Subject: RE: relevent?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 24 May 2004 11:29:29 -0700

Paul,

	This is not what is being asked for.

	I don't think anyone wants to delay DNSSEC bis. I certainly do not
want to do 11th hour design. You are completely right about opening cans of
worms. I don't want to end up with yet another half-baked fix up that only
solves half the problems.

	All that is needed at this stage to meet everyone's immediate needs
is to change the DNSSEC docs so that a zone can say that it does not support
NSEC. It would be good if it could also state what it does support. There
would be a stiff Security Considerations item that says that this creates
serious vulnerabilities.

	All that is really needed at this stage is a versioning mechanism
for the NSEC record. I do not think that any reasonable person could state
that there is a consensus here that there is absolutely no possibility that
NSEC needs to be revised. That has already happened several times.

	Basically its just a signed return that says 'NSEC not supported,
see the X,Y or Z records instead'.

	We all understand that there will be deployment issues and that any
proposal comming out of the gate late will be at a disadvantage. This does
not matter, if DNSSEC is so successfull that it does not need fixing then
great!

		Phill

> > I'm sorry to be dense, but I don't follow how NO didn't work.  ...
> > Don't get me wrong, I'm not trying to push a NO solution ...
> 
> and yet, you must.  perhaps that's the component i'm seeing 
> that others
> here are not.  if we're going to reopen the dnssec design, 
> then we have
> to re-evaluate NO, opt-in, as well as NSEC2, and anything else lurking
> in the shadows.  anything we don't evaluate fully enough, will clearly
> just become an 11th hour showstopped 18 months from now when 
> we next feel
> ready to start deployment.  therefore, if this WG decides to 
> adopt NSEC2,
> we have to broaden the net to include competing proposals, 
> some of whom
> were shot down just because of the lateness of the hour 
> rather than for
> functional reasons.
> 
> --
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>