Subject: What are the opt-in issues

From: David Conrad <[email-masked]>
Date: Fri, 07 Jun 2002 16:25:12 -0700

Randy,

On 4/16, you wrote:
> after much discussion and struggle, it seems the closest we can get
> to consensus is a compromise with which few if any can not live,
> opt-in restricted to delegation points.

On 6/6, you wrote:
> major pushback from the dns directorate

In an attempt to bring the opt-in discussions back out into the light, what
exactly was the pushback?

I am not a particular fan of opt-in, however we have implemented delegation
only opt-in in 3 separate name servers (including both authoritative and
caching servers), it was painful but it works, and the functionality it
provides addresses some scaling considerations at least one organization
involved in large scale DNS operations believe are significant.

Given the working group seemed to accept the arguments Mark Kosters put
forth regarding the implications of fully signing .COM (and other TLD
registries seem to want to follow Verisign into the same scaling swamp as
quickly as they can), it would seem to me that the value of opt-in has been
documented.  

As I have been reminded in the past, the question should be "is there a
protocol issue here" not "do I like it".  What are the opt-in protocol
issues?

Tnx,
-drc

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Fri, 07 Jun 2002 22:13:26 -0700

A note before I begin.  Derek has earned my deep respect over years, and
no part of what I've got to say here should be thought of as directed at
him, even though I'm going to couch my words here as a reply to his.  I
am quietly outraged at the closed nature of the standards body I thought
I was part of.  My words should be taken personally only by those who
have set up and still maintain a secret second government here.  Derek
is a relative newcomer to DNSDIR (by his own words) and I'm not holding
him responsible for its existence nor for the AD's reliance upon it.

> ...  Similarly, I do not believe that the DNS Directorate can dictate
> policy or direction, but can urge the A/Ds to stop a potentially
> dangerous direction.

So, anyone who thought the WG was anything but a debating society were
confused.  A non-open process will be used to decide what is advanced,
and the visible and open process is just "the show."

> Specifically on opt-in, there are a number of attacks that full DNSSec
> protects against but opt-in re-opens.  In particular there are a few
> types of cache poisoning attacks that fall into this category.

We heard those concerns in the open process -- in the WG, that is -- and
the moderately clear consensus of those involved was "go ahead with it."

However, since the minority opposition included Randy Bush, a non-open
process -- let's call these "the grownups" -- was convened to study the
situation more seriously and make sure that the open process -- let's
call ourselves "the kids" -- weren't going off in some crazy direction.

What a relief.  Now I don't have to pull up stakes in the bar and port
myself and my laptop into a meeting room next time there's a DNSEXT
time slot.  You other kids can go have your fun and games, I'll just sip
my beer and wait for the grownups to meet later in secret and decide
what direction the DNS protocol will take.  Simplicity itself.

> One of the real issues is that opt-in severly changes the security
> properties of DNSsec in a way that is not completely understood and
> without a clear and comprehensive security analysis.  Being a security
> person myself I am uncomfortable mucking with security properties
> without a clear analysis of the ramifications.  Said cache-poisoning
> attacks are one such ramification.  Are there others?  We don't know.
> And there-in lies the potential gotchas.

Well, noone with either DNS experience or security experience has been
entirely comfortable with any version of the DNSSEC specification, ever.
Many of us now treat that condition as a given.  I guess not everybody!

I guess we were deadass wrong back in 1996 when we deliberately proceeded
toward what we thought was a short path toward implementation and 
deployment.  We had at least five more years to debate these matters,
and based on this latest DNS Directorate revelation, it appears that we
have at least one more year of debate remaining.  Goodbye, 2002, we hardly
knew ye.

I call upon Randy Bush to resign as DNSEXT WG co-chair.

---

From: Marshall Rose <[email-masked]>
Date: Fri, 7 Jun 2002 23:09:50 -0700

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

hi. sorry to comment on something that i know absolutely nothing about, i.e., "the opt-in issues".

i will take the blame for having started the concept of an "area directorate" about 10 years ago when i was running the network management area. there are a lot of different goals for a directorate, ranging from "having more eyes on the ground" to "helping mid-level folks become senior level folks". i had pretty good success with the folks on my directorate, and a few even went on to greater things...

what is important to understand is that no directorate has any power whatsoever. a directorate can give advice to some ADs, but ultimately it is the ADs who have to make, and then defend, those decisions. alternatively, the ADs can simply ignore the advice.

citizen D is flat out wrong when he likens a directorate to the iesg. a directorate can not kill anything. they can suggest to some ADs that something be killed, but it is up to the ADs to pull the actual trigger. alternatively, the ADs can graciously thank the directorate for their advice and move on to the next topic.

citizen P is flat out wrong when he says there is a conflict of interest here because an AD is also chair of this working group, and therefore the working group can't mount an effective appeal.

citizen X is flat out wrong when he views a directorate as any kind of a formal body, similar to a working group, a design team, or an AD. a directorate is nothing more than an informal group of folks who advise an AD. and, let's say it again... the AD is free to take their advice, or ignore it, or do both or neither.

the appeals process is clear: wg chair, relevant AD, entire IESG, entire IAB.

if folks aren't happy about the way this "opt-in" thing isn't being handled by the WG chair, go to the relevant AD. if folks aren't happy about what the relevant AD says,, go to the entire IESG. if folks aren't happy about what the IESG says, then go the IAB. if folks aren't happy about what the IAB says, then perhaps you should get back on the court-ordered medication.

again, i appolgize for taking everyone's time.

/mtr

---

From: "Phillip Hallam-Baker" <[email-masked]>
Date: Sat, 8 Jun 2002 11:59:28 -0400

No Marshall, telling us everything is alright and we should just trust the
great and the good is not going to help.

You may be correct in stating what a directorate SHOULD be, however that is
irrelevant. A directorate should not be an informal gatekeeper on the
standards track which is the role the WG chair has attempted to assign to
it.

The issue is not whether the formation of a directorate is legitimate but
whether the role of an unaccountable, unelected directorate meeting in
secret in a standards process is legitimate.

As for your statement that the directorate has no power, I have heard the
statement from a member of the IESG and the Directorate only to then be
directly contradicted as follows. "The Directorate has no power to create
but it does have an effective power to block, the AD would find it hard to
approve a specification against the advice of the directorate." Citizen D.
is apparently not the only member of the directorate who is under the
misapprehension that they hold an informal veto power.

What we are talking about is a case in which their are two specifications,
the status quo and the ammended specification. The power of veto thus
becomes the power of decision.

The right to give advice in a standards process is not the trivial matter
you purport it to be. Given your experience of ISO processes I can't believe
that you don't understand that to be the case.

Moreover your description of the appeals process is incomplete in two
respects. First you miss off step zero in any argument between a WG and a
chair which is for the WG members to tell the chair that they have no
confidence in him and it is time for them to resign. I second Paul's motion.

I have had no confidence in Randy Bush since my first experience of a DNSEXT
meeting. It is the only tme I have ever spoken in a standards group meeting
and been hissed at by the WG chair when I stated my company. I have a pretty
thick skin but I do not find such open intimidation acceptable which is why
I made my earlier complaint concerning the incident to the ADs. That type of
behaviour is I believe calculated to poison the atmosphere of any working
group and discourage particpation by legitimate .

The second respect in which your analysis is incomplete is that the IETF
process is not the final recourse. That is why the irregular procedure
adopted by the WG chair is so problematic. To put it bluntly the companies
that pay ISOC subscription fees to buy indemnity insurance to cover ADs and
WG chairs actions do not do so so that clowns like Bush can behave as if
they can run a working group as their own personal fifedom.

		Phill

---

From: Bill Manning <[email-masked]>
Date: Sat, 8 Jun 2002 13:18:32 -0700 (PDT)

Noting that the WG list <[email-masked]> where most
	of this discussion is moderated by Mr. Bush. 

-- 
--bill

---

From: Brian Wellington <[email-masked]>
Date: Sat, 8 Jun 2002 18:21:28 -0700 (PDT)

On Sat, 8 Jun 2002, Randy Bush wrote:

> [1] - i know this is not the forum for technical issues :-), but
>       here's a timy one that came up last week.  how does opt-in
>       affect ad-is-secure?  it seems to further weaken what
>       receiving ad==true tells a stub resolver.

Why?  Insecure data from an opt-in zone will cause the AD bit to not be 
set in the response.  The AD bit will be set if the response contains only 
secure data from the opt-in zone.

Brian

---

From: Paul Vixie <[email-masked]>
Date: Sat, 08 Jun 2002 19:00:03 -0700

> 	of this discussion is moderated by Mr. Bush. 

i don't think there's any problem with censorship.  ops.ietf.org has the
same A RR as psg.com, indicating that randy not only moderates this
list, he also hosts it.  i'm sure that, other issues aside, randy is
doing everything possible to ensure that the namedroppers list works
and his only moderation activity as far as i know is keeping spam out.

---

From: Paul Vixie <[email-masked]>
Date: Sun, 09 Jun 2002 13:18:18 -0700

the process as i understood it was that if the WG reached consensus the
chair's job was to fwd the relevant drafts to the AD's.  this appears to
have happened.

if the AD's don't feel comfortable with the document, they are supposed
to throw it back to the WG with their concerns and questions noted, in a
timely fashion.  this appears not to have happened.

now we're in an unhappy place.  a subset of the WG (called a directorate)
is meeting and discussing this in closed sessions for the purpose of
advising the AD about these documents.

the delay thus caused, and the lack of transparency, are intolerable.

---

From: "Phillip Hallam-Baker" <[email-masked]>
Date: Sat, 8 Jun 2002 19:57:25 -0400

Randy is incorrect to claim that new technical issues have emerged.

The Typo attack is simply a sub class of an attack that was identified in
the original security analysis. Any party can apply for an unregistered
domain name in a TLD at any time, the authentication criteria applied by
registrars do not include verification that the applicant of the domain name
has provided a bona fide address on which process can be served.

This would have been clarified earlier if the objection had been posted to
the working group where it belongs rather than an unrepresentative and
unaccountable body meeting in secret.

I suspect that if you are allowed to continue to take advice in secret you
can continue to re-raise old technical issues as new ones for a very long
time.

		Phill

---

From: [email-masked]
Date: Sun, 9 Jun 2002 03:02:28 +0000 (UCT)

> and his only moderation activity as far as i know is keeping spam out.

	That was the point. What ever else people may think, Mr. Bush
	is generally an reasonable person. Opinionated. Sarcastic.
	Does not suffer fools gladly. But he does his level best to 
	ensure that the "right" thing happens. Sort of like a number of
	people I know.
	
	Questions regarding what is the "right" thing are, perhaps, not
	open to debate. :)

--bill

---

From: [email-masked] (Ted Lindgreen)
Date: Mon, 10 Jun 2002 09:48:50 +0200

[Quoting "Phillip Hallam-Baker", on Jun 10,  4:06, in "Re: What are the opt ..."]

> has provided a bona fide address on which process can be served.

Phillip,

You are confusing a Registry issue (a security problem due to lack
of proper administration) with a security hole inside the protocol
itself. The fact that the former exists at some Registries does not
mean we don't need to care about the latter.

-- ted

---

From: "Phill" <[email-masked]>
Date: Mon, 10 Jun 2002 09:24:57 -0400

>mean we don't need to care about the latter.

No I am performing a security analysis of a system as opposed to a
single component. Analysis of the system is almost always the preferred
choice for an application protocol.

I am fully aware of the fact that a security analysis that is performed
in one context may fail in another. For example 4 digit account PINs
works for ATM cards but has major failure modes when used on the
Internet. Knowing the appropriate security analysis to apply is my job.
That is why I frequently advise against blindly reusing protocols in
applications that are beyond the context of the original security
context.

The decision to fully sign or OPTIN sign a zone is acknowledged to have
security implications. You should not use OPTIN unless you have
determined that either an insertion attack is not an issue (as is the
case for the registries) or the cost of fully signing the domain is
greater than the probability of an insertion attack multiplied by the
cost of the damage caused.

The term 'security hole' is not appropriate in this instance. A security
hole is by definition an error in the design. A limitation of the
applicability of a protocol is not a security hole if that limitation is
clearly stated.

		Phill

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Jun 2002 17:20:43 +0200 (CEST)

> chair's job was to fwd the relevant drafts to the AD's.  this appears to

I'll respond to this thread in more detail once I've caught up with it.
But this particular point warrants a short response.

I have not seen the opt-in documents be forwarded to me as an AD.
They are not on http://www.ietf.org/IESG/status.html

I also think that the current draft is about unrestricted opt-in
and the rough consensus discussion in Minneapolis was about opt-in
restricted to delegation points. Thus I don't think there is or ever was
a draft that *could* have been forwarded to the AD.

I would expect, assuming for a second that we continue down the path of
opt-in restricted to delegations, that the document would actually specify 
how servers check this (and whether the resolver verification is any 
different due to the restriction).

   Erik

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Jun 2002 17:35:01 +0200 (CEST)

> When
> the AD is the chair of the working group and most of the experts consulted
> are a subset of the working group chosen by the chair/AD it becomes
> something else.

Phillip,

Last time I checked I was the AD for DNSEXT and I was not one of the co-chairs.
Randy is the AD for DNSOP.

   Erik

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 11 Jun 2002 11:37:24 -0700

Let us rewind, at this point we have been told that this issue has been
discussed in the DNS Directorate and at the IESG retreat. The one place that
discussion does not appear to be taking place is in the working group where
it belongs.

The original question was whether the Working Group Chairs had come to a
decision concerning the consensus within the group regarding OPTIN. In this
regard the WG chairs have only three options:

	WG consensus is for full OPTIN
	WG consensus is for OPTIN restricted to delegation zones
	WG consensus is for no OPTIN

I have re-read the RFC section that concerns directorates. As Erik points
out directorates advise the ADs, at no point is there any statement that
says that a WG chair can consult a directorate to determine the consensus of
a WG.

If the WG consensus is in favor of full OPTIN then the existing documents
can be forwarded to the AD. Otherwise we simply modify the draft to state
the restriction and if there is consensus that this is done properly
(appropriately enforced etc.) the document goes forward.

Only after the document goes to the AD is it appropriate for the AD to
consult the DNS directorate.

The technical merits of OPTIN do not enter into the issue at this point. The
question being asked is what the working group consensus is, not the
consensus of the directorate.

There may of course be value in the DNS directorate anticipating the OPTIN
document at a moment when people happen to be in one physical location.
However such a discussion should not prevent the regular process of the
working group being followed. 

What we need is the co-Chair's statement on consensus, or if that is not
going to be forthcomming should we simply take the statement by the AD as
indicative of the consensus and proceed on that basis (i.e. make the mods to
the draft etc) ?

		Phill

> -----Original Message-----
> From: Erik Nordmark [mailto:[email-masked]]
> Sent: Tuesday, June 11, 2002 11:21 AM
> To: Paul Vixie
> Cc: namedroppers
> Subject: Re: What are the opt-in issues 
> 
>

---

From: "Phill" <[email-masked]>
Date: Wed, 12 Jun 2002 10:37:02 -0400

>this is drivel.  i can ask whomever i want for any advice i want any
>time i want.  jeezus!

NOT if you are telling the group that you won't talk to them until
secret deliberations are complete.

There is no impediment whatsoever to your telling the group your
decision on consensus. Your refusal to do so is holding up the group.

Since the AD has given his opinion of what the consensus of the group is
should we simply bypass Randy and proceed on that basis?

		Phill

---

From: Greg Hudson <[email-masked]>
Date: 13 Jun 2002 10:39:26 -0400

On Thu, 2002-06-13 at 09:05, Erik Nordmark wrote:
> I (and I think others) have meta-concerns which are a lot harder to deal with.
> They relate to handling the unknown; folks seem to be discovering
> new techncial corner cases at some rate.

This can't be treated purely as a meta-issue.  If I raised the question
"How will opt-in affect the care and feeding of my dog?", then it
wouldn't be appropriate for the ADs to use it as justification for
worrying about opt-in.  (Especially since I don't have a dog.)  You have
to actually look at the questions raised and ask whether they cast any
significant doubt on opt-in.

How opt-in affects AD-is-secure is a complete non-issue.  Unsigned
records in an opt-in zone aren't secure data, so AD=0.  Nobody should be
confused about this unless they havent't read the AD-is-secure draft
recently, and those people aren't going to be helped by explicit
statements, so there's nothing to worry about here.

Roy also raised the question of whether a caching resolver might have to
do weird, error-prone TTL calculations in order to cache one copy of a
NXT record for both positive and negative replies.  I don't think this
is a significant issue because:

  * Any security issues it might raise would at worst be of the denial
of service type, since TTLs do not affect the cryptographic
authenticaticity of records.

  * It's quite easy for a cache to avoid this issue by not making the
stated optimization.

  * I doubt that the required TTL calculations are any more complicated
than they are for other sorts of answer synthesis.