DNSSEC
for the Root Zone
IEPG @ IETF’76
8 November 2009
Richard Lamb, ICANNJoe Abley, ICANN

Sunday 8 November 2009

Matt Larson,VeriSignThis design is the result of a cooperation
between ICANN & VeriSign withsupport from the U.S. DoC NTIA

Sunday 8 November 2009

Design Requirements
Keywords

Sunday 8 November 2009

Transparency
Processes and procedures should
be as open as possible for the Internet
community to trust the signed root

Sunday 8 November 2009

Audited
Processes and procedures should
be audited against industry standards,e.g. ISO/IEC 27002:2005

Sunday 8 November 2009

High Security
Root system should meet all NIST
SP 800-53 technical security controls requiredby a HIGH IMPACT system

Sunday 8 November 2009

Roles andResponsibilities

Sunday 8 November 2009

ICANN

IANA Functions Operator• Manages the Key Signing Key (KSK)• Accepts DS records from TLD operators• Verifies and processes request• Sends update requests to DoC for
authorization and to VeriSign for
implementation

Sunday 8 November 2009

DoC NTIA

U.S. Department of Commerce
National Telecommunications and Information Administration• Authorizes changes to the root zone
‣ DS records‣ Key Signing Keys‣ DNSSEC update requests follow the sameprocess as other changes• Checks that ICANN has followed theiragreed upon verification/processing policies
and procedures

Sunday 8 November 2009

VeriSign

Root Zone Maintainer• Manages the Zone Signing Key (ZSK)• Incorporates NTIA-authorized changes• Signs the root zone with the ZSK• Distributes the signed zone to the root
server operators

Sunday 8 November 2009

DNS records sent fromTLD operator to ICANN

Verified data
sent to DoC

ICANNTLDOperator

KSK publishedby ICANN

Root Zone
distributed toroot servers

Authorized datasent to VeriSign

VeriSign
RZM

KSKManagement

DoC

Unsigned root

ZSK sent from VeriSign to ICANN

Keyset is signed by KSK and sent back from ICANN to VeriSign

Sunday 8 November 2009

SignerZSKManagement

Signed root

Root
ServersProposed Approach toProtecting the KSK

Sunday 8 November 2009

Physical Security
Facility – Tier 1 – Access control by Data Center
Facility – Tier 2 – Access control by Data Center
Facility – Tier 3 – Access control by Data Center
Cage – Tier 4 – Access control by Data Center

Safe Room – Tier 5 – Access control by ICANN

Safe #1 – Tier 6Safe #2 – Tier 6
Safe Deposit Box – Tier 7

HSM – Tier 7

Private Keys

Sunday 8 November 2009

Key Ceremony
Computer

Crypto Officers'
Credentials

DPS

DNSSEC Policy & Practice Statement• States the practices and provisions that are
employed in root zone signing and zone
distribution services‣ Issuing, managing, changing and distributing DNS
keys in accordance with the specificrequirements of the U.S. DoC NTIA

• Comparable to a certification practicestatement (CPS) from an X.509 certificate
authority (CA)

Sunday 8 November 2009

Key Signing Key Management
Global InternetCommunity

3rd Party Auditors

Other Witnesses

VeriSign Staff

3rd Party Auditors

ICANN Staff

Generate

External
Trusted Persons

PublishPublishUseUseDestroy

Destroy

Policy & Practice Statement

Sunday 8 November 2009

Zone Signing Key Management

Generate

Policy & Practice Statement

Community Trust• Proposal that community representatives*
have an active roll in management of theKSK‣ as Crypto Officers needed to activate the KSK‣ as Backup Key Share Holders protecting sharesof the symmetric key that encrypts the backup
copy of the KSK*) drawn from members of entities such as ccNSO, GNSO, IAB, RIRs, ISOC

Sunday 8 November 2009

Auditing &Transparency• Third-party auditors check that ICANN
operates as described in the DPS• Other external witness may also attend thekey ceremonies

Sunday 8 November 2009

Proposed DNSSEC
Protocol Parameters

Sunday 8 November 2009

Key Signing Key• KSK is 2048-bit RSA‣ Rolled every 2-5 years‣ RFC 5011 for automatic key rollovers• Propose using signatures based onSHA-256

Sunday 8 November 2009

Zone Signing Key• ZSK is 1024-bit RSA‣ Rolled once a quarter (four times per year)• Zone signed with NSEC
• Propose using signatures based onSHA-256

Sunday 8 November 2009

Signature Validity• DNSKEY-covering RRSIG validity 15 days
‣ re-sign every 10 days

• Other RRSIG validity 7 days

‣ re-sign twice per day (with zone generation)

Sunday 8 November 2009

Key Ceremonies• Key Generation‣ Generation of new KSK‣ Every 2-5 years• Processing of ZSK Signing Request (KSR)‣ Signing ZSK for the next upcoming quarter‣ Every quarter

Sunday 8 November 2009

Root Trust Anchor• Published on a web site by ICANN as‣ XML-wrapped and plain DS record• to facilitate automatic processing‣ PKCS #10 certificate signing request (CSR)• as self-signed public key• Allows third-party CAs to sign the KSK
Sunday 8 November 2009

Proposed Deployment

Sunday 8 November 2009

Roll Out• Incremental roll out of the signed root
‣ Groups of root server “letters” at a time

• Watch the query profile to all root servers
as roll out progresses• Listen to community feedback for any
problems

Sunday 8 November 2009

No validation• Real keys will be replaced by dummy keyswhile rolling out the signed root

‣ Signatures will not validate during roll out‣ Actual keys will be published at end of roll out

Sunday 8 November 2009

Draft Timeline• December 1, 2009

‣ Root zone signed• Initially signed zone stays internal to ICANN and VeriSign‣ ICANN and VeriSign begin KSR processing• ZSK and KSK rolls• January - July 2010

‣ Incremental roll out of signed root

• July 1, 2010

‣ KSK rolled and trust anchor published‣ Signed root fully deployed

Sunday 8 November 2009

Documentation• NTIA Requirements and High Level
Technical Architecture posted:‣ http://www.ntia.doc.gov/dns/dnssec.html• Draft DPS for ICANN and VeriSign will be
posted in very near future.

Sunday 8 November 2009

Thoughts?
• Feedback on this proposal would be
extremely welcome‣ Queue at the mic‣ Email to root-dnssec-feedback@verisignlabs.com

Sunday 8 November 2009

Root DNSSEC Design TeamJoe Abley
David Blacka
David Conrad
Richard Lamb
Matt Larson
Fredrik LjunggrenDavid Knight
Tomofumi Okubo
Jakob Schlyter

Sunday 8 November 2009