Notes from the State-Of-The-Technology: DNSSEC

A meeting of groups involved in the development of the DNS SecurityExtensions (DNSSEC) was held in conjunction with the 49th IETF. Thediscussion covered the extent of current efforts, a discussion of whatquestions are being asked of DNSSEC, and what is needed by the IETF toprogress the definition to the Draft Standard level. In short, thiswas a DNSSEC status meeting. 1.0 Introduction DNSSEC [RFC 2535] hasbeen under consideration for quite a few years, with RFC 2535 beingthe core of the most recent definition. DNSSEC is part of the charterof two working groups, DNSEXT and DNSOP. ISC's BIND v8.2implemented part of the specification, BIND v9 represents the firstfull implementation. In 1999 and 2000, more than a half dozenworkshops have been held to test the concepts and the earliestversions of implementations. But to date, DNSSEC is not in common use.The current collective wisdom is that DNSSEC is 1) important, 2) abuzzword, 3) hard, 4) immature. To capture the true state of thetechnology and identify where work is needed, an informal gathering ofgroups known to be involved in DNSSEC was held in conjunction with the49th IETF. The attendees represented NLnet Labs, The Foundation forInternet Infrastructure, RIPE NCC, ARIN, CAIRN (ISI and NAI Labs),NIST, DISA, RSSAC, Network Associates and Verisign (COM/NET/ORG TLDs).The agenda of the meeting consisted of three items. Reports from eachgroup on their current research goals were followed by a discussion ofquestions being asked of DNSSEC. Finally, with reaching Draft standardstatus as a goal, what was needed to make this happen was considered.This report is not simply a transcript of the meeting, it is asummary. Some of the information presented here was obtained in directcontact with participants after the meeting. If other groups that aredoing DNSSEC research want to be represented in this document, contactthe editor for inclusion. 1.1 What does the term "DNSSEC" mean? Oneof the comments made during di ...