Secure DNS (TIS/DNSSEC)
September 1996
Copyright (C) 1995,1996 Trusted Information Systems, Incorporated
Trusted Information Systems, Inc. has received approval from the
United States Government for export and reexport of TIS/DNSSEC
software from the United States of America under the provisions of
the Export Administration Regulations (EAR) General Software Note
(GSN) license exception for mass market software. Under the
provisions of this license, this software may be exported or
reexported to all destinations except for the embargoed countries of
Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. Any export
or reexport of TIS/DNSSEC software to the embargoed countries
requires additional, specific licensing approval from the United
States Government.
Trusted Information Systems, Inc., is pleased to
provide a reference implementation of the secure Domain Name System
(TIS/DNSSEC). In order to foster acceptance of secure DNS and provide
the community with a usable, working version of this technology,
TIS/DNSSEC is being made available for broad use on the following basis.
- Trusted Information Systems makes no representation about the
suitability of this software for any purpose. It is provided "as is"
without express or implied warranty.
- TIS/DNSSEC is distributed in source code form, with all modules written
in the C programming language. It runs on many UNIX derived platforms
and is integrated with the Bind implementation of the DNS protocol.
- This beta version of TIS/DNSSEC may be used, copied, and modified for
testing and evaluation purposes without fee during the beta test
period, provided that this notice appears in supporting documentation
and is retained in all software modules in which it appears. Any other
use requires specific, written prior permission from Trusted Information
Systems.
TIS maintains the email distribution list dns-security@tis.com for
discussion of secure DNS. To join, send email to
dns-security-request@tis.com.
TIS/DNSSEC technical questions and bug reports should be addressed to
dns-security@tis.com.
To reach the maintainers of TIS/DNSSEC send mail to
tisdnssec-support@tis.com
TIS/DNSSEC is a product of Trusted Information Systems, Inc.
This is an beta version of Bind with secure DNS extensions it uses
RSAREF which you must obtain separately.
Implemented and tested in this version:
Portable key storage format.
Improved authentication API
Support for using different authentication packages.
All Security RRs including KEY SIG, NXT, and support for wild cards
tool for generating KEYs
tool for signing RRs in boot files
verification of RRs on load
verification of RRs over the wire
transmission of SIG RRs
returns NXT when name and/or type does not exist
storage of NXT, KEY, and SIG RRs with CNAME RR
AD/ID bits added to header and setting of these bits
key storage and retrieval
dig and nslookup can display new header bits and RRs
AXFR signature RR
keyfile directive
$SIGNER directive (to turn on and off signing)
adding KEY to answers with NS or SOA
SOA sequence numbers are now set each time zone is signed
SIG AXFR ignores label count of names
generation and inclusion of .PARENT files
Returns only one NXT at delegation points unless two are required
Expired SIG records are now returned in response to query
Implemented but not fully tested:
Known bugs:
Not implemented:
ROUND_ROBIN behaviour
zone transfer in SIG(AXFR) sort order.
transaction SIGs
verification in resolver. (stub resolvers must trust local servers
resolver library is to low level to implement security)
knowing when to trust the AD bit in responses
Read files INSTALL_SEC and USAGE_SEC for installation and user
instructions, respectively.
