DNSOP, .GB - 2018-03 v0.3

Major changes

Major changes

• Conversational description of how this works.
• This is for the active root TA.
• Many many readability fixes (thanks all!)
• Make examples FQDN.
• Some privacy clarifications.
• SERVFAIL vs NXDOMAIN...

Major changes

• _is-ta-<key-tag>
• kskroll-sentinel-is-ta-<hex key-tag>
• kskroll-sentinel-is-ta-<dec key-tag>

Demo

Questions?

Backup Slides

What's the problem?

• We need want to roll the DNSSEC trust-anchor (KSK)
• Have no way to measure the impact.

RFC8145!

Pretty graphs!

Prettier graphs!

Sentinel

1. Requires a (simple) resolver update
2. Allows anyone to set up a measurement service
3. Exposes the result to the users

Example

• I'm a validating resolver. I support sentinel.
• I have the new KSK (20326)

• I get a query for invalid.example.com
  • It fails DNSSEC validation - SERVFAIL
• I get a query for

  kskroll-sentinel-is-ta-20326.example.com

• • I resolve it and get 192.0.2.23
  • I have (and am using) KeyID 20326
    • answer with 192.0.2.23 
• I get a query for

  kskroll-sentinel-not-ta-20326.example.com

  • I do have (and am using) KeyID 20326
    • send SERVFAIL

Yawn. So what?!

• Fish? Not validating, key-roll doesn't affect you.
• Kitten and Puppy? Legacy, we cannot tell.
• Kitten? You have the new key, you'll be fine.
• Puppy? DANGER! You only have the old key.

Srsly? Kittens?!

...but kittens!!!

Questions?