Subject: NSEC-13 conclusion

From: Ólafur Guðmundsson /DNSEXT chair <[email-masked]>
Date: Tue, 11 Dec 2007 11:26:35 -0500

Namedroppers,
There seems to be consensus that the change is acceptable.
The working group is done with NSEC3.

Mark,
please forward this version to the RFC-editor, for publication.

         Olafur

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Tue, 11 Dec 2007 12:28:29 -0500

I have to ask, now that I have time to read the 
document, is there a reason opt-out is optional 
wrt to NSEC3?

Yes I know I'm late in asking, but as things wind 
down I get to catch up on my reading pile.

The reason I'm asking this question is that I am 
concerned (meaning unable to come up with a 
concrete reason) about altering parameters in an 
operating zone.  If there are few NSEC3 records 
to update, I think it is okay.  But if there are 
millions of records, I am not so sure.

Did we consider adding text to encourage liberal use of opt-out?

At 11:26 -0500 12/11/07, Ólafur Guðmundsson /DNSEXT

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Think glocally.  Act confused.

---

From: Mark Andrews <[email-masked]>
Date: Wed, 12 Dec 2007 10:12:05 +1100

> I have to ask, now that I have time to read the=20
> document, is there a reason opt-out is optional=20
> wrt to NSEC3?

You can still want to assert the non existance of a delegation.

Note: the decision of whether to include opt-out or not in NSEC3
has never been decided.  We are still in limbo state on this question.

The most recent version of this WG's "Requirements related to DNSSEC 
Signed Proof of Non-Existence" document, dated June 2006, contains 
the text:

    Editor comments: We believe that [opt-out] is a medium-priority goal or
    desire and should be considered.  Because of the similarity of this
    item to the older "opt-in signed zones" proposal, we recognize that
    consideration of this item may bog down the DNSEXT WG and that a
    decision must be made by the WG chairs.  [Section 8, "Group 5"]

If the audio records were complete I'm pretty sure I could also find the
decision to defer deciding whether NSEC3 should be part of DNSSEC or
not.
 
	Mark

> Yes I know I'm late in asking, but as things wind=20
> The reason I'm asking this question is that I am=20
> concerned (meaning unable to come up with a=20
> concrete reason) about altering parameters in an=20
> operating zone.  If there are few NSEC3 records=20
> to update, I think it is okay.  But if there are=20
> At 11:26 -0500 12/11/07, =D3lafur Gu=F0mundsson /DNSEXT
>   chair wrote:
> >Namedroppers,
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D=
> -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Edward Lewis <[email-masked]>
Date: Wed, 12 Dec 2007 00:04:16 -0500

>You can still want to assert the non existance of a delegation.

If you want to do that, just put an TXT record there saying "Na na 
nana nah" and sign it.  (DNSSEC isn't about asserting anything, it's 
about being able to verify something.)

>has never been decided.  We are still in limbo state on this question.

Well, then let's leave the doc as it is and be done with it.

>Signed Proof of Non-Existence" document, dated June 2006, contains

If it never made it to consensus, then I wouldn't worry about it.

(http://tools.ietf.org/html/draft-ietf-dnsext-signed-nonexistence-requirements-03)

>decision to defer deciding whether NSEC3 should be part of DNSSEC or

I don't see the point of worrying about this, it seems like the WG 
has already agreed to nsec3-13.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

---

From: [email-masked]
Date: Wed, 12 Dec 2007 09:50:57 +0000

> about being able to verify something.)

We have considered that. That would require either an additional query for 
that text record, or that text record, including its signature present in 
every (nsec3) referral. 
Since we need to signal a binary state (a single bit), we thought it is 
efficient to signal that binary state in the NSEC3 record. This would save 
the additional query, or save space (of that text record and the 
signature) in a referral where the cost of packet real estate is already 
significant. Especially when it is for a single bit.

This is the rationale for the 'how' though, not the 'why'.

The rationale for the 'why is it optional' is that anti-enumeration and 
opt-out are two different concepts that is signalled in one record (the 
nsec3 record). The requirement for anti-enumeration does not imply a 
requirement for opt-out, hence it is optional.

Roy

---

From: [email-masked]
Date: Wed, 12 Dec 2007 10:58:29 +0000

> decision to defer deciding whether NSEC3 should be part of DNSSEC or

Mark, I think we did due diligence on that.

On Wed, 10 Jan 2007, Olaf Kolkman, the then WG co-chair issued a WGLC on 
NSEC3:

   http://ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00027.html

On Mon, 5 Feb 2007, during the last call, there was one comment on 
Opt-Out, from Olaf Kolkman, acting without hats, stating the following:

   http://ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00086.html

   In the past I have repeatedly said that I am not happy with the way 
   that OPT-OUT (then called OPT-IN) changes the security model away 
   from the concept that a "zone" is secure. I continue to not be happy
   but consent with the argument that such feature is needed in specific 
   operational environments.

On Fri, 23 Feb 2007, Olaf Kolkman, acting as co-chair, summarized the WGLC 
as follows on this specific point:

   http://ops.ietf.org/lists/namedroppers/namedroppers.2007/msg00132.html

   The opt-in feature used to be contentious but it is clear that
   the consensus in the working group has shifted over the years.

In the presence of his own concern, and absence of other statements on 
nonsupport for OPT-OUT, the co-chair declared consensus.

I do not know of any decision to defer deciding whether NSEC3 should be 
part of DNSSEC or not. I do not know of any decision to defer deciding 
whether opt-out should be part of NSEC3. I've found no evidence on the 
mailing list about a decision to defer either. NSEC3, including opt-out 
was adopted as a working group item.

Note that the quoted text in the requirements document is not contentious 
here. Since 'consideration of this item' [opt-out] did not bog down the 
DNSEXT WG, and that the WG chairs _have_ made a decision (see wglc summary 
above), I do not see why 'we are in still in limbo state on this 
question'.

Regards,

Roy Arends