Subject: [dnsop] epp-secdns

From: Edward Lewis <[email-masked]>
Date: Mon, 7 Mar 2005 14:14:05 -0600

Following discussions in the hallways the past few days, and the 
comment from EBW (apparently his posts have fallen into a moderator's 
queue but my responses to him have not), here is a summary of what 
some of us think should be done regarding the timing parameters in 
the EPP draft.

Currently there are four timing parameters:

1) TTL suggestion
2) vInterval (signing frequency parameter
3) startDate
4) endDate

If these dates are not honored, the current situation treats this as a warning.

Here is what we think it ought to become...

1) TTL limit
2) Validity span limit

Treating failure of the server to accommodate these as hard failures.

The rationale is

- The DS RRSet is authoritative only from the parent, making it 
unlike the NS RRSet or glue records.  I.e., there is a reason that 
the child gets to "feedback" to the parent in this case.

- The lack of explicit revocation in DNSSEC means that the parent has 
a responsibility to limit the length of the RRSIG validity period at 
the request/demand of the child.  (The parent has the right not to 
serve the child too.)

- The treatment of a failure to accommodate the request as a hard 
failure is based upon the thought behind this example:

1) Client says "here's my DS, sign it for just a week at a time"
2) Servers says "okay, but warning, I signed it for 2 years."

There's no undoing the publication of a record, you can pull it, but 
someone out there can copy it first and use it in replays.  Akin to 
"privacy", it's hard to rescind information once it goes out, so we 
now think we want to play it conservatively.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Achieving total enlightenment has taught me that ignorance is bliss.
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Mon, 07 Mar 2005 16:54:29 -0500

> queue ...

i'm moving up in the world, but i'm still as dumb as a carp. there isn't
any chance that "parent" and "server" are used interchangably, as the
registry may be the sink for data describing an arbitrary sub-delegation
from some root, and parent and child w.r.t. that arbitrary point.

> 2) Servers says "okay, but warning, I signed it for 2 years."

in the dcp vs harald's-one-bit episode of joy, the client (one bit) does
cause an error if unsatisfied, not a warning.

> now think we want to play it conservatively.

       <complexType name="dcpRetentionType">
         <choice>
           <element name="business"/>
           <element name="indefinite"/>
           <element name="legal"/>
           <element name="none"/>
           <element name="stated"/>
         </choice>
       </complexType>

this only expresses the retention by the policy announcing data collector
(server), not the policy of arbitrary 3rd-parties, which may be "indefinite".

ebw
.