Subject: DNSSEC docset last call

From: [email-masked]
Date: Sun, 23 May 2004 23:32:22 +0000

I'm in favor of shipping out the docs as currently written.

This does not imply that there are areas of the spec that don't 
need work. There are. But what we have now is "good enough" for
what is needed for those who are waiting for deployment.

To paraphrase Moses, "Let my docset go".

--bill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Michael Richardson <[email-masked]>
Date: Mon, 24 May 2004 20:24:34 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Olaf" == Olaf Kolkman <[email-masked]> writes:
    Olaf> The question on the table is what this WG needs to do.

    Olaf> In my previous mail I have listed two possibilities. Taking up
    Olaf> work to prevent zone enumeration while holding the DNSSEC bis
    Olaf> document-set or shipping DNSSEC bis and forgetting about

  Sigh.
  I hate to say this... if we are going to do this, let's do it *now*

  I suggest that some may want to go ahead with DNSSEC deployment
without NSEC.  If doing so, they should not have any NSEC records at all,
nor should their resolvers know what to do with them at this point.

  I think that the chairs should establish a firm time table for doing
this work. It should take no more than 5 weeks.

- --
]     "Elmo went to the wrong fundraiser" - The Simpson         |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Fri, 28 May 2004 16:12:33 +0200

Dear chairs, dear all,

> It would
> help if you make your (motivated) position clearer and provide your
> arguments for taking one of the options. Do so before June 1.

DENIC (7,6 million DE-domains) is looking forward DNSSEC deployment, and 
that rather happening before secure islands appearing under DE may 
endanger the common namespace. However, DENIC will not be able to carry 
this deployment out with the form of the specification as it is today 
(because of a clashing of the NSEC traversal with [*]).

We would be willing to give green light to the current spec if the working 
group could commit to solving the NSEC traversal problem afterwards. Then, 
at that point, the form of the problem should be formalized and well 
defined, with our commitment to contribute to the process. The form of the 
solution (whether NO/NSEC2, or online signing of NXDOMAIN-answers, or 
optional use of NSEC or something else) probably can't be decided at the 
moment. We are aware that providing an open door to the future solution 
might require slight modifications of the current drafts.

Best,
Marcos Sanz
DENIC eG

[*] http://www.denic.de/en/faqs/allgemeine_faqs/index.html#section_185