94 lines
3.7 KiB
Plaintext
94 lines
3.7 KiB
Plaintext
|
|
Secure DNS (TIS/DNSSEC)
|
|
September 1996
|
|
|
|
Copyright (C) 1995,1996 Trusted Information Systems, Incorporated
|
|
|
|
Trusted Information Systems, Inc. has received approval from the
|
|
United States Government for export and reexport of TIS/DNSSEC
|
|
software from the United States of America under the provisions of
|
|
the Export Administration Regulations (EAR) General Software Note
|
|
(GSN) license exception for mass market software. Under the
|
|
provisions of this license, this software may be exported or
|
|
reexported to all destinations except for the embargoed countries of
|
|
Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria. Any export
|
|
or reexport of TIS/DNSSEC software to the embargoed countries
|
|
requires additional, specific licensing approval from the United
|
|
States Government.
|
|
|
|
Trusted Information Systems, Inc., is pleased to
|
|
provide a reference implementation of the secure Domain Name System
|
|
(TIS/DNSSEC). In order to foster acceptance of secure DNS and provide
|
|
the community with a usable, working version of this technology,
|
|
TIS/DNSSEC is being made available for broad use on the following basis.
|
|
|
|
- Trusted Information Systems makes no representation about the
|
|
suitability of this software for any purpose. It is provided "as is"
|
|
without express or implied warranty.
|
|
|
|
- TIS/DNSSEC is distributed in source code form, with all modules written
|
|
in the C programming language. It runs on many UNIX derived platforms
|
|
and is integrated with the Bind implementation of the DNS protocol.
|
|
|
|
- This beta version of TIS/DNSSEC may be used, copied, and modified for
|
|
testing and evaluation purposes without fee during the beta test
|
|
period, provided that this notice appears in supporting documentation
|
|
and is retained in all software modules in which it appears. Any other
|
|
use requires specific, written prior permission from Trusted Information
|
|
Systems.
|
|
|
|
TIS maintains the email distribution list dns-security@tis.com for
|
|
discussion of secure DNS. To join, send email to
|
|
dns-security-request@tis.com.
|
|
|
|
TIS/DNSSEC technical questions and bug reports should be addressed to
|
|
dns-security@tis.com.
|
|
|
|
To reach the maintainers of TIS/DNSSEC send mail to
|
|
tisdnssec-support@tis.com
|
|
|
|
TIS/DNSSEC is a product of Trusted Information Systems, Inc.
|
|
|
|
This is an beta version of Bind with secure DNS extensions it uses
|
|
RSAREF which you must obtain separately.
|
|
|
|
Implemented and tested in this version:
|
|
Portable key storage format.
|
|
Improved authentication API
|
|
Support for using different authentication packages.
|
|
All Security RRs including KEY SIG, NXT, and support for wild cards
|
|
tool for generating KEYs
|
|
tool for signing RRs in boot files
|
|
verification of RRs on load
|
|
verification of RRs over the wire
|
|
transmission of SIG RRs
|
|
returns NXT when name and/or type does not exist
|
|
storage of NXT, KEY, and SIG RRs with CNAME RR
|
|
AD/ID bits added to header and setting of these bits
|
|
key storage and retrieval
|
|
dig and nslookup can display new header bits and RRs
|
|
AXFR signature RR
|
|
keyfile directive
|
|
$SIGNER directive (to turn on and off signing)
|
|
adding KEY to answers with NS or SOA
|
|
SOA sequence numbers are now set each time zone is signed
|
|
SIG AXFR ignores label count of names
|
|
generation and inclusion of .PARENT files
|
|
Returns only one NXT at delegation points unless two are required
|
|
Expired SIG records are now returned in response to query
|
|
|
|
Implemented but not fully tested:
|
|
|
|
Known bugs:
|
|
|
|
Not implemented:
|
|
ROUND_ROBIN behaviour
|
|
zone transfer in SIG(AXFR) sort order.
|
|
transaction SIGs
|
|
verification in resolver. (stub resolvers must trust local servers
|
|
resolver library is to low level to implement security)
|
|
knowing when to trust the AD bit in responses
|
|
|
|
Read files INSTALL_SEC and USAGE_SEC for installation and user
|
|
instructions, respectively.
|