Subject: RE: [Enum] ENUM+DNSSEC Trial in JAPAN

From: "Peter Williams" <[email-masked]>
Date: Mon, 26 Jul 2004 13:45:41 -0400

Can you state the main security objectives for the use of DNSSEC, please?
For example:
(1) enable users to validate "national authority" delegation of ENUM regions 
withing e164.arpa

(2) enable users to establish a secure channel to a DNS server, when issuing 
queries

(3) distribute public keys to VoIP users
(4) use ENUM algorithm to locate public keys of DNS servers of private ENUM 
tress, and/or SIP proxies

etc.

From: fujiwara at jprs.co.jp
To: enum at ietf.org
Subject: [Enum] ENUM+DNSSEC Trial in JAPAN
Date: Tue, 27 Jul 2004 01:05:22 +0900 (JST)

Hi, I'm Kazunori Fujiwara, JPRS and ETJP(ENUM Trial JAPAN).
We developed ENUM+DNSSEC Registry system and
added DNSSEC with our ETJP ENUM trial this March.
I planed to report this DNSSEC+ENUM Trial
if ENUM trial report session will be hold at the next IETF meeting.
I want to discuss DNSSEC in ENUM in any places.
Our system accepts NAPTR RRs and NS delegations at valiours
delegation point (for both user ENUM trial and operator ENUM trial).
and more, this system accepts DNSSEC DS RR with NS RR.
and then, ENUM zone is signed after zone generation.
we are using BIND-9.3.0rc.
Sorry, there is no English documentation.
Some infomation is in Yasuhiro Morishita's presentation at DNSSEC
deployment workshop.
     http://www.sdl.sri.com/other/dnssec/DNSSEC04MayUS-Info.html
Regards,
--
Fujiwara, Kazunori	JPRS
_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

_______________________________________________
enum mailing list
enum at ietf.org
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Mon, 26 Jul 2004 14:39:58 -0400

>>>>> "Peter" == Peter Williams <home_pw at msn.com> writes:

    Peter> Can you state the main security objectives for the use of
    Peter> DNSSEC, please?

The Security Considerations section of RFC3761 already makes this
clear.

    Peter> (1) enable users to validate "national authority"
    Peter> delegation of ENUM regions withing e164.arpa

    Peter> (2) enable users to establish a secure channel to a DNS
    Peter> server, when issuing queries

    Peter> (3) distribute public keys to VoIP users

    Peter> (4) use ENUM algorithm to locate public keys of DNS servers
    Peter> of private ENUM tress, and/or SIP proxies

DNSSEC provides for authenticity and non-repudiation of data in DNS
responses using public key crypto and digital signatures. ie I can
lookup your domain name in the DNS and prove that the answer I got
back came from you and wasn't tampered with after it left your name
server. The DNS as we know it today does not have these safeguards. In
the context of ENUM the implication for that should be obvious: spoofed
DNS responses could be used to hijack telephone service or worse. Likewise,
retrieving keys from the DNS only makes sense if the responses from
the DNS can be validated.

FYI, DNSSEC does not provide a "secure channel" between client and
server. It does not encrypt the data being sent in either direction.
For more info, consult the latest internet drafts on DNSSEC. 
draft-ietf-dnsext-dnssec-intro-11.txt is an excellent primer on this
important new protocol.