Subject: Re: Please advance draft-ietf-dnsind-tsig-09.txt

From: John Gilmore <[email-masked]>
Date: Wed, 28 Jul 1999 14:57:57 -0700

> From: Dennis Glatting <[email-masked]>
>
> > TSIG should not be mandatory to implement.  It's a poor
> > cryptographic design providing very minimal security, which
> > has no hope of scaling. It was intended from the beginning as a
> > stopgap.
> 
> As a non-stopgap measure, when can we expect the roots to offer
> DNSSEC services?

This is a red herring.  The roots do not, and will not, offer TSIG
services either.

I know of several TLDs that are investigating DNSSEC support for their
TLD.  Presumably this means getting their zone's KEY and SIG glue
records into the root zone.

Getting the entire root zone signed with DNSSEC is caught up in the
IANA/ICANN mess, and will probably take a while.  NSI, who currently
manages the root zone under contract, is still being recalcitrant
about taking orders from ICANN; and ICANN has bigger things on its
plate than signing the root zone.

There's no reason to expect DNSSEC to appear at the root, the leaves,
or any other particular part of the tree first.  It can be used at any
level of the tree that chooses to implement it.  The biggest payoff
for you is when every level from the root to your domain implements
it.  Even if the root was signed, .COM isn't.  (CORE built
infrastructure that would let them sign their TLDs, but the
politicians and NSI subverted their chance to get working TLDs.)
Ask NSI when they will implement DNSSEC, since your domain
(software-munitions.com) has NSI between you and the root.

	John

---

From: "Richard J. Sexton" <[email-masked]>
Date: Thu, 29 Jul 1999 11:53:18 -0400 (EDT)

Neither ICANN nor NSI have any control over the root zone. Becky
Burr in DoC/NTIA does, soley.

NSI wanted to add some more .COM nameservers; Becky wouldnt let them
add those pointers to the root zone.  One might ask, as the com
zone doubles in suze every six monts to a year, how this meshes
with her credo of "keeping the trains running on time". At least
one cctld has mentioned thay were also denied being allowed to
change a contact address in their domain record. The legacy
root zone is frozen, solid.

Best of luck on your efforts.

>Return-Path: <[email-masked]>
>Delivered-To: [email-masked]
>X-Authentication-Warning: toad.com: Host localhost [127.0.0.1] didn't use
HELO protocol
>To: [email-masked]
>Cc: John Gilmore <[email-masked]>,
>	Olafur Gudmundsson <[email-masked]>,
>	Robert Elz <[email-masked]>,
>	Thomas Narten <[email-masked]>,
>	Erik Nordmark <[email-masked]>,
>	Randy Bush <[email-masked]>, [email-masked], [email-masked]
>Subject: Re: Please advance draft-ietf-dnsind-tsig-09.txt 
>Date: Wed, 28 Jul 1999 14:57:57 -0700
>From: John Gilmore <[email-masked]>
>Sender: [email-masked]
>

--
Richard Sexton  |  [email-masked]  | http://dns.vrx.net/tech/rootzone
http://killifish.vrx.net    http://www.mbz.org    http://lists.aquaria.net
Bannockburn, Ontario, Canada,  70 & 72 280SE, 83 300SD   +1 (613) 473-1719