Shumon Huque

Software Engineering Architect @salesforce. Ex @VERISIGN Principal Scientist. Ex @Penn engineer. @Penn CS Alum. Opinions here are my own.

[Shumon Huque @shuque]

RFC 9102: "TLS DNSSEC Chain Extension", finally published as "experimental" -- a few years after a long, acrimonious battle in the IETF TLS WG to get it published as "standards track" failed: https://t.co/o1xH10uCEH

[DNS-OARC @dnsoarc]

Shumon Huque covers much ground in his presentation, including a call for an ICANN role for DNS providers, and handling parental detection of CDS/CDNSKEY records - on which there were new ideas proposed by Johan Stenstam during IDS yesterday.
#OARC41 #LoveDNS ^CA

[DNS-OARC @dnsoarc]

Shumon Huque from Salesforce presenting "Automation of DNSSEC provisioning and maintenance" asserts that robust automation in these areas should make it easier to deploy DNSSEC
https://t.co/gm6xcuOcai
#OARC41 #LoveDNS ^CA

[Shumon Huque @shuque]

@marcodavids It is not. The A record set (via Fastly) is not signed and can be spoofed, so this response is not secure end to end. All RRsets in the DNS response's answer section need to be signed for the response to be secure. Since they weren't the resolver did not set the AD flag.

[Shumon Huque @shuque]

#IETF114 Meeting Tshirt. Does it look familiar?

[Shumon Huque @shuque]

@aabdnn Oh, wow! Thanks for thinking of me while playing Scrabble, Anand! :)

[Shumon Huque @shuque]

@AkiTuomi No worries

[APNIC @apnic]

On the blog today, @shuque breaks down alternative models to zone transfer that can support #DNSSEC's non-standardized features: https://t.co/0gk3K9ba2V

#DNS #MultiSigner #security

[Shumon Huque @shuque]

#IETF111 dnsop yesterday "Black Lies Empty Non-Terminal Sentinel" Slides: https://t.co/09cHQaa9Np draft: https://t.co/8fGdpm3M3F

[Shumon Huque @shuque]

And 1 more #IETF111 DNSSEC Automation https://t.co/NcKIHJtFwc; Slides https://t.co/muvdXWFgRQ, with @wisser

[Shumon Huque @shuque]

Also #IETF11 Domain Verification Techniques: https://t.co/aR9Oolp4rf; Slides https://t.co/qC72LfWZAL with @shivan_kaul

[Shumon Huque @shuque]

Presented at #IETF111 today: (DNS) Glue is not Optional draft https://t.co/HVTEXdAP0O; Slides: https://t.co/nivOsyhavU with m. andrews, @letoams & @PacketPusher

[Shumon Huque @shuque]

@letoams @VDukhovni Ha! :) That would solve some problems!

[Shumon Huque @shuque]

@letoams @VDukhovni There are definitely security benefits for individual certs. We do that for customers with "high security" needs - they go in their own namespace with their own certs/keys. For vast majority of tenants that don't ask for this, there is no business need to forgo wildcard certs.

[Shumon Huque @shuque]

@letoams @VDukhovni So, that creates another problem: the app has to manage N million certs.

[Shumon Huque @shuque]

@letoams @VDukhovni Also, I wonder what the performance impact on the TLS handshake will be if it has to carry an EE certificate with N million SANs.

[Shumon Huque @shuque]

@letoams @VDukhovni Not really, new SNIs appear dynamically and very rapidly. There is no time (or desire) to provision new certificates on that time scale.

[Shumon Huque @shuque]

@letoams @VDukhovni Also, without wildcards, they'd have to reissue the certs with additional SANs probably hundreds of times per day as new tenant names are deployed.

[Shumon Huque @shuque]

@letoams @VDukhovni That wouldn't fly and not because of cost. Many application service providers deploy thousands and sometimes millions of tenant specific names that map to the same or small set of apps. They would not want to deploy certificates with that many SANs even if that were feasible.