Domain Name System Security (dnssec) 




Charter



Status: Concluded December, 1999 







Chair(s):







 James Galvin 







Description of Working Group:



The Domain Name System Security Working Group (DNSSEC) will ensure



enhancements to the secure DNS protocol to protect the dynamic update



operation of the DNS. Specifically, it must be possible to detect the



replay of update transactions and it must be possible to order update



transactions. Clock synchronization should be addressed as well as all



of the dynamic update specification.







Some of the issues to be explored and resolved include







o scope of creation, deletion, and updates for both names and zones







o protection of names subject to dynamic update during zone transfer







o scope of KEY resource record for more specific names in wildcard



  scope







o use of or relationship with proposed expiration resource record







One essential assumption has been identified: data in the DNS is



considered public information. This assumption means that discussions



and proposals involving data confidentiality and access control are



explicitly outside the scope of this working group.

Request for Comments:

  • RFC2065 Domain Name System Security Extensions (Proposed Standard)
  • RFC2137 Secure Domain Name System Dynamic Update (Proposed Standard)
  • RFC2535 Domain Name System Security Extensions (Proposed Standard)
  • RFC2536 DSA KEYs and SIGs in the Domain Name System (DNS) (Proposed Standard)
  • RFC2537 RSA/MD5 KEYs and SIGs in the Domain Name System (DNS) (Proposed Standard)
  • RFC2538 Storing Certificates in the Domain Name System (DNS) (Proposed Standard)
  • RFC2539 Storage of Diffie-Hellman Keys in the Domain Name System (DNS) (Proposed Standard)
  • RFC2540 Detached Domain Name System (DNS) Information (Experimental)
  • RFC2541 DNS Operational Security Considerations (Informational)