| Overview |
DNS Security (DNSSEC) refers to the addition of data authentication and integrity protection to the DNS protocol. This is accomplished by the inclusion of public keys and the use of digital signatures to DNS information. The DNSSEC specification is considerd complete and now the effort is directed towards deployment. There are currently several deployed zones including ccTLDs.
At NIST, our contribution to securing DNS is in aiding deployment and determining the impact of the new security transactions on server performance. DNS servers are now asked to verify digital signatures and establish "chains of trust" between previously unknown zones and a known secure zone (root, or some other pre-configured, trusted public key). Our goal is to quantify the impact the security extensions have on server performance.In aiding deployment, the Secure Naming Infrastructure (SNIP) has been implemented to provide a "training ground" for DNS administrators who wish to run a small domain in order to develop and test new procedures for maintaining a DNSSEC signed zone. The SNIP is a joint project between NIST and SPARTA Inc. to produce a DNSSEC pilot zone for US Federal Government IT administrators. In conjuction with the pilot domain, there are also training material, workshops, and links to resources to assist in deployment.
The driving force behind the creation of the SNIP project is the new Federal Information Security Management Act (FISMA); a set of security controls that all federal agencies must implement. One of the new controls is the deployment of DNSSEC to zone information in the .gov domain. The SNIP was designed to help agency DNS administrators to learn and deploy DNSSEC on their zones in order to meet the new controls.
| Collaborators |
| Staff |
| Latest Updates |
| Related Projects |
Questions or comments should be sent to
proj-dnssec@antd.nist.gov