Subject: Re: Confirming the Nominet position

From: "Jay Daley" <[email-masked]>
Date: Thu, 27 May 2004 21:24:24 +0100

Bill

[email-masked] wrote on 27/05/2004 14:54:25:

>    to make it easier to track, would "watermarking" the
>    database be helpful?

Possibly, but we would need to decide whether to do this by IP address, by 
zone etc. (which may not be as trivial as it seems).  Whatever the way 
this is still an after-the-fact control mechanism and those are arduous 
and expensive to pursue.  This is something we unfortunately have a lot of 
experience of ... http://www.vnunet.com/news/1154488

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Fri, 28 May 2004 13:03:03 +0000

> experience of ... http://www.vnunet.com/news/1154488

	Beating this dead mule...  Digitally signing the data provides an
	un-ambigious, hard to forge, proof that the zone and each RR in the
	zone was signed by a unique source. This "watermark" technique is being 
	considered by some to dis-abmbigious potential conflicts.
	YMMV.

--bill

---

From: [email-masked] (Geoffrey Sisson)
Date: Fri, 28 May 2004 14:42:57 +0100 (BST)

> 	considered by some to dis-abmbigious potential conflicts.

Hi Bill

Are you suggesting the use of steganography to somehow uniquely
identify RRs, or set of RRs, by whomever retrieved them?  Or are you
suggesting the use of the RRSIGs as legal evidence of the unambiguous
origin of the zone data?  Or something else?

Regards

Geoff

---

From: Ben Laurie <[email-masked]>
Date: Fri, 28 May 2004 16:01:15 +0100

[email-masked] wrote:
> 	zone was signed by a unique source.

I don't see how that helps Nominet, since, by definition, if it ends .uk 
it'll be on their servers and the signatures would surely not be 
preserved in a list of .uk domains.

> This "watermark" technique is being 

I don't understand what this means?

Cheers,

Ben.

---

From: [email-masked]
Date: Fri, 28 May 2004 15:16:21 +0000

> origin of the zone data?  Or something else?

	i've been told that digital signatures can be used as
	legal evidence in some jurisdictions. if true, it is 
	conceivable that by my holding signed data indicates,
	if not the path by which i received said data, who signed the
	data.  

-- bill

---

From: [email-masked]
Date: Fri, 28 May 2004 15:39:46 +0000

> preserved in a list of .uk domains.

	er... not at all.  the server @ 198.32.2.10 has had 100,000s
	of RRs that end in uk. locally stored.  - I could slurp them into 
	zone file format and publish it as uk. for the server users.  Not 
	a Nominet server(s) and not Nominet data.  QED.

> I don't understand what this means?

	How does one distinguish the Nominet collection of data that
	ends in uk. and the Msrs Bill, Ben & Geoffs collection of data 
	that ends in uk.?

	The simple way is to "watermark" the dataset and it elements
	with digital signatures.  ergo the database entry  "co.uk."
	with a Nominet signature is clearly signed by Nominet and 
	presumably they acknowledge that the data so signed is 
	authentic to Nominet.

	One might presume that a careful application might be able
	to distinguish a "co.uk." signed by Msrs Bill, Ben & Geoff and 
	a "co.uk." signed by Nominet.  

	And it might even be reasonable to consider the possiblity of
	Nominet being grumpy about finding the unauthorized republication
	of signed Nominet data by Msrs Bill, Ben & Geoff... don't you think?

	One should be careful to mind the huge gaps in thinking here, but
	it is a plausable argument to digitally sign your zones & data.

--bill

---

From: [email-masked] (Geoffrey Sisson)
Date: Fri, 28 May 2004 17:08:59 +0100 (BST)

Hi Bill

Thanks for the clarification.  As you say, it's possible that RRSIGs
could be used to show unambigiously that the data originated from a
particular source, but it's unlikely that RRSIG data would be left in
unauthorised copies of zones, if for no other reason than they would
likely to be seen to consume storage unneccessarily.  (I expect
elaboration tools will summarily discard them!)

Regards

Geoff

---

From: Edward Lewis <[email-masked]>
Date: Fri, 28 May 2004 14:03:49 -0400

>	if not the path by which i received said data, who signed the

Evidence != conclusion.  I'm sure a digital signature is worthless if 
the private key needed to generate it is "widely" known.  Much like 
having the keys to a car that caused the accident doesn't mean you 
were driving it at the time.

Sorry, I think I've strayed into a legal discussion...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

Even the voices inside my head are refusing to talk to me anymore.

---

From: [email-masked]
Date: Fri, 28 May 2004 18:11:13 +0000

On Fri, May 28, 2004 at 02:02:35PM -0400, Derek Atkins wrote:
> Except signatures can be removed.

	see above.  in the example, I end up holding signed 
	data.

> I could remove it in my copy, so you
> couldn't verify the origin of the document.

	and -you- are smarter than the average bear. :)

> Watermarking needs to be performed _IN_ the document, not by a
> signature.  And all watermarking techniques have been shown to be
> breakable via collusion of multiple recipients of the data.

	yes... note again (earlier in thread) that watermark was
	quoted. that was intentional.

> -derek

---

From: Derek Atkins <[email-masked]>
Date: Fri, 28 May 2004 14:02:35 -0400

> 	if not the path by which i received said data, who signed the

Except signatures can be removed.  For example, if I were to
(theoretically) illictly obtain a signed document, I could use
the signature to prove to someone that W went to war in Iraq
without proof of WMD.  However I don't have to reproduce that
signature in all cases, I could remove it in my copy, so you
couldn't verify the origin of the document.

-derek
-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant