Speakers
Description
Many enterprises today employ the service of multiple DNS providers to operate their authoritative DNS service. Two providers are fairly typical and this allows the DNS service to survive a complete failure of any single provider. Deploying DNSSEC in such an environment can have some challenges depending on the configuration and feature set in use. In particular, large enterprises often make use of a number of non-standardized DNS features, that necessitates having each provider independently sign the DNS zone data with a coordinated set of keys. We will present several operationally viable deployment models for multi signer DNSSEC. One of the goals of this talk is to generate interest in these models and encourage managed DNS providers to support them (encouragingly, several are already planning to do so), as this will solve an important deployment hurdle for enterprise DNSSEC. Additionally, it may be possible to leverage the multi-signer models to allow non-disruptive handoff of DNSSEC signed zones from one DNS operator to another. We now have an early implementation of some of the key management mechanisms needed to deploy the multi-signer models, and will share details of the implementation.
| Talk Duration | 30 Minutes |
|---|
