Domain Name System Security

DNS Security (or DNSSEC) applies cryptography to the Domain Name System to authenticate the information served. This site is about the process of integrating DNS Security with the existing DNS infrastructure.

• Protocol Development
• Software Integration
• Generating Keys
• Signing Your Zone
• Exchanging Keys with Sub- and Super-Zones
• How keying info gets used
• Government controls (or the lack thereof)
• Downloading an early prototype of the software

• RSA info about the "DNSsafe" software appearing soon in production releases
• ISC info about the "DNSsafe" software appearing soon in production releases
• Downloading production BIND DNS software (which does not implement DNS Security yet)

• Dec 23, 1997: Strong Crypto Code Published Online for Authentication
• Background information for Dec 23, 1997 press release

UPDATES - March 1999

• Phil Karn's declaration which refers to this software and points out to BXA that it's similar to the software that they refused him permission to export.
• James Lewis (BXA)'s declaration which indicates how BXA re-reviewed Integrated DNSSEC after Phil's declaration.
• June 1998 letter from BXA "reviewing" its previous conclusion and reclassifying this software as embargoed crypto because they claim that "with minimal effort" it can also encrypt data for confidentiality.
• July 1998 letter to BXA appealing the reclassification.
• December 1998 fax from BXA in response to appeal.
• January 1999 letter defining procedures for informal hearing.
• January 1999 informal hearing transcript from a meeting at the Bureau of Export Administration to explore the issue.
• February 23, 1999 written submission to BXA by Lee Tien as part of the informal hearing process.