PING

In this episode of PING, Caspar Schutijser and Ralph Koning from SIDN Labs in the Netherlands discuss their post-quantum testbed project. As mentioned in the previous PING episode about Post Quantum Cryptography (PQC) in DNSSEC with Peter Thomassen from SSE and Jason Goertzen from Sandbox AQ it's vital we understand how this technology shift will affect real-world DNS systems in deployment.The SIDN Labs system has been designed to be a "one stop shop" for DNS operators to test configurations of DNSSEC for their domain management systems, with a complete virtualised environment to run inside. It's fully scriptable so can be modified to suit a number of different situations and potentially include builds of your own critical software components to include with the system under test.Read more about the testbed and PQC on the APNIC Blog and at SIDN Labs:PATAD: The SIDN Labs post-quantum cryptography DNSSEC testbed[Podcast] Testing Post Quantum Cryptography DNSSECA quantum-safe cryptography DNSSEC testbedHow organizations can prepare for post-quantum cryptography

In his regular monthly spot on PING, APNIC’s Chief Scientist Geoff Huston continues his examination of DNSSEC. In the first part of this two-part story, Geoff explored the problem space, with a review of the comparative failure of DNSSEC to be deployed by zone holders, and the lack of validation by the resolvers. This is visible to APNIC labs from carefully crafted DNS zones with validly and invalidly signed DNSSEC states, which are included in the Labs advertising method of user measurement.This second episode offers some hope for the future. It reviews the changes which could be made to the DNS protocol, or use of existing aspects of DNS, to make DNSSEC safer to deploy. There is considerable benefit to having trust in names, especially as a "service" to Transport Layer Security (TLS) which is now ubiquitous worldwide in the web.Read more about DNSSEC and TLS on the APNIC Labs website and the APNIC Blog:Calling time on DNSSEC (Geoff Huston, APNIC Blog, June 2024)'Keytrap' attacks on DNSSEC (Geoff Huston, APNIC Blog, June 2024)DNS topics at RIPE 88 (Geoff Huston, APNIC Blog, June 2024)The Tranco listDNSSEC validation client usage (APNIC Labs)DNSSEC-enabled domains from Cloudflare public DNS (APNIC Labs)

This time on PING, Peter Thomassen from deSEC and Jason Goertzen from Sandbox AQ discuss their research project on post quantum cryptography in DNSSEC, funded by NLNet Labs.Post Quantum cryptography is a response to the risk that a future quantum computer will be able to implement Shor's Algorithm -a mechanism to uncover the private key in the RSA public-private key cryptographic mechanism, as well as Diffie-Hellman and Elliptic Curve methods. This would render all existing public-private based security useless, because with knowledge of the private key by a third party, the ability to sign uniquely over things is lost: DNSSEC doesn't depend on secrecy of messages but it does depend on RSA and elliptic curve signatures. We'd lose trust in the DNSSEC protections the private key provides.Post Quantum Cryptography (PQC) addresses this by implementing methods which are not exposed to the weakness that Shor's Algorithm can exploit. But, the cost and complexity of these PQC methods rises.Peter and Jason have been exploring implementations of some of the NIST candidate post quantum algorithms, deployed into bind9 and PowerDNS code. They've been able to use the Atlas system to test how reliably the signed contents can be seen in the DNS and have confirmed that some aspects of packet size in the DNS, and new algorithms will be a problem in deployment as things stand.As they note, it's too soon to move this work into IETF DNS standards process but there is a continuing interest in researching the space, with other activity underway from SIDN which we'll also feature on PING.

In his regular monthly spot on PING, APNIC’s Chief Scientist Geoff Huston discusses DNSSEC and it's apparent failure to deploy at scale in the market after 30 years: Both as the state of signed zone uptake (the supply side) and the low levels of verification seen by DNS client users (the consumption side) there is a strong signal DNSSEC isn't making way, compared to the uptake of TLS which is now ubiquitous in connecting to websites. Geoff can see this by measurement of client DNSSEC use in the APNIC Labs measurement system, and from tests of the DNS behind the Tranco top website rankings.This is both a problem (the market failure of a trust model in the DNS is a pretty big deal!) and an opportunity (what can we do, to make DNSSEC or some replacement viable) which Geoff explores in the first of two parts.A classic "cliffhanger" conversation about the problem side of things will be followed in due course by a second episode which offers some hope for the future. In the meantime here's the first part, discussing the scale of the problem.Read more about DNSSEC and TLS on the APNIC Labs website and the APNIC Blog:Calling time on DNSSEC (Geoff Huston, APNIC Blog June 2024)"Keytrap" attacks on DNSSEC (Geoff Huston, APNIC Blog June 2024)DNS topics at RIPE88 (Geoff Huston, APNIC Blog June 2024)The Tranco top website RankingsDNSSEC validation client usage (APNIC Labs)DNSSEC enabled domains from Cloudflare public DNS (APNIC Labs)

This time on PING, Philip Paeps from the FreeBSD Cluster Administrators and Security teams discusses their approach to systems monitoring and measurement. Its eMail.“Short podcast” you say, but no, there’s a wealth of war-stories and “why” to explore in this episode.We caught up at the APNIC57/APRICOT meeting held in Bangkok in February of 2024. Philip has a wealth of experience in systems management and security and a long history of participation in the free software movement. So his ongoing of support of email as a fundamental measure of system health isn’t a random decision, it’s based on experience.Mail may not seem like the obvious go-to for a measurement podcast, but Philip makes a strong case that it’s one of the best tools available for a high-trust measure of how systems are performing, and in the first and second order derivative can indicate aspects of velocity and rate of change of mail flows, indicative of the continuance or change in the underlying systems issues.Philip has good examples of how Mail from the FreeBSD cluster systems indicates different aspects of systems health. Network delays, disk issues. He’s realistic that there are other tools in the armoury, especially the Nagios and Zabbix systems which are deployed in parallel. But from time to time, the first best indication of trouble emerges from a review of the behaviour of email.A delightfully simple, and robust approach to systems monitoring can emerge from use of the fundamental tools which are part of your core distribution.Read more about Philip, FreeBSD, Zabbix and Nagios at their websites:FreeBSD Project home pageThe FreeBSD Foundation welcomes donations!The FreeBSD Project and AdministrationPhilip’s home pageZabbix for systems and network monitoringNagios for systems and network monitoring

In his regular monthly spot on PING, APNIC’s Chief Scientist Geoff Huston discusses the question of subnet structure, looking into the APNIC Labs measurement data which collects around 8 million discrete IPv6 addresses per day, worldwide.Subnets are a concept which "came along for the ride" in the birth of Internet Protocol, and were baked into the address distribution model as the class-A, class-B and class-C subnet models (there are also class-D and class-E addresses we don't talk about much).The idea of a sub-net is distinct from a routing network, many pre-Internet models of networking had some kind of public-local split, but the idea of more than one level of structure in what is "local" had to emerge when more complex network designs and protocols came into being.Subnets are the idea of structure inside the addressing plan, and imply logical and often physical separation of hosts, and structural dependency on routing. There can be subnets inside subnets, its "turtles all the way down" in networks.IP had an ability out-of-the-box to permit subnets to be defined, and when we moved beyond the classful model into classless inter-domain routing or CIDR, the idea of prefix/length models of networks came to life.But IPv6 is different, and the assumption we are heading to a net-subnet-host model of networks may not be applicable in IPv6, or in the modern world of high speed complex silicon for routing and switching.Geoff discusses an approach to modelling how network assignments are being used in deployment, which was raised by Nathan Ward in a recent NZNOG meeting. Geoff has been able to look into his huge collection of IPv6 addresses and see what's really going on.Read more about networks and subnets and address policy on the APNIC Web and blogAPNIC's current address policyRFC4632 Classless Inter-Domain Routing (CIDR) (IETF RFC)IPv6 Prefix Lengths (Geoff Huston, blog article)

Doug Madory discusses his recent measurements of the RPKI system worldwide using Oregon RouteViews data, emphasizing its impact on BGP stability and security. He explores the significance of BGP repositories, challenges in data analysis, RPKI protection levels, and advancements in routing security measures. The podcast delves into the evolving landscape of BGP analysis, network traffic analysis, ASPA and ROV implementation, and future technology advancements.

In this episode of PING, APNIC’s Chief Scientist Geoff Huston discusses Starlink again, and the ability of modern TCP flow control algorithms to cope with the highly variant loss and delay seen over this satellite network. Geoff has been doing more measurements using starlink terminals in Australia and the USA, at different times of day exploring the system behaviour.Starlink has broken new ground in Low Earth Orbit internet services. Unlike Geosynchronous satellite services which have a long delay but constant visibility of the satellite in stationary orbit above, Starlink requires the consumer to continuously re-select a new satellite as they move overhead in orbit. In fact, a new satellite has to be picked every 15 seconds. This means there's a high degree of variability in the behaviour of the link, both between signal quality to each satellite, and in the brief interval of loss ocurring at each satellite re-selection window. Its a miracle TCP can survive, and in fact in the case of the newer BBR protocol thrive, and achieve remarkably high throughput, if the circumstances permit. This is because of the change from a slow start, fast backoff model used in Cubic and Reno to a much more aggressive link bandwidth estimation model, which continuously probes to see if there is more room to play in.Read more about Satellites, TCP and flow control algorithms on the APNIC Blog and on the IETF website.An explainer on Coherent Optical Transcievers (Geoff Huston, APNIC Blog 2024)Low Earth Orbit and the Congestion Control Problem (Geoff Huston, APNIC Blog 2023)APNIC Labs measurements of Starlink (APNIC Labs)Comparing TCP and QUIC (Geoff Huston APNIC Blog 2022)Testing LEO and GEO Satellite Services in Australia Transport Protocols and the Network Congestion Control at IETF 110

This time on PING, Dr Mona Jaber from Queen Mary University of London (QMUL), discusses her work exploring IoT, Digital Twins and Social Science led research in the field of networking and telecommunications.Dr Jaber is a senior lecturer in QMUL and is the founder and director of the Digital Twins for Sustainable Development Goals (DT4SDG) at QMUL. She was one of the invited Keynote speakers at the recent APRICOT/APNIC57 meeting held in Bangkok, and the podcast explores the three major themes explored in her keynote presentation.The role of deployed fibre optic communication systems in measurement for sustainable green goalsDigital Twin Simulation platforms for exploring the problem spaceSocial Sciences led research, an inter-disciplinary approach to formulating and exploring problems which has been applied to Sustainable Development-related research through technical innovation in IoT, AI, and Digital Twins.The Fibre Optic measurement method is Distributed Acoustic Sensor or DAS:"DAS reuses underground fibre optic cables as distributed strain sensing where the strain is caused by moving objects above ground. DAS is not affected by weather or light and the fibre optic cables are often readily available, offering a continuous source for sensing along the length of the cable. Unlike video cameras, DAS systems also offer a GDPR-compliant source of data."The DASMATE Project at theengineer.co.ukThis Episode of PING was recorded live in the venue and is a bit noisy compared to the usual recordings, but it's well worth putting up with the background chatter!Read more about Dr Jaber's presentation, the DAS system, Digital Twins and Fibre Optic communications:Intelligent IoT for sustainable development Goals: Keynote talk at APRICOT/APNIC57The recording of Dr Jaber's Keynote talkThe DASMATE project: Assisting the uptake of Active Travel Tower Hamlets, LondonThe DT4SDG group page at QMULCoherent Optical Tranceivers (Geoff Huston, April 2024)

In this episode of PING, APNIC’s Chief Scientist Geoff Huston discusses the European Union's consideration of taking a role in the IETF, as itself. Network engineers, policy makers and scientists from all around the world have participated in IETF but this is the first time an entity like the EU has considered participation as itself in the process of standards development. What's lead to this outcome? What is driving the concern that the EU as a law setting and treaty body, an inter-governmental trade bloc needs to participate in the IETF process? Is this a mis-understanding of the nature of Internet Standards development or does it reflect a concern that standards are diverging from society's needs? Geoff wrote this up in a recent opinion piece on the APNIC Blog and the podcast is a conversation around the topic.Read more about digital sovereignty on the APNIC Blog and on the IETF website.Digital sovereignty and standards (Geoff Huston, APNIC Blog)As the Balance of Security Controls shifts where does responsibility rest? (Kathleen Moriarty, Guest Author on the APNIC Blog)Reflections on Ten Years Past the Snowden Revelations (IETF RFC9446)Pervasive Monitoring is an Attack (IETF RFC7528)