Lessons learned from the .SE algorithm rollover
The Swedish Internet Foundation was the first TLD to sign their zone, but eventually you come to a point where an overhaul is needed. This is what we learned from that process.
-
-
Rolling, Rolling, Rolling...
Most probably by now you are tired of all the talk about rolling the root KSK. Yes, we are too! So, today we are not going to talk about that one.
-
The renaming of .nu
No, of course we won't change the name of the TLD, just the hostname of some of the name servers serving the .nu zone.
-
.SE KSK Algorithm Rollover
At The Swedish Internet Foundation we are very security concious. We were the first TLD in the world to sign their zone with DNSSEC. Being on the forefront of things is a nice feeling, but sometimes you get to feel the pain of it. Having signed so early means that at the time there was only one algorithm to use, RSA-SHA1. The security of SHA1 has been discussed in the community for some time now and even though there is no need for panic, there are more secure alternatives available today.
-
Remember, remember 11th of October
Let's talk Root KSK Rollover! If you run your own resolver at home, or at the office, you need to act now. Let us show you how.
-
Packet size and name server authorative zone
As preparation for the changing of keys used in the .se zone I have done some tests about packet sizes with different key sizes and algorithms. Currently the .se zone is signed by a 2048 bit Key Signing Key (KSK) and a 1024 bit Zone Signing Key (ZSK) both in RSA-SHA1 format.
-
Monitoring of IIS Anycast
In January 2017 The Swedish Internet Foundation started a new service "IIS Anycast". We offer our registrars a secondary DNS. We do this in cooperation with CIRA (the Canadian ccTLD Registry). Our secondary DNS is a DNS anycast network.
-
Summer fun with a DNS resolver
On my way back home from the IETF93 meeting in Prague I decided to do a small summer project. For a long time I have wanted to run my own DNS resolver. Lately I had considered to run it on my Synology NAS. But my NAS is already stretched by all the applications running. So I decided to use one of my Raspberry Pi's to do the job. Now, after some runs of the washing machine, I am ready to go.
-
New domain names for people around the world
Extending domain names and TLDs with other letters and characters beyond a-z has been possible since 2003. Mats Dufberg dives into the world of Internationalized domain names, and explains how Arabic, Chinese and Cyrillic is able to function on the web.
-
Money for internet improvement projects
In addition to investments financed through the Internet Fund, The Swedish Internet Foundation has also recently chosen to support two important projects. The names of these are Cryptech and CeroWRT, and we think that both are important for the future of the internet.
