July 2017 - Dnssecurity-ssr2-rt

Action items: DNS SSR call 21 July
by Jennifer Bryce July 24, 2017

July 24, 2017

Hi all, Below are the action items from the DNS SSR subtopic call on Friday 21 July. Note there is now a Google doc of the topics document using the latest versions with Eric’s redline comments. I’ll give editing rights to all subteam members, please expect an invite shortly. Working DNS SSR topics list doc: https://docs.google.com/document/d/1HcwcIPhdN3Ogad0zqR7vM5IVyrio6sxCWQF7RGp… Please advise if there are any edits to the below. Action Owner Expected Delivery Date Share redline version of work topics draft to the subtopic email list. (COMPLETE) Eric 21 July Send email to subteam list to determine if 17:00 UTC Monday is a good time for recurring call. (COMPLETE) ICANN Org 24 July Team to share thoughts on work topics draft doc<https://docs.google.com/document/d/1HcwcIPhdN3Ogad0zqR7vM5IVyrio6sxCWQF7RGp…>. DNS SSR Subteam 31 July Thanks! -- Jennifer Bryce Senior Reviews Coordinator Internet Corporation for Assigned Names and Numbers (ICANN) Email: jennifer.bryce(a)icann.org Skype: jennifer.bryce.icann www.icann.org

1 0

Re: [Dnssecurity-ssr2-rt] Action Required - Please respond - Call Time Confirmation
by MSSI Secretariat July 21, 2017

July 21, 2017

Hi All - The timeslot Geoff had originally selected was Monday at 21:00 UTC and not 17:00 UTC - my apologies for the error. Would the 21:00 UTC (2pm PST / 5pm EST) reoccurring timeslot for Mondays work for everyone? Please advise. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30212.1521A630] From: Yvette Guigneaux Sent: Friday, July 21, 2017 10:54 AM To: DNSsecurity-SSR2-RT(a)icann.org Subject: Action Required - Please respond - Call Time Confirmation Hi All - Good day. The SSR2 - DNS SSR meeting call timeslot for Mondays @ 17:00 UTC was agreed upon during this first meeting as a reoccurring weekly timeslot for now this DNS SSR subtopic. Anyone have any objections? Please advise today, thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30212.1521A630]

3 3

Action Required - Please respond - Call Time Confirmation
by Yvette Guigneaux July 21, 2017

July 21, 2017

Hi All - Good day. The SSR2 - DNS SSR meeting call timeslot for Mondays @ 17:00 UTC was agreed upon during this first meeting as a reoccurring weekly timeslot for now this DNS SSR subtopic. Anyone have any objections? Please advise today, thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D3020F.996D52C0]

2 1

DNS Security - SSR2 Subtopic Call - Agenda/Materials Request
by MSSI Secretariat July 21, 2017

July 21, 2017

Hi All - Good day. We have the DNS Security - SSR2 Subtopic call on Friday, 21 July @ 17:00 UTC. Please note - this is a once-time call slot to get things rolling. In search of an agenda and/or materials for upload to the Adobe Room to make sure all is prepared in time for the call. Please advise. Geoff: I understand you are not able to make this call but I will get AC Room recording to you after the call finishes. Going forward, it has already been suggested to use the timeslot that works with your schedule, which is the Monday @ 17:00 UTC - will advise after the call discussion tomorrow on final scheduling. Thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D3017F.0D6EDCC0]

3 5

Topic List
by Geoff Huston July 21, 2017

July 21, 2017

Hi, Here is an ascii version of the proposed re-orgisation of the study topics that would fall within this area, as we discussed today. As you read this could you please bear in mind a few questions: Is this a useful structure to use to organise this activity? What is missing from this list? Is there anything here that is perhaps out of scope? Is this an achievable agenda for the study? thanks, Geoff ————————— Security and Stability of the DNS Topics The following are a set of general topic areas to underpin the study of this question. The question is predicated by scoping this topic to matters that fall with ICANN's remit. The broader consideration of the security and stability of the architecture of the DNS ecosystem, its technologies, aplicable standards, vendors, operating practices and actors doubtless intersect with ICANN's remit but the general topics are substantially larger matters and will not be considered as part of this review. The focus point here are those activities that are directed or coordinated by ICANN or the PTI, or where ICANN has a substantive presence by virtue of hosting the community-driven policy process. >>>1. Root Zone Management Practices >>>2. Change Management >>>3. Roles and Responsibilities >>>4. Abuse and Threats ------------- >>>1. Root Zone Management Practices ICANN coordinates the contents of the root zone of the public DNS system, so consideration of the security aspects of the way in which this responsibility is fulfilled is relevant to this topic. POtential sub-topics incliude: 1.1 TLD Label management (what labels go in the root zone) What guidelines and constraints govern the labels that are placed into the root zone of the DNS? How are these constraints managed? How is change control exercised over these constraints? If a proposed TLD contains non-ascii unicode characters (IDN) what procedures are followed to ensure that the label is not inherently confusable? (see SSAC084 for background) 1.2 Name Server and DS record management When a name is delegated in the root zone, the delegation is made by virtue of entering NS (and DS) records into the root zone. These records change from time to time as the authoritative name servers change, and as DNSSEC Keys change, so the subject of the delegation. Are appropriate security practices used to ensure that changes are duly authorised by the correct party prior to inclusion onto the root zone? This includes considered of whether the content of the NS and DS records be validated prior to inclusion in the root zone, and whether these records should be regularly audited to ensure their contining accuracy? 1.3 Respective roles of RSSAC and ICANN The Root Server operators serve an authoritative copy of the current root zone contents from their secondary servers. They have considerable latitude as to how the root zone is served in terms of technical aspects of their service. Is this appropriate? The finer level of detail of how each root server actually delivers content are largely undocumented, and it is unclear if this opacity and diversity serves the security and resilience of the root service or detracts from this. 1.4 Respective roles of ICANN, PTI and Verisign over root zone contents The root zone is produced as the outcome of a multi-party process, where the zone file is the result of records provided by PTI and records provided by Verisign. Is this separation of roles appropriate? Does this multi-step process introduce vulnerabilities, or do they remove potential single points of failure by having multiple parties with oversight on the root zone as it is generated? >>>2. Change Management 2.1 Introduction of new TLDs Is the phased introduction of TLDs with the root zone in a state of constant flux better or worse than a single introduction of new names in a single well advertised event? Aside from ccTLDs (below) is there any consideration of the retirement of TLDs from the root zone? 2.2 Coordination with ISO3166 or both introduction and retirement of ccTLDs What is the nature of the interaction between ISO 3166 and the root zone? Are all two letter TLDs reserved? What about Exceptionally reserved, traditionally reserved and indeterminately reserved names? Does ISO3166 provide for CC name retirement in an acceptable manner? 2.3 Coordination with IETF over Special Use Names Registry There is none at the moment! See SSAC 090 2.4 Coordination between IETF and Unicode Consortium over IDNA standards and practice See SSAC 095 for the specific case with emojis, but the general observation holds true as well. 2.5 Evolution of the Root Service Does the future security of the DNS root service rely solely on the current root server operators and the infrastructure that they operate? Should the model of distribution of root zone data evolve to include consideration of the opportunities offerred by DNSSEC, such as local root secondary servers and recursive resolvers DNSSEC NSEC caching. How can ICANN assist in these measures to assist tin scaling the root and making it more resilient to known attack vectors? 2.6 Consistency of the Identifiers The DNS resolution protocol is not the only protocol that performs a mapping from a domain name to a IP address (or other 'attached' attribute. To what extent should the ICANN community take steps to ensure that a domain name has a consistent meaning irrespect of the method of name resolution? i.e. is ICANN's remit solely concerned with domain names as resolved by the DNS protocol. Or does it extent to domain names as resolved by any protocol in the context of the public Internet? Or domain names irrespective of the name's manner and context of use? >>>3. Roles and Responsibilities 3.1 How to balance community policies, applicable standards, and SSR concerns over DNS evolution Are there checks and balances in the process are do they have a voice? To what extent do registrar contracts take account of standards? >>>4. Abuse and Threats 4.1 What are ICANN's responsibilities in this space? Notes about DNSSEC DNSSEC is the chosen mechanism to support security in the DNS, in so far that the resolution process itself is not protected, but the result can be validated to assure the client that the resolution response is genuine and complete. Being such a central part of DNS Security in general, should it be a topic of study in this sub-topic? DNSSEC is largely under the control of the IETF as a piece of technology. If a party wants to alter the operation of DNSSEC or any other aspect of the way in which its operation if defined then the IETF is the place to undertake such a conversation. This implies that such technical aspects are beyond ICANN's remit. DNSSEC, as seen by ICANN, is firstly a set of DS delegation records, similar in almost every respect to NS records. There are some operational questions in this process, noted in section 1.2. Secondly, DNSSEC is a root zone signing operation. This area includes the management of the KSK key which appears to fall under the subtopic of ICANN operations as it not a generic DNS topic. The question of the choice of protocol and key length and the scheduling of periodic KSK rolls appears to also be an ICANN operational topic rather than a generic DNS stability issues.

4 5

Action Required - Please respond - Doodle Poll - DNS Security Subtopic times
by MSSI Secretariat July 20, 2017

July 20, 2017

Hi All - Good day. For the doodle poll, it appears the Friday @ 17:00 UTC was the most popular timeslot selected from the graph below, however it looks as if not all members including the rapporteur cannot make that time. How would you all like to proceed? Would you prefer to book the Friday @ 1700 timeslot each week of do you wish to book the Monday @ 2100 UTC slot which has fewer participants but would include the Rapporteur? Please advise and thank you. [cid:image002.jpg@01D30126.17982BB0] Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30125.17797590] From: MSSI Secretariat Sent: Tuesday, July 18, 2017 1:01 PM To: DNSsecurity-SSR2-RT(a)icann.org Subject: RE: [Dnssecurity-ssr2-rt] Doodle Poll - DNS Security Subtopic times - Please respond Hi All - reminder this doodle poll below closes Wednesday, 19 July @ 19:00 UTC - if you have not responded please do so, thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D30125.17797590] From: dnssecurity-ssr2-rt-bounces(a)icann.org<mailto:dnssecurity-ssr2-rt-bounces@icann.org> [mailto:dnssecurity-ssr2-rt-bounces@icann.org] On Behalf Of MSSI Secretariat Sent: Monday, July 17, 2017 4:26 PM To: DNSsecurity-SSR2-RT(a)icann.org<mailto:DNSsecurity-SSR2-RT@icann.org> Subject: [Dnssecurity-ssr2-rt] Doodle Poll - DNS Security Subtopic times - Please respond Hi All - Good day everyone. Here is a doodle poll with more European friendly UTC times for DNS Security - SSR2 Subtopic - choice of days are Thursday, Friday & Monday - please select from the poll below which times work for you. Doodle poll will close Wednesday, 19 July @ 19:00 UTC - thank you! http://doodle.com/poll/wdibhhz3ikm755g7[doodle.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__doodle.com_poll_wdibhhz…> Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org[icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMFAg…> [cid:image001.png@01D30125.17797590]

6 5

Re: [Dnssecurity-ssr2-rt] Doodle Poll - DNS Security Subtopic times - Please respond
by MSSI Secretariat July 18, 2017

July 18, 2017

Hi All - reminder this doodle poll below closes Wednesday, 19 July @ 19:00 UTC - if you have not responded please do so, thank you! Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FFC5.BA027890] From: dnssecurity-ssr2-rt-bounces(a)icann.org [mailto:dnssecurity-ssr2-rt-bounces@icann.org] On Behalf Of MSSI Secretariat Sent: Monday, July 17, 2017 4:26 PM To: DNSsecurity-SSR2-RT(a)icann.org Subject: [Dnssecurity-ssr2-rt] Doodle Poll - DNS Security Subtopic times - Please respond Hi All - Good day everyone. Here is a doodle poll with more European friendly UTC times for DNS Security - SSR2 Subtopic - choice of days are Thursday, Friday & Monday - please select from the poll below which times work for you. Doodle poll will close Wednesday, 19 July @ 19:00 UTC - thank you! http://doodle.com/poll/wdibhhz3ikm755g7[doodle.com]<https://urldefense.proofpoint.com/v2/url?u=http-3A__doodle.com_poll_wdibhhz…> Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org[icann.org]<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.icann.org_&d=DwMFAg…> [cid:image001.png@01D2FFC5.BA027890]

1 0

Doodle Poll - DNS Security Subtopic times - Please respond
by MSSI Secretariat July 17, 2017

July 17, 2017

Hi All - Good day everyone. Here is a doodle poll with more European friendly UTC times for DNS Security - SSR2 Subtopic - choice of days are Thursday, Friday & Monday - please select from the poll below which times work for you. Doodle poll will close Wednesday, 19 July @ 19:00 UTC - thank you! http://doodle.com/poll/wdibhhz3ikm755g7 Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FF13.C4C768B0]

1 0

Re: [Dnssecurity-ssr2-rt] Doodle Poll - please respond
by MSSI Secretariat July 17, 2017

July 17, 2017

Hi All -please note this doodle poll below has been cancelled - a new one will be sent out shortly, thank you. Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FF04.E4215EF0] From: MSSI Secretariat Sent: Monday, July 17, 2017 11:12 AM To: DNSsecurity-SSR2-RT(a)icann.org Subject: Doodle Poll - please respond Hi All - Good day - please confirm your availability below for Monday, 17 July 2017 @ 23:59 UTC. Please respond today, thank you. http://doodle.com/poll/fwnim359hvhst2a9 Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org<mailto:yvette.guigneaux@icann.org> Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FF04.E4215EF0]

1 0

Doodle Poll - please respond
by MSSI Secretariat July 17, 2017

July 17, 2017

Hi All - Good day - please confirm your availability below for Monday, 17 July 2017 @ 23:59 UTC. Please respond today, thank you. http://doodle.com/poll/fwnim359hvhst2a9 Kind Regards, Yvette Guigneaux (MSSI) Multistakeholder Strategy & Strategic Initiatives Projects & Operations Assistant. ICANN - Internet Corporation for Assigned Names and Numbers Email: yvette.guigneaux(a)icann.org Cell: +1-310-460-8432 Skype: yvette.guigneaux.icann www.icann.org<http://www.icann.org/> [cid:image001.png@01D2FEED.8F6EC030]

1 0