OARC 2014 Fall Workshop (Los Angeles)

11 Oct 2014, 13:00 → 13 Oct 2014, 17:50 US/Pacific

Westside (Hyatt Regency Century Plaza)

Eberhard Wolfgang Lisse (Namibian Network Information Centre), Keith Mitchell (DNS-OARC), Sebastian Castro (.nz Registry Services)

OARC's Fall 2014 Workshop and AGM will take place in Los Angeles, California, in conjunction with the ICANN51 meeting, and is sponsored by:

Diamond and Social Sponsor

Meeting Host

Silver Sponsor

Bronze Sponsor

The OARC AGM and member-only session will be held on Saturday 11th October, the main workshop on Sunday 12th, and a joint session with ICANN's Tech Day on Monday 13th.

OARC Workshop meetings are open to OARC members and to all other parties interested in DNS operations and research, with ICANN attendees particularly welcome this time around. Meeting registration is free, with priority given to OARC Members, Speakers and Sponsors in the event of limited space, or please consider donating some funds toward the Workshop running costs at this Donation Link.

Webcast Audio Archive

• Morning session
• Afternoon session

Remote participation of this meeting is being supported by ICANN:

• Adobe Connect Link:https://icann.adobeconnect.com/lax51-westside
• Audio (English): http://stream.icann.org:8000/lax51-westside-en.m3u
• Jabber: xmpp://dns-operations@conference.dns-oarc.net

Our agenda is now full and all submissions are closed at this point.

If your organization is interested in sponsoring this workshop, please see our Sponsor Benefits or e-mail sponsor@dns-oarc.net for more information.

OARC has arranged for attendee accommodation at the nearby Beverly Hills Crowne Plaza.

Please also see the ICANN51 Meeting Site for further venue/travel details.

Accomodation Information Accommodation Booking

AGM Documents

• 2013 AGM Minutes
• 2013 Financial Statements
• 2014 EGM Minutes
• AGM Board Proceedings
• AGM Elections Results
• AGM-Member-resolutions.pdf
• Participation Agreement Changes
• Proxy Form
• Restated Bylaws
• Revised Participation Agreement

Saturday, 11 October

13:00 → 17:50 Saturday Members-only/AGM

Conveners: Mr Keith Mitchell (DNS-OARC), Mr Ondrej Filip (CZ.NIC)

13:00 Member Lunch, Registration

14:00 Introduction from OARC Chairman

Speaker: Mr Ondrej Filip (CZ.NIC)

14:15 OARC President's Report

Speaker: Mr Keith Mitchell (DNS-OARC)

Slides OARC President's Report OARC President's Report

14:45 OARC Treasurer's Report

Speaker: Matthew Pounsett (Rightside)

Paper Auditor-report-summary.pdf

Slides OARC-Treasurer.pdf

15:00 Coffee Break

15:30 Revised OARC Participation Agreement

AGM Documents https://indico.dns-oarc.net//getFile.py/access?resId=4&materialId=0&confId=20

16:15 OARC Board Elections

Web Page https://www.dns-oarc.net/oarc/agm-2014/elections

17:00 SECIR Trust Platform Support

Speaker: Jacques Latour (CIRA)

Slides https://portal.dns-oarc.net/cgi-bin/file_download.pl?type=application/pdf;%20charset=binary;name=/meeting-201410/LaTour-SECIR.pdf

17:15 Bumblebee Demonstration

This demonstration-based talk will cover various results of Nominet's analytics efforts over the last four years. The talk will discuss various incidents, misconfigurations, bugs, attacks and malware behaviour we have uncovered by visualizing and interacting with DNS data. I’ll go through a few stories: 1) The limitations we had using existing tools, and the requirements we had when building our analytics tool. 2) How we found CVE-2011-2464 (BIND bug) by understanding how a secondary nameserver should behave, and subsequently looking for abnormalities. 3) How we spot suspicious behaviour and subsequently track a botnet. 4) How we spot abnormal behaviour and subsequently track crypto locker. 5) How two bugs in different implementations amplify eachother. A story about Google and BIND. 6) The effect of RRL during an attack. 7) How OpenDNS improved on their shutter time. 8) The importance of interaction _and_ visualisation (and as a natural consequence, timeliness).

Speaker: Roy Arends (Nominet)

20:00 → 23:00 Evening Social

Sunday, 12 October

09:00 → 17:50 Sunday Workshop (Public)

Convener: Mr Sebastian Castro (.nz Registry Services)

Audio Archive Afternoon Session Morning Session

09:00 Analysis of TCP traffic in DITL data

The historical archive of DITL data is analyzed for trends in TCP traffic, answering some of the following questions: are TCP sources representative of UDP sources? Does TCP always follow a UDP TC=1 response? Do TCP and UDP sources have similar query type distributions? Are response sizes increasing over time, leading to more TCP? What do TCP connections indicate regarding latency?

Speaker: Duane Wessels (Verisign)

Slides rtt_Oarc_ThomasWessels_v1.pdf

09:30 DNS Name Collision Risk Mitigation

Starting August 2014, new gTLDs have been required to insert certain records in their DNS zone to manage name collision risks. This presentation provides a description of the mitigation measures and operational experiences regarding the management of risks related to name collisions in the DNS associated with the introduction of new TLDs.

Speaker: Francisco Arias (ICANN)

Slides PDF Version PPT version

10:00 A country level Analysis of the OARC DITL root traces 2009-2014

I would like to present an analysis of a country level breakdown of the DNS traffic captured by the OARC members on the DITL traces between 2009 and 2014.

Speaker: Bradley Huffaker (CAIDA/UCSD)

Slides dns-country.pdf

10:20 2014 Root DITL Data analysis and TLD popularity analysis

The presentation reports statistics of 2014 DITL root dataset and differences from previous data. And tries to show popularities of each TLD. The data may show the share of usage of TLDs in each country.

Speaker: Mr Kazunori Fujiwara (Japan Registry Services Co., Ltd)

Slides fujiwara-201410120205.pdf

10:40 Coffee Break

11:00 Measuring the cost of DNSSEC

The presentation provides some measurements on the incremental cost of signing a domain name. It looks at the profile of additional time taken to resolve a signed name by a dnssec-validating resolver and from the perspective of the authoritative name server quantifies the additional query and traffic load when serving a signed zone as distinct from an unsigned zone. The presentation also extrapolates this load to the situation when all resolvers perform DNSSEC-validation

Speaker: Mr Geoff Huston (APNIC)

Slides 2014-10-11-DNSOARC-measure.pdf Alternative presentation about ECC

11:30 OARC's Technical Report

Report from William Sotomayor about the work being done by OARC Technical team since last workshop.

Speaker: Mr William Sotomayor (DNS-OARC)

Slides 201410_OARC_Systems_Update.pdf

12:00 Improved NSEC3 performance in DNSSEC

A challenge in DNSSEC is that the ‘NSEC3’ records used to assert the non-existence of a given domain name can create a significant computational load on the DNS servers. This document describes an application of a cryptographic technique known as a ‘time-lock puzzle’ to the calculation of NSEC3 records. This provides a means of reducing this load whilst simultaneously increasing the security against DNS record enumeration offered by NSEC3.

Speaker: Dr Jonathan Tuliani Tuliani (Microsoft)

Slides pdf PowerPoint

12:30 Lunch Break

13:00 PGP Signing Session

Speaker: Matthew Pounsett (Rightside)

notes signing_keychain.asc

13:30 Reputation Metrics Design to Improve Intermediary Incentives for Security of TLDs

In this presentation, we describe security metrics for Top-Level Domains (TLDs) and we measure their operational values using DNS query data and other data sources such as botnet and phishing feeds. They can serve as publicly available signals to different classes intermediaries such as registries, registrars, or hosting providers and can offer the option to benchmark themselves against their market. There currently exists very little empirical information about the security performance of TLDs and of the overall DNS ecosystem. We distinguish three types of security metrics, each at a different layer of ab- straction. The top-layer involves the security metrics of an entire TLD such as .nl, .com, or .amsterdam. The second layer of abstraction consists of security metrics for market players under TLDs. These are Internet infrastructure providers, registries, registrars, and hosting providers. Examples of security metrics at this layer include concentration of malicious domains across players and their up-times. The third layer is a break-down of the second layer and involves security metrics for network resources managed by each of the players, such as DNS resolvers, or authoritative name servers. In this presentation, we pay a special attention to the second layer and we develop reputation metrics for registries, registrars, and hosting providers with the respect to the TLD layer. In our future work, we plan to correlate the abuse rate reflected in the here-proposed reputation metrics with registry policy, such as pricing, the correctness of the whois data, security monitoring of the DNS infrastructure, etc.

Speaker: Dr Maciej Korczynski (Delft University of Technology)

Slides REMEDI3_Maciej_Korczynski.pdf (Protected)

14:00 A Survey of Current DANE/TLSA Deployment

As adoption of DNS Security Extensions (DNSSEC) grows, DNS-based Authentication of Named Entities (DANE) provides an alternative to traditional CA-based certificate authentication. The DANE TLSA protocol specification was published in 2012. It's generally unknown to the DNS community how widely DANE TLSA has been deployed and how TLSA records are used. In this talk, we present a survey of current deployment of DANE TLSA. We developed PryDane, a tool for actively probing names possibly having TLSA records validating those records with the server certificates. Based on the data we collected, we conclude that DANE TLSA is not widely deployed at this time. Our probing data shows the most common (>80%) usage of TLSA record is: domain-issued cert matching full cert with SHA-256. Our validation results show there are consistently about 7%-10% of DANE-enabled names having invalid TLSA records. We explored the reasons for these mismatches, such as wrong certs and incorrect parameters in TLSA records.

Speaker: Liang Zhu (USC/Information Sciences Institute)

Slides dane_tlsa_survey.pdf dane_tlsa_survey.pptx

14:20 Preserving case-sensitivity in zone names

In early 2014 a BIND user encountered a problem with some SIP phones, that turned out to be due to the fact that, while compressing zone updates, we were not preserving case-sensitivity. We determined that CamelCasing is allowed, and thus case should be preserved by IETF specification. We then consulted with a number of operating system publishers and agreed on a solution. This brief presentation will explain how BIND handles this situation and introduce others to the issue.

Speaker: victoria risk (isc)

Slides ISC-case-sensitivity.pdf

14:40 NSEC5: Provably Preventing DNSSEC Zone Enumeration

DNSSEC is designed to prevent network attackers from tampering with domain name system (DNS) messages. The cryptographic machinery used in DNSSEC, however, also creates a new vulnerability--zone enumeration, where an adversary launches a small number of online DNSSEC queries and then uses offline dictionary attacks to learn which domain names are present or absent in a DNS zone. We propose a new cryptographic construction that solves the problem of DNSSEC zone enumeration while remaining faithful to the operational realities of DNSSEC. NSEC5 can be thought of as a variant of NSEC3 in which the unkeyed hash function is replaced with a deterministic RSA-based keyed hashing scheme. We also show that a public-key operation is necessary to prevent zone enumeration. Specifically, we prove that security against network attackers and privacy against zone enumeration cannot be satisfied simultaneously unless the DNSSEC server performs online public-key cryptographic operations.

Speaker: Prof. Sharon Goldberg (Boston University)

Slides Powerpoint 2010 slides set

15:10 Coffee Break

15:30 The GIft that Keeps on Giving: Open DNS Proxies

DNS DDoS attacks continue, fueled by open DNS proxies. Now they're stressing resolvers and authorities worldwide using pseudo random subdomains. In June of 2014 there was a 400% increase in this traffic and popular domains continue to be targeted. Analysis of recent DNS data reveals other interesting details. For instance, Response Rate Limiting in authorities appears to aggravate attacks. This presentation will cover the latest attack data as well as tests of the major resolvers showing the impact of capabilities to mitigate them, ranging from changes in recursive behaviors to filtering traffic at ingress.

Speaker: Mr Ralf Weber (Nominum)

Slides PRSD-DNS-OARC-Oct-2014.pdf PRSD-DNS-OARC-Oct-2014.pptx

16:00 DNS - the glue in the IoT

In Internet of Things (IoT), the "Things" could be anything from refrigerators to human to books. These "things" should be identified at least by one unique way of identification, for the capability of addressing and communicating with each other. This is made possible by attaching/embedding different data carrier devices such as barcodes,RFID, Sensors etc with the 'things'. Sensors, for example could be identified by MAC or IPv6 address. Similarly barcodes, RFID tags are encoded with an identifier based on different identification schemes such as Universal Product Code, (UPC), Electronic Product Code (EPC), ucode etc. The basic feature of these identifiers are : they are allocated hierarchically, control is decentralised and the nature of allocation makes sure that there is no duplicity. The identifier properties described in the previous paragraph are similar to the domain name allocation and management, and thus, identifiers in IoT could leverage the DNS infrastructure and software for allocation and resolution. Leveraging DNS for other uses started with ENUM for telephone numbers, and for IoT, there exists already overlay mechanisms services such as Object Naming Service (ONS) [EPCglobal standard] and Object Directory Service (ODS) [ITU-T standard] which uses the DNS to resolve the IoT identifiers (their respective identification schemes) to its related digital information. As DNS acts as a "glue" in the current Internet, where its basic feature is to resolve "human-friendly" host names to their corresponding "machine-friendly" IP addresses, in IoT also it is proved, that DNS could be a glue for certain identification schemes. This talk will concentrate on [1] How DNS could be leveraged for resolving a 'thing' associated with an RFID based on our experiences in working on the WINGS [WINGS] project and contributing to the ONS 2.0 standard [EPCglobal standard] [2] The issues involved in using DNS for resolution in the Wireless sensor network (i.e using Sensor devices) based on a recently started collaborative project [WSNProject]. [3] If time permits, IoT standardisation activities at the IETF relating to DNS [WINGS] http://www.wings-project.fr/ [EPCglobal standard] http://www.gs1.org/gsmp/kc/epcglobal/ons/ons_2_0_1-standard-20130131.pdf [ITU-T standard] Object Directory Service for Mobile AIDC services (ISO/IEC 29177) [WSNProject] http://www.labfab.fr/portfolio/lora-fabian/

Speaker: Mr Sandoche Balakrichenan (Afnic)

Slides DNS-IoT-12102014-Final.pdf

16:30 Orient data vertically for faster analysis

Column store databases are a newer entry to the big data realm. They handle structured data like DNS queries exceptionally well and work best with minimal data normalization. Queries execute significantly faster than RDBMS technology (~ 100 times faster). This talk will outline the technology at a high level and walk through examples of data loading, compression, and reporting using a freely available Column Store DB as well as Nominum’s experiences and findings analyzing large amounts of DNS data. No normalization, fast data loading, no indexing, fast queries and SQL... what's not to like?

Speaker: Mr Adrian Beaudin (Nominum)

Slides PDF Version

17:00 Test cases for domain checks -- a step towards a best practice

Zonemaster is an upcoming tool for controlling DNS zones. It is designed to replace the .SE DNSCheck and the .FR ZoneCheck with better performance, modularity and scalability. One of the design goals is to have explicit test cases for the tool. I.e. exactly what are the requirements of the tested zone that tools should test? What outcomes should return pass and what outcomes should return fail? Those explicit specifications, i.e. the test cases, will at the same time be the ground the validation of the tool. The goal of the test cases is more than being the requirements for Zonemaster, our ambition is to develop a best practice for zone delegations by having transparent and publically available specifications that are independent of the test tool. The Zonemaster test tool could be seen as one implementation of those specifications. The test cases should not only capture a completely valid delegation, but they should also be ground for meaningful error messages when things are more or less bad. I will in my presentation present the major test cases for the tool and some test cases where the outcome need considerations and where discussions and suggestions could help the development. The material for the project is publicly available at Github, https://github.com/dotse/zonemaster

Speaker: Mats Dufberg (.SE (The Internet Infrastructure Foundation))

Slides Oarc_Oct_2014_Dufberg_and_Balakrichenan-rev_2.0.pdf Oarc_Oct_2014_Dufberg_and_Balakrichenan-rev_2.0.pptx

Monday, 13 October

10:25 → 17:50 Monday Joint OARC/Tech Day

Convener: Mr Sebastian Castro (.nz Registry Services)

slides http://la51.icann.org/en/schedule/mon-tech/agenda-dns-oarc-tech-13oct14-en

10:30 TechDay Opening Remarks

Speaker: Dr Eberhard Wolfgang Lisse (Namibian Network Information Centre)

10:40 Disturbance in the DNS

Speaker: Mr Sandoche Balakrichenan (Afnic)

Slides dafa888-DosAttack.pdf

11:00 Keynote Address

Speaker: Paul Mockapetris

11:30 DNSViz - powerful and extensible DNS analysis

DNSViz has been developed as a Web-based tool for analysis, visualization, education, and troubleshooting DNS and DNSSEC. The tool has recently been reworked for extensibility and portability, including a downloadable library and tool suite available via an open source license--and a revamped Web site. We discuss the new features available with DNSViz, future plans, and how to get involved.

Speaker: Dr Casey Deccio (Verisign Labs)

Slides 2014-10-13-dnsviz-oarc.pdf

11:50 Low-Cost Threshold Cryptography HSM for OpenDNSSEC

The DNS Security Extensions (DNSSEC) add a new layer of security based on public-key infrastructure: each DNS record is digitally signed to verify the authenticity of the answer. However, the introduction of DNSSEC has an impact in the operational workflow of DNS systems: (i) signatures have an expiration date, hence the records must be periodically signed and (ii) key management tasks can be overwhelming. These are problems specially for DNS zones with several records (for instance a Top Level Domain). The adoption of Hardware Security Module (HSM) is an option to provide highly secured keys and signature management. Nevertheless HSM is expensive and hardware can fail. We present a novel system based on threshold cryptography to support the operational signing workflow of DNSSEC. This approach significantly improves security and availability of the overall system since the secret key is never stored in a single place; it is spread among the nodes of the system.

Speaker: Mr Francisco Cifuentes (NIC Chile Research Labs)

Slides DNS-OARC.odp DNS-OARC.pdf

12:10 Measuring the Leakage of Onion at the DNS Root

The Tor project provides individuals with a mechanism of communicating anonymously on the Internet. Furthermore, Tor is capable of providing anonymity to servers, which are configured to receive inbound connections only through Tor (more commonly called hidden services). In order to route requests to these hidden services, a namespace is used to identify the resolution requests to such services. A namespace under a non-delegated (pseudo) top-level-domain (TLD) of .onion was elected. Although the Tor system was designed to prevent .onion requests from leaking into the global DNS resolution process, numerous requests are still observed in the global DNS. In this talk I propose to present the state of .onion requests received at the global public DNS A and J root nodes, and a complementary measurement from the DITL (day in the life of the Internet) data repository. I will also present potential explanations of the leakage, and highlights of trends associated with global censorship events.

Speaker: Dr Aziz Mohaisen (Verisign Labs)

Slides Mohaisen-Measuring_the_Leakage_of_Onion_at_the_Root_2.pptx

12:30 Host Presentation

Speaker: Mr Marx Peter (Los Angeles City Council)

12:50 IDNA 2008 & Unicode

Speaker: Patrick Faltstrom

13:10 Lunch

On your own.

14:00 MS DNS Server Data Mine

Speaker: Mr Kumar Ashutosh (Microsoft)

Slides PDF Version PPT Version

14:20 Facebook CSIO Update

14:40 Yahoo CSIO Update

Speaker: Alex Stamos (Yahoo)

15:00 DNS Rex: Do you need an aggressive benchmarking tool?

DNS Rex: Do you need an aggressive benchmarking tool? I would like to present DNS Rex, an open source performance benchmark for DNS servers, with a focus on busy DNS caching resolvers. DNS Rex was created to address several known (and rumored) problems with existing DNS testing tools. Our goals included: * reliable generation of high query rates, * reproducibility of test results, * ability to sustain any configurable cache hit ratio, * support for long tests without reliance on trace replay, * independence from a 3rd-party authoritative server, * DNSSEC support. DNS Rex has been successfully used for private tests, and is publicly available[1], but we have not promoted its wider use. Besides describing what DNS Rex can do today, I would like to gauge audience interest in continued development of the tool. Is there a genuine need for a better DNS benchmark? What missing features are the most important? [1] http://rex.measurement-factory.com/

Speaker: Alex Rousskov (The Measurement Factory)

Slides

• slides-4x3.odp
• slides-4x3.pdf
• slides-old.pdf

15:20 DNS Bake-off

Speaker: Jacques Latour (CIRA)

17:00 PKI News

Speaker: Jeremy Rowley (Digicert)

17:20 Closing Remarks

Speaker: Mr Ondrej Filip (CZ.NIC)