[B! DNSSEC] TsuSUZUKIã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

TsuSUZUKI id:TsuSUZUKI

DNSSECã«é–¢ã™ã‚‹TsuSUZUKIã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (31)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

IIJã®DNSæš—å·åŒ–ã¸ã®å–ã‚Šçµ„ã¿ | IIJ Engineers Blog
ã¯ã˜ã‚ã« ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¯ãƒ©ã‚¦ãƒ‰æœ¬éƒ¨ã®å…¶ç”°ã§ã™ã€‚ä»Šå›žã¯IIJã®DNSæš—å·åŒ–ã¸ã®å–ã‚Šçµ„ã¿ã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ ã“ã®è¨˜äº‹ã§ç´¹ä»‹ã™ã‚‹ã®ã¯ã€æœ¬æ—¥ãƒ—ãƒ¬ã‚¹ãƒªãƒªãƒ¼ã‚¹ã—ãŸã€ŒIIJã€æŽ¥ç¶šã‚µãƒ¼ãƒ“ã‚¹ã§æä¾›ã™ã‚‹DNSã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚’å¼·åŒ–ã€ã®ä¸ã®ã€DNSã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒã¨ãŠå®¢æ§˜ã®é–“ã®é€šä¿¡(DoT/DoH)ã«è©²å½“ã—ã¾ã™ã€‚ å–ã‚Šçµ„ã¿ã®ãã£ã‹ã‘ IIJã§ã®DNSæš—å·åŒ–ã®å–ã‚Šçµ„ã¿ã¯2018å¹´ã‹ã‚‰ã‚¹ã‚¿ãƒ¼ãƒˆã—ã¦ã„ã¾ã™ã€‚ å½“æ™‚æœ¬å‘½ã¨ã•ã‚ŒãŸDNS over TLS(DoT)ã¯2016å¹´ã«RFCåŒ–ã•ã‚Œã¦ã„ã‚‹ã®ã§ã€ã¡ã‚‡ã£ã¨é…ã„ã‚¹ã‚¿ãƒ¼ãƒˆã ã£ãŸã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚DoTã‚„DoH(DNS over HTTPS)ãŒå¯¾è±¡ã¨ã™ã‚‹ã€ãƒ•ãƒ«ãƒªã‚¾ãƒ«ãƒ(DNSã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒ)ï½žã‚¹ã‚¿ãƒ–ãƒªã‚¾ãƒ«ãƒ(ãƒ‘ã‚½ã‚³ãƒ³ã‚„ã‚¹ãƒžãƒ›ã®ä¸ã«çµ„ã¿è¾¼ã¾ã‚Œã¦ã„ã‚‹DNSå•ã„åˆã‚ã›æ©Ÿèƒ½)ã®é–“ã®é€šä¿¡ã¯ã€ISPã®å¥‘ç´„è€…ãŒISPãŒç”¨æ„ã—ãŸDNSã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚µãƒ¼ãƒã‚’ä½¿ã†é™ã‚Šã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚’é€šéŽã›ãšã€ç‰¹å®šã®IS
TsuSUZUKI 2020/01/17
IIJ

DNS

DoH

DoT

DNSSEC
ãƒªãƒ³ã‚¯
ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã«ã‚ˆã‚‹å½±éŸ¿ã¨ãã®ç¢ºèªæ–¹æ³•ã«ã¤ã„ã¦ï¼ˆ2019å¹´1æœˆ16æ—¥æ›´æ–°ï¼‰
--------------------------------------------------------------------- â– ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã«ã‚ˆã‚‹å½±éŸ¿ã¨ãã®ç¢ºèªæ–¹æ³•ã«ã¤ã„ã¦ æ ªå¼ä¼šç¤¾æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJPRSï¼‰ åˆç‰ˆä½œæˆ 2017/07/10ï¼ˆMonï¼‰ æœ€çµ‚æ›´æ–° 2019/01/16ï¼ˆWedï¼‰ ï¼ˆæ—§KSKå¤±åŠ¹æ™‚ã®DNSKEY RRã®å¿œç”ã‚µã‚¤ã‚ºã‚’ä¿®æ£ï¼‰ --------------------------------------------------------------------- â–¼æ¦‚è¦ 2017å¹´7æœˆã‚ˆã‚Šã€ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã«ãŠã„ã¦DNSSECéµç½²åéµï¼ˆKSKï¼‰ã®æ›´æ–°ï¼ˆä»¥ä¸‹ã€ ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ï¼‰ã®ãƒ—ãƒã‚»ã‚¹ãŒé–‹å§‹ã•ã‚Œã¾ã™ã€‚ä»Šå›žã®ãƒ«ãƒ¼ ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã¯2010å¹´ã®DNSSECã®é‹ç”¨é–‹å§‹å¾Œåˆã¨ãªã‚‹ã‚‚ã®ã§ã€ è¤‡æ•°ã®ã‚¹ãƒ†ãƒƒãƒ—ã«
TsuSUZUKI 2017/07/11
DNSSEC

KSK

JPRS

DNSKEY

DNS
ãƒªãƒ³ã‚¯
DNSSECãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã› - JPNIC
DNSSECãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³ã«ãŠã‘ã‚‹ ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã› DNSSECæŠ€è¡“ã«ã‚ˆã‚‹ãƒãƒªãƒ‡ãƒ¼ã‚·ãƒ§ãƒ³(ç½²åæ¤œè¨¼)ã§åˆ©ç”¨ã™ã‚‹ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³éµç½²åéµ(KSK)ã®ãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼(æ›´æ–°)ã«ã¤ã„ã¦ã€ é‡è¦ãªãŠçŸ¥ã‚‰ã›ã‚’ã„ãŸã—ã¾ã™ã€‚ ã“ã®åº¦ã®ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKã®æ›´æ–°ã¯ã€ ICANNãŒãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKã®ç®¡ç†è€…ã¨ã—ã¦é€²ã‚ã¦ã„ã‚‹ã‚‚ã®ã§ã™ã€‚ ã“ã‚Œã«ä¼´ã„ã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ¦ãƒ¼ã‚¶ãƒ¼ã®4äººã«1äººã€ ã¤ã¾ã‚Š7å„„5000ä¸‡äººã«å½±éŸ¿ã‚’åŠã¼ã™å¯èƒ½æ€§ãŒã‚ã‚‹ã¨ICANNã¯æŽ¨å®šã—ã¦ã„ã¾ã™ã€‚ ã“ã®ãŸã‚ICANNã¯ã€ ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³KSKã®æ›´æ–°ã«é–¢ã™ã‚‹ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³æ–‡æ›¸ã‚’å…¬é–‹ã—ã€ ã‚°ãƒãƒ¼ãƒãƒ«ã«å¹…åºƒã„é–¢ä¿‚è€…ã«å‘ã‘ãŸå‘¨çŸ¥ã‚’è¡Œã£ã¦ãŠã‚Šã€JPNICã¯ã€ ICANNãŒæä¾›ã—ã¦ã„ã‚‹ã“ã‚Œã‚‰ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³æ–‡æ›¸ãŒæ—¥æœ¬ã®é–¢ä¿‚è€…ã«ã¨ã£ã¦é‡è¦ãªæƒ…å ±ã§ã‚ã‚‹ã¨åˆ¤æ–ã—ã€ ç¿»è¨³ã‚’å…¬é–‹ã—ã¾ã—ãŸã®ã§ãŠçŸ¥ã‚‰ã›ã„ãŸã—ã¾ã™ã€‚ å›½å†…ã§ã¯ã€ã“ã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã«
TsuSUZUKI 2017/06/01
cf. https://www.nic.ad.jp/ja/translation/icann/2016/20160722.html

DNSSEC

KSK

JPNIC

ICANN

bind

å…¬é–‹éµ
ãƒªãƒ³ã‚¯
ãƒŠãƒ¬ãƒƒã‚¸ãƒ™ãƒ¼ã‚¹ - ã‚µãƒ¼ãƒID ã‚µãƒãƒ¼ãƒˆ - Security Advisory - è„†å¼±æ€§ï¼šOpenSSL Heartbleed Bug (CVE-2014-0160/CVE-2014-0346) ã«ã¤ã„ã¦
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181

CVE-2014-0160
ãƒªãƒ³ã‚¯
OpenSSL 1.0.1ã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã¸ã®å¯¾å¿œã®ãŠé¡˜ã„
(2014å¹´04æœˆ09æ—¥ : æ›´æ–°) OpenSSL 1.0.1ã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã«é–¢ã™ã‚‹è¿½åŠ ã®ã”æ¡ˆå†…ã«ãªã‚Šã¾ã™ã€‚ 2014å¹´04æœˆ08æ—¥ 17:50ã®ãŠçŸ¥ã‚‰ã›ã‚’ã”ç¢ºèªã®ä¸Šã€ä»¥ä¸‹ã®å¯¾å¿œã‚’ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ OpenSSLã®è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘ãŸSSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã«é–¢ã—ã¦ã¯ã€æ–°ãŸã«ä½œæˆã—ãŸç§˜å¯†éµã§è¨¼æ˜Žæ›¸ã‚’å†ç™ºè¡Œã€å†ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã®ä¸Šã€å¤±åŠ¹ã‚’æŽ¨å¥¨ã„ãŸã—ã¾ã™ã€‚ ã¾ãŸã€æ–°ãŸã«SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã‚’ã”è³¼å…¥ã„ãŸã ãéš›ã«ã€OpenSSLã‚’ã”åˆ©ç”¨ã®å ´åˆã¯ã€å¿…ãšOpenSSLãŒæœ€æ–°ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚ã‚‹ã“ã¨ã‚’ã”ç¢ºèªã®ä¸Šã€ãŠç”³ã—è¾¼ã¿ãã ã•ã„ã€‚ ãªãŠã€ãŠå®¢æ§˜ã®ã‚µãƒ¼ãƒã§ã®OpenSSLã®ã”åˆ©ç”¨çŠ¶æ³ã¯ã€ã‚µãƒ¼ãƒç®¡ç†è€…ã¾ãŸã¯ã‚µãƒ¼ãƒç®¡ç†ä¼šç¤¾ã«ãŠå•ã„åˆã‚ã›ãã ã•ã„ã€‚ è¨¼æ˜Žæ›¸ã®å¤±åŠ¹ã«ã¤ã„ã¦ ---------------------------------------------------------- (2014å¹´04æœˆ08æ—¥ 17:
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
OpenSSL ï¼ˆ1.0.1ï½ž1.0.1ï½†ãŠã‚ˆã³1.0.2-betaã‚·ãƒªãƒ¼ã‚ºï¼‰ã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã›ã€ã‚»ã‚³ãƒ ã€‘
å¹³ç´ ã¯ã€ã‚»ã‚³ãƒ ãƒ‘ã‚¹ãƒãƒ¼ãƒˆfor Webã‚·ãƒªãƒ¼ã‚ºã‚’ã”åˆ©ç”¨ã„ãŸã ãèª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ æŽ²é¡Œã®ä»¶ã«ã¤ãã¾ã—ã¦ã€å¼Šç¤¾SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ã”åˆ©ç”¨æ™‚ã«é‡å¤§ãªå½±éŸ¿ãŒç”Ÿã˜ã‚‹æã‚ŒãŒã”ã–ã„ã¾ã™ã®ã§ã€ä»¥ä¸‹ã®å†…å®¹ã‚’ã”ç¢ºèªã„ãŸã ãã€å¯¾ç–ã‚’å®Ÿæ–½ã„ãŸã ãã¾ã™ã‚ˆã†ã€ã‚ˆã‚ã—ããŠé¡˜ã„ç”³ã—ä¸Šã’ã¾ã™ã€‚ ï¼‘ï¼Žå†…å®¹ OpenSSLâ€»1ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³1.0.1ï½ž1.0.1ï½†ãŠã‚ˆã³1.0.2-betaã‚·ãƒªãƒ¼ã‚ºã«é‡å¤§ãªè„†å¼±æ€§ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚Webã‚µãƒ¼ãƒã«ãŠã„ã¦è©²å½“ã™ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹å ´åˆã€OpenSSL ã® heartbeat æ‹¡å¼µã®å®Ÿè£…ã«ã¯ã€æƒ…å ±æ¼ãˆã„ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚TLS ã‚„ DTLS é€šä¿¡ã«ãŠã„ã¦ OpenSSL ã®ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã„ã‚‹ãƒ—ãƒã‚»ã‚¹ã®ãƒ¡ãƒ¢ãƒªå†…å®¹ãŒé€šä¿¡ç›¸æ‰‹ã«æ¼ãˆã„ã™ã‚‹æã‚ŒãŒã‚ã‚Šã¾ã™ã€‚(CSRç”Ÿæˆæ™‚ã¯æœ¬è„†å¼±æ€§ã®å¯¾è±¡ã§ã‚ã‚Šã¾ã›ã‚“) â€»1 OpenSSLï¼šé–‹ç™ºã—ãŸã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã«SSL/TLSã«ã‚ˆã‚‹æš—å·é€šä¿¡æ©Ÿèƒ½
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
OpenSSL 1.0.1ç³»ã®è„†å¼±æ€§å¯¾å¿œã«é–¢ã—ã¦
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
ã‚»ã‚¯ãƒ†ã‚£ã‚´ã‚¸ãƒ£ãƒ‘ãƒ³ï¼ˆæ—§ã‚³ãƒ¢ãƒ‰ã‚¸ãƒ£ãƒ‘ãƒ³ï¼‰ã‹ã‚‰ã®ãŠçŸ¥ã‚‰ã› - ã‚³ãƒ¢ãƒ‰SSL
ã‚»ã‚¯ãƒ†ã‚£ã‚´ã‚¸ãƒ£ãƒ‘ãƒ³ï¼ˆæ—§ã‚³ãƒ¢ãƒ‰ã‚¸ãƒ£ãƒ‘ãƒ³ï¼‰ã‹ã‚‰ã®ãŠçŸ¥ã‚‰ã› OpenSSL ã®è„†å¼±æ€§å¯¾ç–ã«é–¢ã™ã‚‹é‡è¦ãªãŠçŸ¥ã‚‰ã›åŠã³ç¢ºèªãƒ„ãƒ¼ãƒ«ã®ã”æä¾› ãŠå®¢æ§˜å„ä½ å¹³ç´ ã¯ã‚³ãƒ¢ãƒ‰SSLã‚’ã”åˆ©ç”¨ãã ã•ã„ã¾ã—ã¦ã€èª ã«ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ OpenSSL ã®è„†å¼±æ€§ã«é–¢ã—ã€ä¸‹ã®å†…å®¹ã‚’ã”ç¢ºèªã®ã†ãˆã€é©å®œã”å¯¾å¿œãã ã•ã„ã¾ã™ã‚ˆã†ãŠé¡˜ã„ç”³ã—ä¸Šã’ã¾ã™ã€‚ è„†å¼±æ€§ãŒèªã‚ã‚‰ã‚ŒãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ã® OpenSSL ã‚’ä½¿ç”¨ã—ã¦ã„ã‚‹å…¨ã¦ã®ãŠå®¢æ§˜ã¯ä¿®æ£ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¸ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã¾ãŸã¯ä¿®æ£ãƒ‘ãƒƒãƒã®é©ç”¨ãŒå¿…è¦ã¨ãªã‚Šã¾ã™ã€‚ æœ¬ä»¶ã®ã€ã€ Heartbleed ã€‘ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ã«ã¤ã„ã¦ã¯ã€ãŠå®¢æ§˜ãŒåˆ©ç”¨ã™ã‚‹ã‚µãƒ¼ãƒä¸Šã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€Œ OpenSSL ã€ ã®å•é¡Œã§ã‚ã‚Šã€ã‚³ãƒ¢ãƒ‰ãŒç™ºè¡Œã™ã‚‹è¨¼æ˜Žæ›¸ã‚„èªè¨¼åŸºç›¤ã€ã¾ãŸã¯ç§˜å¯†éµã®å•é¡Œã§ã¯ã”ã–ã„ã¾ã›ã‚“ã€‚ è©²å½“ã™ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’ã”åˆ©ç”¨ã®ãŠå®¢æ§˜ã¯ã€ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆå¾Œã€è¨¼æ˜Žæ›¸ã®å…¥ã‚Œæ›¿ãˆã‚’æŽ¨å¥¨ã„ãŸã—ã¾ã™ã€‚è¨¼æ˜Žæ›¸ã®å†ç™ºè¡Œã«ã‹ã‹ã‚‹è²»ç”¨ã«ã¤ãã¾ã—ã¦ã¯
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
Security Advisory - è„†å¼±æ€§ï¼šOpenSSL Heartbleed Bug (CVE-2014-0160/CVE-2014-0346) ã«ã¤ã„ã¦
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
Microsoft IIS6.0 SSLã‚µãƒ¼ãƒè¨¼æ˜Žæ›¸ ã‚¨ã‚¯ã‚¹ãƒãƒ¼ãƒˆæ–¹æ³• | CrossTrust - iis6exp
é©æ£ä¾¡æ ¼ ä»Šã™ãã‚³ã‚¹ãƒˆå‰Šæ¸›ï¼ Â· ã‚¹ãƒ”ãƒ¼ãƒ‰ç™ºè¡Œ å¾…ã¦ãªã„ãŠå®¢æ§˜ã« Â· ãƒ–ãƒ©ã‚¦ã‚¶ãƒ»æºå¸¯å¯¾å¿œ å¹…åºƒã„å¯¾å¿œçŽ‡ Â· å®‰å¿ƒã‚µãƒãƒ¼ãƒˆ ã™ãã”ç›¸è«‡ãã ã•ã„ï¼
TsuSUZUKI 2014/04/17
OpenSSL

Heartbleed

Cache

DNS

EDNS0

DNSSEC

Kaminsky

RFC2181
ãƒªãƒ³ã‚¯
ã‚¤ãƒ³ã‚¿ãƒ¼ãƒŽãƒƒãƒˆå´©å£Šè«–è€…ã®ç‹¬ã‚Šè¨€ - é–‹ã„ãŸãƒ‘ãƒ³ãƒ‰ãƒ©ã®ç®± - é•·å¹´æ”¾ç½®ã•ã‚Œã¦ããŸ DNS ã®æã‚‹ã¹ãæ¬ é™¥ãŒæ˜Žã‚‰ã‹ã«
TsuSUZUKI 2014/04/15
cf. https://moin.qmail.jp/qmailjp

DNS

EDNS0

DNSSEC

JPRS

JPCERT

bind

Kaminsky

unbound

RFC2181

Cache
ãƒªãƒ³ã‚¯
JP DNSã‚µãƒ¼ãƒãƒ¼ã«è¨å®šã•ã‚Œã‚‹DS RRã®TTLå€¤ã®å¤‰æ›´ã«ã¤ã„ã¦
--------------------------------------------------------------------- â– JP DNSã‚µãƒ¼ãƒãƒ¼ã«è¨å®šã•ã‚Œã‚‹DS RRã®TTLå€¤ã®å¤‰æ›´ã«ã¤ã„ã¦ æ ªå¼ä¼šç¤¾æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJPRSï¼‰ 2013/11/06ï¼ˆWedï¼‰ --------------------------------------------------------------------- JPRSã§ã¯2013å¹´11æœˆ17æ—¥ã‚ˆã‚Šã€JP DNSã‚µãƒ¼ãƒãƒ¼ã«è¨å®šã•ã‚Œã‚‹DSãƒªã‚½ãƒ¼ã‚¹ãƒ¬ã‚³ãƒ¼ ãƒ‰ï¼ˆä»¥ä¸‹ã€ã€ŒRRã€ï¼‰ã®TTLè¨å®šå€¤ï¼ˆä»¥ä¸‹ã€ã€ŒTTLå€¤ã€ï¼‰ã‚’å¾“æ¥ã®86400ï¼ˆ1æ—¥ï¼‰ã‹ ã‚‰ã€7200ï¼ˆ2æ™‚é–“ï¼‰ã«å¤‰æ›´ã—ã¾ã™ã€‚ â–¼å¤‰æ›´ã®èƒŒæ™¯ DNSSECã§ã¯ã€è¦ªã‚¾ãƒ¼ãƒ³ã«è¨å®šã•ã‚ŒãŸDS RRã¨åã‚¾ãƒ¼ãƒ³ã«è¨å®šã•ã‚ŒãŸDNSKEY RR ã«ã‚ˆã‚Šã€ä¿¡é ¼ã®é€£éŽ–ï¼ˆchain of trustï¼‰ã‚’ç¢º
TsuSUZUKI 2013/11/08
7200 (2æ™‚é–“) <= 86400 (ï¼‘æ—¥) ã€2013/11/17ã‚ˆã‚Šã€‚

DNSSEC

TTL

DS

DNS

z.dns.jp
ãƒªãƒ³ã‚¯
ç¬¬86å›žIETF Meetingå ±å‘Šï¼ˆå‰ç·¨ï¼‰ | 2013å¹´ | ãƒ‰ãƒ¡ã‚¤ãƒ³åé–¢é€£ä¼šè°å ±å‘Š | ãƒ‰ãƒ¡ã‚¤ãƒ³åé–¢é€£æƒ…å ± | JPRS
ç¬¬86å›žIETF Meetingï¼ˆä»¥ä¸‹ã€IETF 86ï¼‰ãŒã€2013å¹´3æœˆ10æ—¥ã‹ã‚‰15æ—¥ã«ã‹ã‘ã¦ç±³å›½ã®ã‚ªãƒ¼ãƒ©ãƒ³ãƒ‰ã§é–‹å‚¬ã•ã‚Œã¾ã—ãŸã€‚FROM JPRSã§ã¯ã€ä»Šå›žã‹ã‚‰2å›žã«ã‚ãŸã‚ŠIETF 86ã§å ±å‘Šãƒ»è°è«–ã•ã‚ŒãŸè©±é¡Œã¨ä¼šè°çµ‚äº†å¾Œã®å‹•å‘ã«ã¤ã„ã¦ç´¹ä»‹ã—ã¾ã™ã€‚ å‰ç·¨ã¨ãªã‚‹ä»Šå›žã¯ã€ãƒ‰ãƒ¡ã‚¤ãƒ³åï¼DNSé–¢é€£ã®è©±é¡Œã«ã¤ã„ã¦å ±å‘Šã—ã¾ã™ã€‚ IETFã«ã¯ã€dnsextã¨dnsopã¨ã„ã†äºŒã¤ã®DNSé–¢é€£ãƒ¯ãƒ¼ã‚ãƒ³ã‚°ã‚°ãƒ«ãƒ¼ãƒ—ãŒã‚ã‚Šã¾ã™ã€‚ãã®ã†ã¡ã€dnsextã¯DNS Extensionsã«ç”±æ¥ã—ã¦ãŠã‚Šã€DNSSECã‚’ã¯ã˜ã‚ã¨ã™ã‚‹DNSã®æ©Ÿèƒ½æ‹¡å¼µã«é–¢ã™ã‚‹æ¨™æº–åŒ–æ´»å‹•ã‚’é€²ã‚ã‚‹ãŸã‚ã«çµ„ç¹”ã•ã‚Œã¾ã—ãŸã€‚ DNSSECã®åŸºæœ¬ä»•æ§˜ãŒæ¨™æº–åŒ–ã•ã‚Œå®Ÿé‹ç”¨ãŒé–‹å§‹ã•ã‚ŒãŸã“ã¨ã‚’å—ã‘ã€æœ€è¿‘ã®IETFMeetingã§ã¯dnsext WGã¯é–‹å‚¬ã•ã‚Œãªããªã£ã¦ãŠã‚Šã€ãƒ¡ãƒ¼ãƒªãƒ³ã‚°ãƒªã‚¹ãƒˆã«ã‚ˆã‚‹è°è«–ã¨ã€ã“ã‚Œã¾ã§ã«ææ¡ˆã•ã‚ŒãŸã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒ‰ãƒ©ãƒ•ãƒˆã®æ¨™æº–åŒ–ä½œæ¥ã‚’é€²ã‚
TsuSUZUKI 2013/05/05
"OPTãƒ¬ã‚³ãƒ¼ãƒ‰ã®ã‚µãƒãƒ¼ãƒˆãŒç¾©å‹™åŒ–" éžå®Ÿè£…ã®å ´åˆã€"å¿œç”ã¨ã—ã¦æ˜Žç¤ºçš„ã«FORMERR" "æ‹¡å¼µãƒ©ãƒ™ãƒ«ã‚¿ã‚¤ãƒ—ã®ä½¿ç”¨ãŒã€ŒéžæŽ¨å¥¨ã€" "ãƒã‚¤ãƒŠãƒªãƒ¼ãƒ©ãƒ™ãƒ«ãŒã€Œæ´å²çš„ï¼ˆHistoricï¼‰ã€ã«" "EDNSãƒãƒƒãƒ•ã‚¡ãƒ¼ã‚µã‚¤ã‚ºé¸æŠžã®æ–¹æ³•ãŒå¤‰æ›´"

JPRS

EDNS0

RFC6891

obsolete

RFC2671

DNSSEC

RFC6840
ãƒªãƒ³ã‚¯
Google Public DNS Now Supports DNSSEC Validation
The latest news and insights from Google on security and safety on the Internet Tunasashimi said... Does Google publish any live statistics about the state of its DNS network? March 19, 2013 at 6:48â€¯PM Anonymous said... I'm very happy that you're going full steam into DNSSEC and other DNS security best practices deployment, and want to advocate Google DNS to other people, but alas, you aren't actu
TsuSUZUKI 2013/03/21
DNSSEC

Google
ãƒªãƒ³ã‚¯
çŸ¥ã£ã¦ã¾ã™ã‹ï¼Ÿ DNSã®æµ¸é€å•é¡Œã‚„è¦ªååŒå±…å•é¡Œã€æ¤œé–²ã®å½±éŸ¿ ï¼ ï¼ IT
2012/09/07 2012å¹´8æœˆ31æ—¥ã¨9æœˆ1æ—¥ã®2æ—¥é–“ã«ã‚ãŸã‚Šã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã‚¤ãƒ‹ã‚·ã‚¢ãƒ†ã‚£ãƒ–ï¼ˆIIJï¼‰æœ¬ç¤¾ä¼šè°å®¤ã«ã¦ã€ŒDNS Summer Days 2012ã€ãŒé–‹å‚¬ã•ã‚ŒãŸã€‚ä¸»å‚¬ã¯ã€æ—¥æœ¬DNSã‚ªãƒšãƒ¬ãƒ¼ã‚¿ãƒ¼ã‚ºã‚°ãƒ«ãƒ¼ãƒ—ï¼ˆDNSOPS.JPï¼‰ã€‚IIJãŠã‚ˆã³æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJPRSï¼‰ãŒå”åŠ›ã—ãŸã€‚ DNSOPS.JPã¯ã“ã‚Œã¾ã§ã‚‚ã€BoFã‚„DNSSECã‚¸ãƒ£ãƒ‘ãƒ³ã®ãƒ•ã‚©ãƒ¼ãƒ©ãƒ ãªã©DNSé–¢ä¿‚è€…ãŒé›†ã†å ´ã‚’é–‹å‚¬ã—ã¦ãã¦ã„ã‚‹ãŒã€ä»Šå›žã®ã‚ˆã†ã«DNSã®åˆå¦è€…ã‚’å¯¾è±¡ã¨ã—ãŸãƒãƒ¥ãƒ¼ãƒˆãƒªã‚¢ãƒ«ã‚’è‡ªã‚‰ä¸»å‚¬ã—ãŸã®ã¯ã€å®Ÿã¯åˆã‚ã¦ã€‚æ‰‹æŽ¢ã‚Šã®ä¸ã€1æ—¥ç›®ã‚’DNSã®åˆå¦è€…ã‚’å¯¾è±¡ã¨ã—ãŸæ§‹æˆã¨ã—ã€2æ—¥ç›®ã¯ã€DNSã«é–¢ã™ã‚‹è°è«–ã‚’ç›®çš„ã¨ã—ã¦è³ªç–‘å¿œç”ã‚’é‡è¦–ã—ãŸæ§‹æˆã¨ãªã£ãŸã€‚ ç´„150åã‚’åŽå®¹ã§ãã‚‹ä¼šå ´ã¯åˆæ—¥ã®åˆå‰ä¸ã‹ã‚‰æ—©ãã‚‚æº€å¸ã€‚IIJã®å±±æœ¬åŠŸå¸æ°ã«ã‚ˆã‚‹ã‚ªãƒ¼ãƒ—ãƒ‹ãƒ³ã‚°ã®ã‚ã¨ã€è¬›æ¼”ãŒé–‹å§‹ã•ã‚ŒãŸã€‚ ä¸ãƒ»ä¸Šç´šè€…ã«ã‚‚å½¹ç«‹ã¤ãƒãƒ¥ãƒ¼ãƒˆãƒªã‚¢ãƒ« DNS
TsuSUZUKI 2012/09/11
cf. http://www.atmarkit.co.jp/fnetwork/rensai/dnssec04/03.html , http://www.geekpage.jp/blog/?id=2012/9/10/1

DNS

SOA

DNSSEC

delegation

RRSIG

DS

DNSKEY

ZSK

KSK

NXT
ãƒªãƒ³ã‚¯
.jpã‚¾ãƒ¼ãƒ³ã«ãŠã‘ã‚‹KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã®å®Œäº†ã«ã¤ã„ã¦
--------------------------------------------------------------------- â– .jpã‚¾ãƒ¼ãƒ³ã«ãŠã‘ã‚‹KSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ã®å®Œäº†ã«ã¤ã„ã¦ æ ªå¼ä¼šç¤¾æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJPRSï¼‰ 2011/11/04ï¼ˆFriï¼‰ --------------------------------------------------------------------- 2011å¹´11æœˆ4æ—¥æœªæ˜Žã€.jpã‚¾ãƒ¼ãƒ³ã«ãŠã‘ã‚‹DNSSECéµç½²åéµã®æ›´æ–°ï¼ˆKSKãƒãƒ¼ãƒ«ã‚ªãƒ¼ ãƒãƒ¼ï¼‰ãŒã€JPRSãŒåŒå¹´10æœˆ6æ—¥ã«å…¬é–‹ã—ãŸã€Œç¬¬2å›žã€Ž.jp DNSSECã‚ãƒ¼ã‚»ãƒ¬ãƒ¢ãƒ‹ãƒ¼ã€ ã®å®Ÿæ–½ã«ã¤ã„ã¦ã€ã®ã‚¹ã‚±ã‚¸ãƒ¥ãƒ¼ãƒ«ã®é€šã‚Šå®Œäº†ã—ã¾ã—ãŸã€‚ DNSSECã§ã¯æƒ…å ±ã®ä¿¡é ¼æ€§ã‚’ç¶æŒã™ã‚‹ãŸã‚ã€å®šæœŸçš„ãªéµã®æ›´æ–°ï¼ˆãƒãƒ¼ãƒ«ã‚ªãƒ¼ãƒãƒ¼ï¼‰ ãŒæŽ¨å¥¨ã•ã‚Œã¦ãŠã‚Šã¾ã™ã€‚.jpã‚¾ãƒ¼ãƒ³ã§ã¯é‹ç”¨ã‚¹ãƒ†ãƒ¼ãƒˆãƒ¡ãƒ³ãƒˆã§ã‚ã‚‹JP D
TsuSUZUKI 2011/11/06
DNSSEC

DNS
ãƒªãƒ³ã‚¯
ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã¸ã®.jpã‚¾ãƒ¼ãƒ³ã®DSãƒ¬ã‚³ãƒ¼ãƒ‰ç™»éŒ²ãƒ»å…¬é–‹ã«ä¼´ã†å½±éŸ¿ã«ã¤ã„ã¦ | JPãƒ‰ãƒ¡ã‚¤ãƒ³åã«ã¤ã„ã¦ã®ãŠçŸ¥ã‚‰ã› | æ–°ç€æƒ…å ±ä¸€è¦§ | JPRS
2010å¹´12æœˆ10æ—¥ï¼ˆæ—¥æœ¬æ™‚é–“ï¼‰ã€ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã«.jpã‚¾ãƒ¼ãƒ³ã®DSãƒ¬ã‚³ãƒ¼ãƒ‰ãŒç™»éŒ²ãƒ»å…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ æœ¬æ–‡æ›¸ã§ã¯æœ¬ä»¶ã®æ¦‚è¦ã€ãŠã‚ˆã³DNSã¸ã®å½±éŸ¿ã¨ä»Šå¾Œã®äºˆå®šã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ æœ¬ä»¶ã®æ¦‚è¦ ã‚ã‚‹ãƒ‰ãƒ¡ã‚¤ãƒ³åã®DNSSECæ¤œè¨¼ã‚’å¯èƒ½ã«ã™ã‚‹ãŸã‚ã«ã¯ã€æ¤œè¨¼ã™ã‚‹å´ãŒæŒã¤ãƒˆãƒ©ã‚¹ãƒˆã‚¢ãƒ³ã‚«ãƒ¼ã‹ã‚‰ãã®ãƒ‰ãƒ¡ã‚¤ãƒ³åã¾ã§ã®é–“ã«ã€Œä¿¡é ¼ã®é€£éŽ–ï¼ˆchain of trustï¼‰ã€ãŒæ§‹ç¯‰ã•ã‚Œã¦ã„ã‚‹å¿…è¦ãŒã‚ã‚Šã¾ã™ã€‚ ä»Šå›žã®DSãƒ¬ã‚³ãƒ¼ãƒ‰ã®ç™»éŒ²ãƒ»å…¬é–‹ã«ã‚ˆã‚Šãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã‹ã‚‰.jpã‚¾ãƒ¼ãƒ³ã¾ã§ã®ä¿¡é ¼ã®é€£éŽ–ãŒæ§‹ç¯‰ã•ã‚Œã€JPãƒ‰ãƒ¡ã‚¤ãƒ³åã‚µãƒ¼ãƒ“ã‚¹ã¸ã®DNSSECå°Žå…¥ã«å‘ã‘ãŸæº–å‚™ãŒæ•´ã†ã“ã¨ã«ãªã‚Šã¾ã™ã€‚ DNSã¸ã®å½±éŸ¿ã¨ä»Šå¾Œã®äºˆå®š ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã®å…¬é–‹éµæƒ…å ±ï¼ˆå…¬é–‹éµã¾ãŸã¯DSãƒ¬ã‚³ãƒ¼ãƒ‰ï¼‰ã‚’ãƒˆãƒ©ã‚¹ãƒˆã‚¢ãƒ³ã‚«ãƒ¼ã¨ã—ã¦è¨å®šã—ã€DNSSECæ¤œè¨¼æ©Ÿèƒ½ã‚’æœ‰åŠ¹ã«ã—ã¦ã„ã‚‹ã‚ãƒ£ãƒƒã‚·ãƒ¥DNSã‚µãƒ¼ãƒãƒ¼ã«ãŠã„ã¦ã€.jpã‚¾ãƒ¼ãƒ³ã®DNSSECæ¤œè¨¼ãŒé–‹å§‹ã•ã‚Œã¾ã™ã€‚ ãƒ«ãƒ¼ãƒˆã‚¾ãƒ¼ãƒ³ã®å…¬
TsuSUZUKI 2010/12/10
DS

DNSSEC

JPRS
ãƒªãƒ³ã‚¯
æœ€è¿‘ã®DNSSECã®å‹•å‘
2010/10/19ã€€ã‚³ãƒ¼ã‚¹ï¼šå…ƒç¥–ã“ã£ã¦ã‚Š ã€Œå…ƒç¥–ã“ã£ã¦ã‚Šã€è¨˜äº‹ã¯ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ—§ãƒ–ãƒã‚°[netagent-blog.jp]ã«æŽ²è¼‰ã•ã‚Œã¦ã„ãŸè¨˜äº‹ã§ã‚ã‚Šã€ç¾åœ¨ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆã«åœ¨ç±ã—ã¦ã„ãªã„ãƒ©ã‚¤ã‚¿ãƒ¼ã®è¨˜äº‹ã‚‚å«ã¿ã¾ã™ã€‚ æœ€è¿‘ã®DNSSECã®å‹•å‘ ã“ã‚“ã«ã¡ã¯ã€ãƒãƒƒãƒˆã‚¨ãƒ¼ã‚¸ã‚§ãƒ³ãƒˆæ ªå¼ä¼šç¤¾ç ”ç©¶é–‹ç™ºéƒ¨ã€å¤§é˜ªæ”¯ç¤¾ã®å±±å£ã§ã™ã€‚ä»Šå›žã¯ã€DNS ã®ã‚ãƒ¼ãƒˆãƒ”ãƒƒã‚¯ã®ã²ã¨ã¤ã§ã‚ã‚‹ DNSSECï¼ˆDNS Security Extensionï¼‰ ã«ã¤ã„ã¦ç´¹ä»‹ã—ãŸã„ã¨æ€ã„ã¾ã™ã€‚ ----- DNSï¼ˆDomain Name Systemï¼‰ ã¨ã¯ã€ã”å˜ã˜ã®é€šã‚Šã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆä¸Šã«å±•é–‹ã•ã‚Œã¦ã„ã‚‹éšŽå±¤çš„ãªåˆ†æ•£åž‹ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®ã“ã¨ã§ã€ä¸»ã«ãƒ›ã‚¹ãƒˆåã¨IPã‚¢ãƒ‰ãƒ¬ã‚¹ã®å¯¾å¿œä»˜ã‘ç‰ã«ä½¿ç”¨ã•ã‚Œã¦ã„ã¾ã™ã€‚ç¾åœ¨ã®ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆã«ãŠã„ã¦ã¯ DNS ã¯ã‚‚ã¯ã‚„å¿…è¦ä¸å¯æ¬ ãªã‚·ã‚¹ãƒ†ãƒ ã§ã‚ã‚Šã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆæŠ€è¡“ã®æ ¹å¹¹ã¨ã„ã£ã¦ã‚‚éŽè¨€ã§ã¯ã‚ã‚Šã¾ã›ã‚“ã€‚ã—ã‹ã—
TsuSUZUKI 2010/10/20
dig +nocmd +nocomments +noquestion +nostats -t dnskey . > trusted-key.key

DiG

DNSSEC

sigchase
ãƒªãƒ³ã‚¯
ã‚ãªãŸã®ã‚ãƒ£ãƒƒã‚·ãƒ¥DNSã‚µãƒ¼ãƒãƒ¼ã€DNSSECã—ã¦ã¾ã™ã‹ï¼Ÿã€€ã€Œ.jpã€ã§ã‚‚æ£å¼å°Žå…¥ã€DNSSECã®ä»•çµ„ã¿ã¨æ„ç¾©ï¼œå¾Œç·¨ï¼ž
TsuSUZUKI 2010/10/07
[S/MIME][é›»åè¨¼æ˜Žæ›¸][ãƒ‡ã‚¸ã‚¿ãƒ«ID][æ”¹ã–ã‚“][ãƒ‡ã‚¸ã‚¿ãƒ«ç½²å] ãƒ«

DNSSEC

bind

unbound

nsd

å…¬é–‹éµ
ãƒªãƒ³ã‚¯
ãã®DNSã®å¿œç”ã€æœ¬å½“ã«æ£ã—ã„ã‚‚ã®ã§ã™ã‹ï¼Ÿ ã€Œ.jpã€ã§ã‚‚æ£å¼å°Žå…¥ã€DNSSECã®ä»•çµ„ã¿ã¨æ„ç¾©ï¼œå‰ç·¨ï¼ž -INTERNET Watch
TsuSUZUKI 2010/10/07
[S/MIME][é›»åè¨¼æ˜Žæ›¸][ãƒ‡ã‚¸ã‚¿ãƒ«ID][å…¬é–‹éµ][æ”¹ã–ã‚“][ãƒ‡ã‚¸ã‚¿ãƒ«ç½²å] å›³ã‚ã‚Šã€‚

DNS

DNSSEC
ãƒªãƒ³ã‚¯
1 2 æ¬¡ã®ãƒšãƒ¼ã‚¸