- gtld-tech - lists.icann.org

Call for Participation -- ICANN DNSSEC Workshop at ICANN60 in Abu Dhabi, UAE
by Jacques Latour Aug. 23, 2017

Aug. 23, 2017

Call for Participation -- ICANN DNSSEC Workshop at ICANN60 in Abu Dhabi, UAE The DNSSEC Deployment Initiative and the Internet Society Deploy360 Programme, in cooperation with the ICANN Security and Stability Advisory Committee (SSAC), are planning a DNSSEC Workshop during the ICANN60 meeting held from 01 November 2017 in Abu Dhabi, UAE tentatively from 0900-1500 local time. The DNSSEC Workshop has been a part of ICANN meetings for several years and has provided a forum for both experienced and new people to meet, present and discuss current and future DNSSEC deployments. For reference, the most recent session was held at the ICANN Policy Forum in Johannesburg, South Africa. The presentations and transcripts are available at: https://schedule.icann.org/event/B3zi/dnssec-workshop[schedule.icann.org]<https://urldefense.proofpoint.com/v2/url?u=https-3A__schedule.icann.org_eve…>. At ICANN60 we are particularly interested in live demonstrations of uses of DNSSEC or DANE. Examples might include: * Innovative uses of APIs to do something new and different using DNSSEC/DANE. * Email clients and servers using DNSSEC, OPENPGPKEY, or S/MIME for secure email. * DNSSEC automation and deployment using CDS, CDNSKey, and CSYNC. * DNSSEC signing solutions and innovation. * Tools for automating the generation of DNSSEC/DANE records. * Services for monitoring or managing DNSSEC signing or validation. * Tools or services for using DNSSEC/DANE along with other existing protocols and services such as SSH, XMPP, SMTP, S/MIME or PGP/GPG. Our interest is to provide current examples of the state of development and to show real-world examples of how DNSSEC and DANE related innovation can be used to increase the overall security of the Internet. We are open to presentations and demonstrations related to any topic associated with DNSSEC and DANE. Examples of the types of topics we are seeking include: 1. DNSSEC activities in the Middle East Region For this panel we are seeking participation from those who have been involved in DNSSEC deployment in the region and also from those who have not deployed DNSSEC but who have a keen interest in the challenges and benefits of deployment. In particular, we will consider the following questions: Are you interested in reporting on DNSSEC validation of your ISPs? What can DNSSEC do for you? What doesn't it do? What are the internal tradeoffs to implementing DNSSEC? What did you learn in your deployment of DNSSEC? We are interested in presentations from both people involved with the signing of domains and people involved with the deployment of DNSSEC-validating DNS resolvers. 2. Impact and Results of Root Key Rollover Following the Root Key Rollover, we would like to bring together a panel of people who can talk about the impacts to ISPs, equipment providers and end users, and also what was done to mitigate those issues. In particular, we are seeking participation from vendors, ISPs, and the community that may have been affected by distribution of new root keys. you have a specific concern about the Root Key Rollover we would like to hear from you. 3. Implementing next generation DNSSEC signing at Registries and DNS Operators Now that DNSSEC technology has matured many Registries and DNS Operators have upgraded their legacy DNSSEC signing services with innovative solutions. * Real world use cases of HSMs and key management. * Signing at the edge We would be interested in seeing presentations or demonstrations on those topics. 4. The operational realities of running DNSSEC Now that DNSSEC has become an operational norm for many registries, registrars, and ISPs, what have we learned about how we manage DNSSEC? What is the best practice around your local key rollovers? How often do you review your disaster recovery procedures? Is there operational familiarity within your customer support teams? What operational statistics have we gathered about DNSSEC? Are there experiences being documented in the form of best practices, or something similar, for transfer of signed zones? 5. DANE and DNSSEC application automation For DNSSEC to reach massive deployment levels it is clear that a higher level of automation is required than is currently available. There also is strong interest for DANE usage within web transactions as well as for securing email and Voice-over-IP (VoIP). We are seeking presentations on topics such as: * How can the industry use DANE and other DNSSEC applications as a mechanism for creating a more secure Internet? * What tools, systems and services are available to help automate DNSSEC key management? * Can you provide an analysis of current tools/services and identify gaps? * What are some of the new and innovative uses of DANE and other DNSSEC applications in new areas or industries? * What tools and services are now available that can support DANE usage? We would be particularly interested in any live demonstrations of DNSSEC / DANE application automation and services. Demonstrations of new tools that make the setup of DNSSEC or DANE more automated would also be welcome. 6. DNSSEC and DANE in the enterprise and in the enterprise tool set Enterprises and enterprise software can play a critical role in both providing DNSSEC validation to their internal networks and also through signing of the domains owned by the enterprise. We are seeking presentations from enterprises and enterprise software providers that have implemented DNSSEC on validation and/or signing processes and can address questions such as: * What enterprise software support or plan do you have to support DNSSEC? * What are the benefits to enterprises of rolling out DNSSEC validation? And how do they do so? * What are the challenges to deployment for these organizations and how could DANE and other DNSSEC applications address those challenges? * How should an enterprise best prepare its IT staff and network to implement DNSSEC? * What enterprise tools and systems are available to assist enterprises in the deployment of DNSSEC? * How can the DANE protocol be used within an enterprise to bring a higher level of security to transactions using SSL/TLS certificates? 7. Implementing DNSSEC validation at Internet Service Providers (ISPs) Internet Service Providers (ISPs) play a critical role by enabling DNSSEC validation for the caching DNS resolvers used by their customers. We have now seen massive rollouts of DNSSEC validation within large North American ISPs and at ISPs around the world. We are interested in presentations on topics such as: * Can you describe your experiences with negative Trust Anchors and operational realities? * What does an ISP need to do to prepare its network for implementing DNSSEC validation? * How does an ISP need to prepare its support staff and technical staff for the rollout of DNSSEC validation? * Can you provide results and/or impacts of the impact of root key rollover? * What rollover technique do you use, i.e., RFC 5011 or other? In addition, we welcome suggestions for additional topics. If you are interested in participating, please send a brief (1-2 sentence) description of your proposed presentation to dnssec-abudhabi(a)isoc.org<mailto:dnssec-abudhabi@isoc.org> by **08 September 2017** We hope that you can join us. Thank you, Julie Hedlund On behalf of the DNSSEC Workshop Program Committee: Jean Robert Hountomey, AfricaCERT Jacques Latour, .CA Xiaodong Lee, CNNIC Russ Mundy, Parsons Ondřej Filip, CZ.NIC Yoshiro Yoneya, JPRS Dan York, Internet Society Mark Elkins, DNS/ZACR

1 0

2nd Call for Presentation TechDay Hyderabad ICANN57
by Dr Eberhard W Lisse June 17, 2017

June 17, 2017

Hi, we have still one or two 20 minute spots open, so feel free. greetings, el On 2016-09-01 19:10, Jacques Latour wrote: > Call for Presentations > > TechDay > > at ICANN 57 > > in Hyderabad > > > > The ICANN Tech Working Group is again planning a technical workshop at > the ICANN 57 meeting on 2016-11-05 in Hyderabad, India. > > > > The TechDay Workshop has been a part of ICANN meetings for several > years and has provided a forum for both experienced and new people to > meet, present and discuss technical topics related to registry and DNS > work and security. > > > > For reference, the most recent session was held at the ICANN meeting > in Helsinki, Finland 2016-06-27. > > > > We are specially interested in: > > > > 1. Registration Information Accuracy > > > > We remain interested in presentations relating to registry contact > data cleanup, address validation, malicious registration data > verification, batch and/or real-time validation. > > > > We would like, in particular, to see solutions leveraging Open Source, > Open Data or Open Research in order to make them available to a wider > audience. > > > > 2. IDN > > > > We would like to hear about initiatives with regards to IDN. > > > > 3. In addition, we welcome suggestions for additional topics, such > as; > > > > * Registry services and systems > > * Big Data & associated data analysis > > * IETF DNS protocol updates > > * Registry security > > > > > > If you are interested in participating, please email one or all of > > > > el(a)lisse.NA > ondrej.filip(a)nic.cz > jacques.latour(a)cira.ca > kimberly.carlson(a)icann.org > > > > We hope that you can join us and request that you disseminate this > Request to other lists where it might of of interest. > > > Jacques -- Dr. Eberhard W. Lisse \ / Obstetrician & Gynaecologist (Saar) el(a)lisse.NA / * | Telephone: +264 81 124 6733 (cell) PO Box 8421 \ / Bachbrecht, Namibia ;____/

1 14

Fwd: Call for Trusted Community Representatives
by Francisco Arias May 22, 2017

May 22, 2017

FYI ---------- Forwarded message ---------- From: Kim Davies <kim.davies(a)iana.org<mailto:kim.davies@iana.org>> Date: Thu, May 18, 2017 at 2:36 PM Subject: Call for Trusted Community Representatives To: root-dnssec-announce(a)icann.org<mailto:root-dnssec-announce@icann.org> We are seeking interested individuals who wish to act as Trusted Community Representatives (TCRs). These individuals play an important role in managing the Root Zone Key Signing Key (KSK), the trust anchor for the global Domain Name System (DNS). By inviting recognized members of the DNS technical community to be part of the Root Zone KSK operations, the ICANN organization seeks to improve transparency and confidence in the Domain Name System Security Extensions (DNSSEC) security mechanism among the wider Internet community. About the TCR Role ------------------ TCRs serve as one of the multi-layered safeguards that protect the key material used to secure the DNS Root Zone. There are two primary types of TCRs: cryptographic officers, who are actively involved in Root Zone KSK ceremonies conducted throughout the year; and recovery key share holders, who are involved in our disaster recovery planning. The cryptographic officers make a commitment to travel to a least one Root Zone KSK ceremony per year. All TCRs maintain custody of essential pieces required for the successful operation of the Root Zone KSK. To guard against unauthorized access, management of the KSK is spread across multiple individuals who must come together to operate the key. TCRs are ambassadors on behalf of the broader technical and operational communities. To support trust in the system, TCRs report back to the community that the Root Zone KSK is being managed in an appropriate and trustworthy way. All TCRs need to maintain a state of readiness should there be an unforeseen need to hold a ceremony at short notice. Travel support is provided to TCRs who need to attend ceremonies. This support includes arranging and paying for airfare and accommodation, and providing a stipend for incidental costs. More Information ---------------- Those who are interested in applying to be a TCR are invited to review detailed materials posted on the IANA website, which includes the process to submit a statement of interest. Statements of interest will be collected and assessed to fill current vacancies, and in the event of new vacancies. Visit here: https://iana.org/tcr Kim Davies Director, Technical Services _______________________________________________ root-dnssec-announce mailing list root-dnssec-announce(a)icann.org<mailto:root-dnssec-announce@icann.org> https://mm.icann.org/mailman/listinfo/root-dnssec-announce

1 0

Re: [gtld-tech] ICANN monitoring system API
by Michele Neylon - Blacknight May 13, 2017

May 13, 2017

Speaking of IPs .. Ideally being able to provide blocks, rather than lists of IPs .. -- Mr Michele Neylon Blacknight Solutions Hosting, Colocation & Domains https://www.blacknight.com/ http://blacknight.blog/ Intl. +353 (0) 59 9183072 Direct Dial: +353 (0)59 9183090 Personal blog: https://michele.blog/ Some thoughts: https://ceo.hosting/ ------------------------------- Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty Road,Graiguecullen,Carlow,R93 X265,Ireland Company No.: 370845 From: <gtld-tech-bounces(a)icann.org> on behalf of Scott Hollenbeck <shollenbeck(a)verisign.com> Date: Friday 17 February 2017 at 13:05 To: "'gustavo.lozano(a)icann.org'" <gustavo.lozano(a)icann.org>, "'gtld-tech(a)icann.org'" <gtld-tech(a)icann.org> Subject: Re: [gtld-tech] ICANN monitoring system API Thanks for the opportunity to provide comments, Gustavo. It would be helpful to add more introductory text (perhaps in a section titled something like “Operational Assumptions”) to explicitly note several implied functional points. Here are a few that I found: In Section 3, the document says that HTTP Basic authentication is used. Without additional information, that means that credentials are exchanged in plaintext form. Encryption service is hidden in the description of the base URL mentioned in Section 2. I think it would be helpful to note somewhere that TLS protection is required, and that the credentials are protected using TLS. Have you thought about using TLS with mutual authentication of both clients and servers? That would add an extra layer of protection to ensure that only authorized clients have access to TLD-specific data. It would also be helpful to explicitly state that login credentials are provided by ICANN (how are they requested and delivered?), or at least provide a link to some other document that explains the process. It would also be helpful to note that the client must provide (how?) ICANN with a list of IP addresses to be added to a per-TLD white list. Are both IPv4 and IPv6 addresses acceptable? If not, why? Scott From: gtld-tech-bounces(a)icann.org [mailto:gtld-tech-bounces@icann.org] On Behalf Of Gustavo Lozano Sent: Saturday, February 11, 2017 12:17 AM To: gtld-tech(a)icann.org Subject: [EXTERNAL] [gtld-tech] ICANN monitoring system API Hello Colleagues, Specification 10 of the base registry agreement (https://newgtlds.icann.org/sites/default/files/agreements/agreement-approve…) describes the Service Level Requirements and emergency thresholds that a Registry Operator has to comply related to the Registry Services. ICANN has been monitoring compliance of new gTLDs following the algorithms defined in this specification. ICANN provides access to Registry Operators to the incident information of its TLDs through an API currently in beta, and we are planning on releasing the production version in the future. The Registry Operators using the beta API had provided valuable feedback, and the specification to be implemented in the production version has been modified accordingly. Attached you will find the latest draft of this specification. I appreciate your feedback no later than February 24, 2017. Regards, Gustavo

9 13

[부재안내] 4.26(수) ~ 5.10(수) 부재중 입니다.
by hjpaik＠kisa.or.kr May 3, 2017

May 3, 2017

1 0

FW: 6th Registration Operations Workshop
by Hollenbeck, Scott May 3, 2017

May 3, 2017

Cross-posting at the request of the workshop program committee… Scott From: regops [mailto:regops-bounces@nlnetlabs.nl] On Behalf Of Nicoleta Munteanu Sent: Tuesday, May 02, 2017 3:20 AM To: regops(a)nlnetlabs.nl Subject: [EXTERNAL] [Regops] 6th Registration Operations Workshop The upcoming Registration Operations Workshop<http://regiops.net/> (ROW#6) is scheduled to take place in Madrid, on Friday 12 May 2017, from 1.30pm to 5.30pm, at the NH Collection Madrid Eurobuilding Hotel<http://regiops.net/?location=hotel-nh-madrid-eurobuilding>. The session may be accessed via remote participation and links will be posted as soon as available. The agenda for the workshop includes the following: • RDAP implementation in the gTLD space - Francisco Arias [ICANN] • RDAP extension proposals for Federated Authentication, Object Tagging, and Regular Expression Searching - Scott Hollenbeck [Verisign] • The Impact of ICANN SLA Monitoring on gTLD Whois Services - Gavin Brown [CentralNic] • Contact Object Management by Registrars - Gavin Brown [CentralNic] • Syncing Delegation information from DNS operator - Ólafur Guðmundsson [CloudFlare] & Pascal Bouchareine [Gandi] • Extending RDAP query parameters to enable result sorting and paging - Mario Loffredo, Maurizio Martinelli [IIT-CNR/Registro.it<http://registro.it/>] • RDAP Test Suite - Marc Blanchet [Viagenie] If interested in topics being discussed, with the workshop taking place immediately after the ICANN GDD Industry Summit<https://www.icann.org/gddsummit> (9-11 May) and prior to ICANN DNS Symposium<https://www.icann.org/ids> (13 May) and OARC 26<https://indico.dns-oarc.net/event/26/overview> (14-15 May), please consider extending your trip to attend it. The event is open to all interested industry members, including domain name registrars, gTLDs, ccTLDs, registries, resellers and second level domain registries. We kindly ask you to register in advance at: http://regiops.net/?event=registration-operations-workshop-12-may-2017-hote… For other event details and updates please visit the ROW website at http://regiops.net<http://regiops.net/>. We look forward to seeing you in Madrid! The Program Committee (cross-posting to multiple lists - sorry for any duplicates)

1 0

FW: ROW#6: May 12th, 2017 - Madrid
by Hollenbeck, Scott April 24, 2017

April 24, 2017

I’m cross-posting this note at the request of the workshop program committee. Please note that it follows the GDD Summit, so if you happen to be in Madrid it might be worth extending your trip by another day. Scott From: regops [mailto:regops-bounces@nlnetlabs.nl] On Behalf Of Nicoleta Munteanu Sent: Friday, April 21, 2017 2:25 PM To: regops(a)nlnetlabs.nl Subject: [EXTERNAL] [Regops] ROW#6: May 12th, 2017 - Madrid Dear Colleagues, The next Registration Operations Workshop will take place in Madrid, May 12th. Sign up to meet and discuss with your compeers. See Marc Blanchet’s recent blog post for details about the session: "6th Registration Operations Workshop (ROW), Madrid, Friday May 12th 2017<http://www.circleid.com/posts/20170420_6th_registration_operations_workshop…>" We look forward to seeing you in Madrid! The Program Committee http://regiops.net

1 0

FW: Register for ROW#6 - Madrid
by Hollenbeck, Scott March 15, 2017

March 15, 2017

This may be of interest to list members who plan to attend the GDD Summit in May. Scott From: regops [mailto:regops-bounces@nlnetlabs.nl] On Behalf Of Nicoleta Munteanu Sent: Wednesday, March 15, 2017 11:15 AM To: regops(a)nlnetlabs.nl Subject: [EXTERNAL] [Regops] Register for ROW#6 - Madrid With a focus on the Registration Data Access Protocol, the 6th session of the Registration Operations Workshop (ROW) is scheduled to take place in Madrid, on Friday 12 May 2017. To further bring existing communities of interest together, the workshop will be co-located with the events listed below and will take place at the same venue as all the other events: Hotel NH Collection Madrid Eurobuilding, Calle de Padre Damián, 23, 28036 Madrid, Spain. - 9-11 May: ICANN GDD Industry Summit<https://www.icann.org/gddsummit> - 12 May: The 6th Registration Operations Workshop<http://regiops.net> - 13 May: ICANN DNS Symposium<https://www.icann.org/ids> - 14-15 May: OARC 26 (DNS-OARC Workshop)<https://indico.dns-oarc.net/event/26/overview> ROW#6 registration is now open at: http://regiops.net/?page_id=184. The program is being finalized. However, we still have some open presentation slots available; proposals can be submitted to the Program Committee at row(a)viagenie.ca<mailto:row@viagenie.ca> or during the registration process. For other event details and updates please visit the ROW website at http://regiops.net. We look forward to seeing you in Madrid! The Program Committee (cross-posting to multiple lists - sorry for any duplicates)

1 0

ICANN monitoring system API
by Gustavo Lozano Feb. 17, 2017

Feb. 17, 2017

Hello Colleagues, Specification 10 of the base registry agreement (https://newgtlds.icann.org/sites/default/files/agreements/agreement-approve…) describes the Service Level Requirements and emergency thresholds that a Registry Operator has to comply related to the Registry Services. ICANN has been monitoring compliance of new gTLDs following the algorithms defined in this specification. ICANN provides access to Registry Operators to the incident information of its TLDs through an API currently in beta, and we are planning on releasing the production version in the future. The Registry Operators using the beta API had provided valuable feedback, and the specification to be implemented in the production version has been modified accordingly. Attached you will find the latest draft of this specification. I appreciate your feedback no later than February 24, 2017. Regards, Gustavo

2 1

Re: [gtld-tech] Web-based WHOIS, https, redirects
by Francisco Arias Feb. 14, 2017

Feb. 14, 2017

Hi Alex, I'm not aware of any specific requirements on this regard. As such, both HTTP and HTTPS should be accepted. Regards, -- Francisco On 2/14/17, 2:00 AM, "gtld-tech-bounces(a)icann.org on behalf of Alexander Mayrhofer" <gtld-tech-bounces(a)icann.org on behalf of alexander.mayrhofer(a)nic.at> wrote: Specifically, would ICANN allow a redirect from http: (port 80) to https: (port 443)?

1 0