Subject: the birth of DNSSEC

From: Edward Lewis <[email-masked]>
Date: Wed, 19 Mar 2008 13:39:50 -0400

I discovered I do have a copy of the old DNSSEC WG archives on my 
laptop (someone asked).  For grins and giggles, here is the oldest 
message I have (perhaps the first on the list, but I am not sure):

(Note: DNSSEC does not appear in this message.  The first mention of 
DNSSEC is in a message dated Feb 23, 1994.)

Reply-To: James M Galvin <[email-masked]>
To: [email-masked]
Subject: DNS Security Sub-Working Group
Date: Thu, 28 Oct 1993 10:44:33 -0400
From: James M Galvin <[email-masked]>

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"

The DNS Security Sub-Working Group will meet at the Houston IETF.  The
exact placement within the DNS meeting has not been determined, yet.
Unfortunately, it took somewhat longer than desirable for Rob and I to
get together on when the meeting should be.  Rob prefers that the
sub-group meet prior to the DNS working group meeting so we can bring
"results" for discussion rather than having an open meeting.  The
problem is that it is really late to be scheduling a meeting time.

So, I'm going to try to organize a meeting time for the security
subgroup.  If you would like to attend, please send me a note saying so
and tell me when you are available.  I will find a time that is
convenient for the most people and post an announcement, on the message
board at the IETF.  Sorry, but that is the best I can do at this time.
On to the real work....

What I've done is to go through all of the mail I've seen on DNS
security from the following places: namedroppers, ipsec, dns-security,
and firewalls.  From the mail I've identified the issues and have
summarized them below.

I would like to point out that one thing we have not done yet is to
identify the threats against which we are providing protection, and then
to document them.  For the meeting agenda I would like to propose the
following:

	o identification of threats (and justifying rationale) in
	  preparation for a document

	o review of issues

		- do we understand the issues documented

		- is this the right set of issues

	o development of plan and schedule for deliverables, not to
	  exceed two more IETF meetings

I have cc'ed the namedroppers list on this message for information only.
Please keep the discussion on the [email-masked] mailing list.  If
you are not on the list and wish to join please send a message to
[email-masked].

Thanks,

Jim

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"

Resolved Issues For DNS Security

1. The DNS application should support security services itself, i.e., it
    can not depend on the security services of another layer, for
    example, IP.

    In support of this position is the point made first by Steve
    Bellovin.  Network-level security provides identification and
    authentication, but not authorization.  The DNS requires
    authorization.  Christian Huitema also noted that the source of the
    DNS data is not the DNS, per se, but some administrator.  Thus, the
    data needs to be signed by this administrator, not the DNS.

Unresolved Issues for DNS Security

1. On the firewalls mailing list, there was a fair amount of discussion
    of the use of the DNS in firewalled environments.  I would like to
    suggest that this group take as an action item to produce an
    informational document that addresses this issue.

2. Insofar as PEM is a technology that provides key management services,
    the DNS could make use of it to distribute certificates.  However, it
    has also been suggested that the DNS could distribute its own
    certificates by specifying a new resource record.

    The following subissues are relevant to this discussion.

    a. If the DNS is "secure", could we store/distribute just keys
       in/with it, or do we need certificates?

    b. If we store certificates, and even large keys, their distribution
       or inclusion in DNS replies may exceed the maximum size allowed.
       Two suggestions have been made.  First, we could propose a
       parallen DNS-like server that does not have the limitation.
       Second, we could specify MX-like records that point to "key"
       manager services.

    c. Could SNMP be used to distribute the key/certificates?

3. In order for key management to be effective, the key must be "bound"
    to an object that identifies it.  For example, in PEM the public keys
    are embodied in a certificate that binds the distinguished name of
    owner of the public key to the key.

    In the case of DNS, the question is should the key be bound to the
    address (or other data) record, the domain name, or both?

------- =_aaaaaaaaaa0--
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Never confuse activity with progress.  Activity pays more.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Wed, 19 Mar 2008 18:13:55 +0000

>     c. Could SNMP be used to distribute the key/certificates?

I think this is a fine plan.

Alex