
DPS draft
S
a
u
d
i
N
I
C
D
N
S
S
e
c
p
r
o
c
e
d
u
r
e
s
SaudiNIC DNSSec setup
D
N
S
S
e
c
w
o
r
k
s
h
o
p
Building test lab
E
n
a
b
l
i
n
g
D
N
S
S
e
c
o
n
.
A
l
s
a
u
d
i
a
h
(
I
D
N
A
)
E
n
a
b
l
i
n
g
D
N
S
S
e
c
o
n
.
S
A
O
p
e
n
D
N
S
S
e
c
f
o
r
p
u
b
l
i
c
E
n
d
o
f
t
h
e
p
r
o
j
e
c
t
Creating DNSSEC Startup Team
•
Read … read … read
–
DNSSEC RFCs
–
Best practices
–
Guidelines
–
Technical implementation
–
Presentations and reports
•
Continuous meetings and brainstorming
sessions
•
Test … test … test
DPS Draft
•
Review several RFC(s) related.
•
Review some registries’ DPSs:
–
.ca Canada
–
.au Australia
–
.nz New Zealand
–
.at Austria
–
.com
–
.cl chili
–
… etc
DPS Draft
SaudiNIC DNSSec Procedures
•
DNSSEC Keys Generation Ceremony
•
DNSSEC Keys Installation Procedure
•
DNSSEC Emergency Keys Installation
Procedure
•
DNSSEC New Safe Arrangement Procedure
•
DNSSEC Safe Content Transfer Procedure
SaudiNIC DNSSec Procedures
SaudiNIC DNSSec Setup
DNSSEC Credential Matrix
DNSSec Key Management Risks
Keys Setting
•
The zone is signed using pair of keys:
–
Key Signing Key (KSK):
•
RSA/SHA2
•
Rollover every 1 year
•
Key size is 2KB
•
Key rollover algorithm is Double signature
–
Zone Signing Key (ZSK):
•
RSA/SHA2
•
Rollover every 6 months
•
Key size is 2KB
•
Key rollover algorithm is Pre-publish
Building a Test Lab
•
A virtual setup identical to the actual DNSSec
setup.
•
Hands-on on DNSSec to test it out.
•
Selection of HW/SW for DNSSec systems that
meet our need.
•
Validate key generation, signing, key rollover,
… etc.
Challenges
•
So many documents to read and digest related
to DNSSec (RFCs, best practices, … etc).
•
Rollover techniques (key rollover and
algorithm rollover).
•
So many parameters to tune them (RRSIG
inception and expiration, jitter, Max/Min TTL,
… etc).
•
Easy to break!
What is Next?
•
Enabling DNSSec on .Alsaudiah (IDNA).
•
Monitor and keep track on what is going on.
•
Allow a closed access to certain clients.
•
Monitor and keep track on what is going on.
•
Enabling DNSSec on .SA.
•
Monitor, Monitor, Monitor … etc.
•
Done!
Thank you!
SaudiNIC embarked on a comprehensive journey to deploy DNSSEC, starting with observing its growth and conducting in-depth studies on pioneer implementations worldwide. The project involved creating a startup team, drafting procedures, conducting workshops, and enabling DNSSEC on various platforms. Key activities included reviewing RFCs, establishing DNSSEC procedures, managing keys, and addressing associated risks for secure online transactions.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
SaudiNIC Experience in Deploying DNSSec AbdulRahman Al-Ghadir SaudiNIC - CITC MENOG 16
The Start SaudiNIC was observing the growth of DNSSec development till it got mature. SaudiNIC staff conducted a study that consist of: What is DNSSEC? In depth study of some pioneer DNSSEC implementations: Netherland New Zealand A road map for DNSSEC deployment by SaudiNIC
Road Map Start of the project Creating startup team DPS draft SaudiNIC DNSSec procedures SaudiNIC DNSSec setup DNSSec workshop Building test lab Enabling DNSSec on .Alsaudiah (IDNA) Enabling DNSSec on .SA Open DNSSec for public End of the project
Creating DNSSEC Startup Team Read read read DNSSEC RFCs Best practices Guidelines Technical implementation Presentations and reports Continuous meetings and brainstorming sessions Test test test
DPS Draft Review several RFC(s) related. Review some registries DPSs: .ca Canada .au Australia .nz New Zealand .at Austria .com .cl chili etc
SaudiNIC DNSSec Procedures DNSSEC Keys Generation Ceremony DNSSEC Keys Installation Procedure DNSSEC Emergency Keys Installation Procedure DNSSEC New Safe Arrangement Procedure DNSSEC Safe Content Transfer Procedure
Keys Setting The zone is signed using pair of keys: Key Signing Key (KSK): RSA/SHA2 Rollover every 1 year Key size is 2KB Key rollover algorithm is Double signature Zone Signing Key (ZSK): RSA/SHA2 Rollover every 6 months Key size is 2KB Key rollover algorithm is Pre-publish
Building a Test Lab A virtual setup identical to the actual DNSSec setup. Hands-on on DNSSec to test it out. Selection of HW/SW for DNSSec systems that meet our need. Validate key generation, signing, key rollover, etc.
Challenges So many documents to read and digest related to DNSSec (RFCs, best practices, etc). Rollover techniques (key rollover and algorithm rollover). So many parameters to tune them (RRSIG inception and expiration, jitter, Max/Min TTL, etc). Easy to break!
What is Next? Enabling DNSSec on .Alsaudiah (IDNA). Monitor and keep track on what is going on. Allow a closed access to certain clients. Monitor and keep track on what is going on. Enabling DNSSec on .SA. Monitor, Monitor, Monitor etc. Done!
