Subject: Re: What are the opt-in issues

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 00:31:48 -0400

Thre are a number

David Conrad <[email-masked]> writes:

> In an attempt to bring the opt-in discussions back out into the light, what
> exactly was the pushback?
> 
> I am not a particular fan of opt-in, however we have implemented delegation
> only opt-in in 3 separate name servers (including both authoritative and
> caching servers), it was painful but it works, and the functionality it
> provides addresses some scaling considerations at least one organization
> involved in large scale DNS operations believe are significant.
> 
> Given the working group seemed to accept the arguments Mark Kosters put
> forth regarding the implications of fully signing .COM (and other TLD
> registries seem to want to follow Verisign into the same scaling swamp as
> quickly as they can), it would seem to me that the value of opt-in has been
> documented.  
> 
> As I have been reminded in the past, the question should be "is there a
> protocol issue here" not "do I like it".  What are the opt-in protocol
> issues?
> 
> Tnx,
> -drc
> 
> 
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 00:41:47 -0400

First, note that the DNS Directorate does not have any real power,
AFAICT (I've only recently been invited to join).  We don't really
make decisions -- instead we bring a bunch of knowledge from various
fields and provide advice to the A/Ds.  I think the best analogy is to
the IESG: the IESG cannot create anything, but they can certainly
destroy something.  Similarly, I do not believe that the DNS
Directorate can dictate policy or direction, but can urge the A/Ds to
stop a potentially dangerous direction.

Specifically on opt-in, there are a number of attacks that full DNSSec
protects against but opt-in re-opens.  In particular there are a few
types of cache poisoning attacks that fall into this category.

One of the real issues is that opt-in severly changes the security
properties of DNSsec in a way that is not completely understood and
without a clear and comprehensive security analysis.  Being a security
person myself I am uncomfortable mucking with security properties
without a clear analysis of the ramifications.  Said cache-poisoning
attacks are one such ramification.  Are there others?  We don't know.
And there-in lies the potential gotchas.

-derek

PS: These "cache poisoning" attacks have also been called "typo
attacks", and I personally discussed these attacks with people in
Minneapolis.  I do not feel like describing them now -- perhaps next
week after I get some rest.