Subject: [Asrg] Re: DNSSEC not deployable

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 04 Jul 2003 10:31:02 -0400

At 07:02 AM 7/4/2003 -0700, Hallam-Baker, Phillip wrote:

> > Keep in mind the DNS-Sec standards exist and ICANN is even
> > implementing
> > some of them. Security of the Domain Name System is being addressed.
>
>This is unfortunately NOT the case.
>
>Despite objections brought by VeriSign, the operators of the .de
>registry, the author of BIND and many others the IETF has refused
>to allow changes to the DNSSEC protocol to address the problem
>of deployment in large zones.
>
>These changes were agreed by the majority of the working group but
>blocked by one of the chairs.
>
>Unless the IESG decides to intervene to reverse this situation
>ubiquitous deployment of DNSSEC will not be possible using the
>IETF approved specification.
>
>There is a lot of work going on in ICANN that concerns the security
>of the root servers, but this is from an operations point of view.
>There is no DNS security work taking place in ICANN of the sort that
>would address the dependency of RMX type schemes.
>
>Regretably the situation is no better with respect to BGP security.
>
>This is going to get fixed, but it will take a couple of years
>before either the IESG is forced to back down from its current
>position or there is general agreement in the industry that it
>is time to take the DNS and BGP standards out of IETF process.

Thank you for pointing this out. Based on this information, does that mean 
that any type of anti-spam scheme that relies on the DNS system 
(RMX/rDNS/etc.) would be inherently insecure? Also, What exactly is the 
nature of the problem with the current DNS-SEC standard?

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 4 Jul 2003 05:44:02 -0700 (PDT)

The problem is not DNSSEC itself its that some people and organisations 
are actively blocking its deployment - and that includes both sides of 
as far issues at dnsop and namedroppers. And the term "rough concensus" 
or "most agree" does not even closely apply there, so that is why some 
are unhappy that WG Chairs are making decisions which may not have 
everybody's support.

P.S. That above just my opinion as outsider not having participated and just 
based on archives and other docs I've read. I'll not go into this again 
and I think ASRG should avoid futher discussions about issues with 
current or proposed DNS standards - these are for other WGs and we have 
enough countroveries to worry about at ASRG.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 04 Jul 2003 11:25:10 -0400

For the sake of consideration of all DNS proposals, we need to know if we 
can rely on the DNS-SEC protocol being implemented. Otherwise, if it will 
never be implemented there is not point in having DNS-based anti-spam 
systems. That's why I suggested in a different thread that we should not 
have this discussion here, but rather solicit an official comment from the 
IESG or IAB on DNS-SEC status in relation to our group.

Yakov

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 04 Jul 2003 11:52:13 -0400

Yakov Shafranovich <[email-masked]> wrote:
> can rely on the DNS-SEC protocol being implemented.

  I disagree.  The problem ASRG is looking at is the spam problem.
DNS security issues SHOULD be referenced and described in drafts, but
any proposed solution SHOULD NOT be dependent on solving security
issues which are outside of the scope of ASRG.

> Otherwise, if it will never be implemented there is not point in
> having DNS-based anti-spam systems.

  I disagree.  DNS based anti-spam solutions will make it more
difficult for spammers to do their business, even without DNSSEC.

> That's why I suggested in a different thread that we should not have
> this discussion here, but rather solicit an official comment from
> the IESG or IAB on DNS-SEC status in relation to our group.

  ASRG is not about solving the security problem for the entire
network.

  If solutions in one area can't be implemented until all other areas
have solutions implemented, then we will never get anything done.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 04 Jul 2003 11:55:54 -0400

At 11:52 AM 7/4/2003 -0400, Alan DeKok wrote:
>..

Point taken - and I guess its time to drop this issue.