Subject: Re: ROOT?

From: Cengiz Alaettinoglu <[email-masked]>
Date: Mon, 13 Jul 1998 15:08:04 -0700

Harald Tveit Alvestrand on Fri, 26 Jun 1998 09:20:27 +0200 said:
> I glanced through the draft-ietf-rps-auth-01.txt today, and found the
> following paragraph (section 8).
> 
>   A root repository must be agreed upon.  
>   ....
>   In each repository there should be a special repository object named
>   ROOT. This should point to the root repository or to a higher level
>   repository.  This is to allow queries to be directed to the local
>   repository but refer to the full set of registries for resolution of
>   hierarchically allocated objects.
> 
> In other words, one requires that:
> 
> - there be a single, world-wide Root Node for any registry hierarchy
> - any registry can be part of one and only one registry hierarchy.
> 
> Is this a Good Thing, knowing the nightmares we have with this structure
> for DNS (success-but-sued for names, really bad vibes for DNSSEC), X.400
> (anarchy but nobody cares) and X.500 (someone might be It, but nobody knows
> who)?

Harald,

For authorization to work, a record need to point to IANA to start the
authorization delegation chain. This can either be done by hard coding the
public key of IANA in the implementations, or by storing it in a
repository object called ROOT, and hard coding this word (i.e. "ROOT") in
the code. We do not require root to actually run a registry. So for all
practical purposes, the registries architecture (i.e. data distribution,
etc) is flat, but authorization checking is hierarchical.

The scale of DNS and RR is quite different. Because of this, I hope that
we will not have the same problems.

> 
> (Another problem is that the use of mnt-by as an authorization key
> BETWEEN registries requires that mnt-by be globally unique; this may be
> a present feature of the spec?)
> 
> (And of course, the use of mnt-by pointing to other registries means
> that inter-registry communication has to be secure. I assume this is
> a Solved Problem)

yes, this is a solved problem (it is addressed in another draft that
Curtis, I and Ramesh are putting together, it will be ready before the
august i-d deadline).

Thank you for the feedback.

> 
>                                Harald A
> -- 
> Harald Tveit Alvestrand, Maxware, Norway
> [email-masked]
> On holiday June 28 to July 17. Expect delays in responses!
>

---

From: Harald Alvestrand <[email-masked]>
Date: Wed, 15 Jul 1998 20:40:32 -0700

>etc) is flat, but authorization checking is hierarchical.

If IANA is willing to do this, it's OK.
But I think that then the word should not be ROOT, but IANA - be clear
always!

Has Jon Postel agreed to it?

                   Harald A

---

From: Cengiz Alaettinoglu <[email-masked]>
Date: Fri, 17 Jul 1998 11:03:51 -0700

> But I think that then the word should not be ROOT, but IANA - be clear

I will bring this up with the authors before the next revision.

> Has Jon Postel agreed to it?

I talked to Jon briefly. He thinks this is a good idea in general and he
is willing to do his part.