RFC 2137 (rfc2137) - Page 1 of 11

Secure Domain Name System Dynamic Update

Network Working Group                                    D. Eastlake 3rd
Request for Comments: 2137                               CyberCash, Inc.
Updates: 1035                                                 April 1997
Category: Standards Track


                Secure Domain Name System Dynamic Update

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Abstract

   Domain Name System (DNS) protocol extensions have been defined to
   authenticate the data in DNS and provide key distribution services
   [RFC 2065].  DNS Dynamic Update operations have also been defined
   [RFC 2136], but without a detailed description of security for the
   update operation.  This memo describes how to use DNSSEC digital
   signatures covering requests and data to secure updates and restrict
   updates to those authorized to perform them as indicated by the
   updater's possession of cryptographic keys.

Acknowledgements

   The contributions of the following persons (who are listed in
   alphabetic order) to this memo are gratefully acknowledged:

         Olafur Gudmundsson (>
         Charlie Kaufman [email protected]>
         Stuart Kwan [email protected]>
         Edward Lewis [email protected]>

Table of Contents

      1. Introduction............................................2
      1.1 Overview of DNS Dynamic Update.........................2
      1.2 Overview of DNS Security...............................2
      2. Two Basic Modes.........................................3
      3. Keys....................................................5
      3.1 Update Keys............................................6
      3.1.1 Update Key Name Scope................................6
      3.1.2 Update Key Class Scope...............................6
      3.1.3 Update Key Signatory Field...........................6



Eastlake                    Standards Track