Subject: [DNSOP] WGLC: Requirements for Management of Name Servers for the DNS

From: Peter Koch <[email-masked]>
Date: Wed, 18 Mar 2009 17:31:32 +0100

Dear WG,

this is to initiate a working group last call on

        "Requirements for Management of Name Servers for the DNS"
        draft-ietf-dnsop-name-server-management-reqs-02.txt

ending Friday, 2009-04-10, 23:59 UTC.  The tools site gives easy access to
diffs and such under
 <http://tools.ietf.org/html/draft-ietf-dnsop-name-server-management-reqs-02>.

The document is aimed at a status of "Informational".

Please review the draft and send comments and/or statements of support or
non-support to the WG mailing list.
There will be a five reviewer threshold. Not taking silence as consent,
the chairs would like to encourage feedback from non-members of the former
"dcoma" design team.

-Peter [for the wg chairs]

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 09:37:22 -0700

>         draft-ietf-dnsop-name-server-management-reqs-02.txt
Peter - I notice that the standards don't say anything about the EU's 
Data Integrity Directive which in fact will effect the operations of all 
public content systems including the DNS servers which are operated in 
the EU. Why was this never designed into the spec is interesting since 
the specification may "by law not be used in about 1/3 of the populated 
world now" without that consideration being in place.

Todd Glassey
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>
>

---

From: [email-masked]
Date: Wed, 18 Mar 2009 16:53:28 +0000

> world now" without that consideration being in place.

Todd,

A Google search for the term "Data Integrity Directive" returns only one 
(irrelevant) result.

Could you perhaps let us know which EU Directive you really meant?

regards

Ray

-- 
Ray Bellis, MA(Oxon) MIET
Senior Researcher in Advanced Projects, Nominet
e: [email-masked], t: +44 1865 332211

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 18 Mar 2009 10:12:42 -0700

>non-support to the WG mailing list.

I have just re-read the draft and support its publication. Wearing my security-weenie hat, I find that section 4 is an excellent, concise set of security requirements.

--Paul Hoffman, Director
--VPN Consortium

---

From: Joe Abley <[email-masked]>
Date: Wed, 18 Mar 2009 13:17:48 -0400

On 18 Mar 2009, at 12:37, TSG wrote:

> Peter - I notice that the standards don't say anything about the  
> EU's Data Integrity Directive

I can't comment on that directive in particular (if indeed such a  
directive with that name exists, per later mail) but in general I find  
it a feature that a document with operational focus addressed to the  
whole Internet should steer clear of regional policy requirements.

Joe

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 10:28:17 -0700

[email-masked] wrote:
> A Google search for the term "Data Integrity Directive" returns only 
> one (irrelevant) result.
>
Uh, sorry - here are a few of the many links provided. The EU has all 
sorts of new Directives on Data Integrity and the IETF can thank the 
RFC3161 team for some of this.

o-  
http://www.google.com/search?q=eu+data+protection+directive&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a

o-  http://ec.europa.eu/justice_home/fsj/privacy/index_en.htm

o-  http://www.cdt.org/privacy/eudirective/EU_Directive_.html

Those same standards directly apply to anything using time to invalidate 
the use of a policy control - as in a time, DNS, NEA, or  most other 
time-policy controlled servers - and that is for ANY digital control 
purpose.

That same requirement (to prove the actual functionality in a 
world-class test environment that meets the needs of the EU) actually 
prevents RFC3161 or any other IETF standard which wasn't tested under 
those standards from being deployed since the law now pertains to all 
systems in place and has no grandfathering provision to address legacy 
systems designed and implemented before those requirements were put into 
place.

As to who is responsible, the WG Chairs and the project Sponsors and 
IMHO you can also thank the IETF's  legal service for this failure since 
it is their direct responsibility to advise the IETF on these key issues 
of International Law.

The real issue *** AGAIN *** is whether IETF standards were tested in 
environment's which stress the protocol or technology based on these 
operating requirements. In all instances to date the answer is no 
meaning that unless the EU creates a specific exemption for the IETF's 
standards it by its own laws MAY NOT RELY ON IETF WORK PRODUCT for 
anything...

Todd Glassey

> ------------------------------------------------------------------------
>

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Wed, 18 Mar 2009 13:33:21 -0400 (EDT)

Yeah, I agree with Joe here.  If one local initiative starts meandering 
in, then all of them would follow in too.

On Wed, 18 Mar 2009, Joe Abley wrote:

>> Peter - I notice that the standards don't say anything about the EU's Data 
>> Integrity Directive
>
> I can't comment on that directive in particular (if indeed such a directive 
> with that name exists, per later mail) but in general I find it a feature 
> that a document with operational focus addressed to the whole Internet should 
> steer clear of regional policy requirements.
>
>
> Joe

wfms

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 10:36:50 -0700

Joe Abley wrote:
>> Data Integrity Directive
Then commentary needs to be added to the Boiler Plate that no regional 
issues were addressed in the testing - hence a test bed based on the 
requirements for operating a data-center in the EU were not considered.  
That's OK but it means that many in the EU may not be able to deploy 
those protocols in their operating environments until those specific 
implementations are tested now that the audit world is waking up to its 
responsibilities under the digital evidence requirements globally.

If this turns out to be true - it will effect all IETF standards in use 
today in the EU.

Todd Glassey

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 10:38:27 -0700

William F. Maton Sotomayor wrote:
>
> Yeah, I agree with Joe here.  If one local initiative starts 
> meandering in, then all of them would follow in too.

... (in my best sarcastic tone) So then you are saying that the IETF 
will exclude the testing of its protocols in real-world use models. Cool 
- that makes a lot of good sense (yeah right).

Todd Glassey
>> directive with that name exists, per later mail) but in general I 
>> find it a feature that a document with operational focus addressed to 
>> the whole Internet should steer clear of regional policy requirements.
>>
>>
>> Joe

---

From: [email-masked]
Date: Wed, 18 Mar 2009 19:39:46 +0100 (CET)

> > whole Internet should steer clear of regional policy requirements.

Agreed.

> requirements for operating a data-center in the EU were not considered.  

I see no way that "Directive 95/46/EC of the European Parliament and of
the Council of 24 October 1995 on the protection of individuals with
regard to the processing of *personal data and on the free movement of
such data*" (my emphasis) is relevant for this requirements document.

> responsibilities under the digital evidence requirements globally.

I note that this is a directive from 1995. Yes, we have seen effects of
this directive, even here in Norway (not a EU member) - but I think you
are going way beyond what the EU directive is meant to cover when you
say it is relevant for the name server requirements document.

My opinins only, IANAL.

> If this turns out to be true - it will effect all IETF standards in use 

The EU directive deals with explicitly *personal data* and the storage
and movement of such data. It does not deal with *all data*.

Steinar Haug, Nethelp consulting, [email-masked]

---

From: SM <[email-masked]>
Date: Wed, 18 Mar 2009 15:30:57 -0700

>whole Internet should steer clear of regional policy requirements.

I couldn't find such a directive.  The question might have been 
raised due to some confusion with the directive about data 
protection.  The draft is about the requirements for a management 
system for DNS name servers instead of country-specific policy requirements.

Regards,
-sm

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 15:32:07 -0700

> meandering in, then all of them would follow in too.
I forgot to bring up that you are apparently saying that Standards are 
exempt from the laws of this planet. Is this more of the "pay no 
attention to the man in the white coat" commentary?

Todd

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 15:53:49 -0700

SM wrote:
> I couldn't find such a directive.  The question might have been raised 
> due to some confusion with the directive about data protection.  The 
> draft is about the requirements for a management system for DNS name 
> servers instead of country-specific policy requirements.
The Data Integrity and Security Models apply to the DNS systems as well. 
Since these are key to the security models which are used to protect 
privacy impacted and financial data they are also included. I think  
this is inherently obvious, in fact its so obvious that arguing about it 
is silly. The access model for the (seamless information control/access 
process) at hand is also controlled by the Data Integrity directives 
too. The idea that the systems which control access to these protected 
data are not also protected is laughable IMHO

Todd

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 17:04:57 -0700

Let's us paint a picture...
>>  
> The Data Integrity and Security Models apply to the DNS systems as 
> well. Since these are key to the security models which are used to 
> protect privacy impacted and financial data they are also included. I 
> think  this is inherently obvious, in fact its so obvious that arguing 
> about it is silly. The access model for the (seamless information 
> control/access process) at hand is also controlled by the Data 
> Integrity directives too. The idea that the systems which control 
> access to these protected data are not also protected is laughable IMHO
>
> Todd
>>
So a Medical Records Purveyor in the UK puts their data online for 
Doctor's to download. And because of the BGP4 Routing Flap the MitM 
Attack is seamlessly functional. After some period of time the DNS 
records in the master Root Server are compromised and the pointer to the 
Records Bureau is changed to point to a server being operated off of a 
boat in the Indian Ocean. This one is specific to a particular person's 
medical history, and so then you as the competent member of the Treadway 
project simply contaminate the person's food with some shellfish extract 
and poof - Anaphylaxis and the target is kaput.

This is a specific hack where DNS would be used effectively to kill 
someone by redirecting the Medical Records Bureau where this patients 
data resides to a new faked system, and as long as it worked like it was 
supposed to which wouldn't be to hard to fake, the relying Doctor would 
never know.

Now - once again - the integrity of the DNS being requested for ANY act 
which would provide data to a user wherein that data is controlled by a 
Privacy Act or likewise the EU Data Integrity Act, would also constrain 
here as well. The funniest part is that I bet that the RFC3161 crowd 
still doesnt get that the EU Timestamping Directives apply directly to 
the management of systems logs in the EU as well. - Cracks me up!

Todd Glassey

---

From: Joe Abley <[email-masked]>
Date: Wed, 18 Mar 2009 20:53:32 -0400

On 18 Mar 2009, at 18:32, TSG wrote:

> I forgot to bring up that

You're hilarious, Todd :-)

Joe

---

From: TSG <[email-masked]>
Date: Wed, 18 Mar 2009 18:33:02 -0700

> You're hilarious, Todd :-)
You think??? - I thought it was the other way around  but actually 
what's funny is that Article 6 of the act talks to "Data Processing" 
which is a phrase which pertains to "the System which performs the Data 
Manipulations" not just the protected PII-constrained portable-data 
belonging to the parties ... Wanna bet on it?

Here is the link. 
http://www.cdt.org/privacy/eudirective/EU_Directive_.html#HD_NM_2 - the 
same is true that the time-service is also impacted by the EU directive 
there but that also rolls down to the same service which EU residents 
and member's must bring into that operations. Nice move that one too...

Todd Glassey

---

From: SM <[email-masked]>
Date: Wed, 18 Mar 2009 20:45:57 -0700

At 15:53 18-03-2009, TSG wrote:
>protect privacy impacted and financial data they are also included. I think
>this is inherently obvious, in fact its so obvious that arguing 
>about it is silly. The

You mentioned the "EU's Data Integrity Directive" to back an argument 
about protecting privacy.  As you have not provided any reference to 
such a directive, I'll assume that it does not exist.

>Let's us paint a picture...

[snip]

>Now - once again - the integrity of the DNS being requested for ANY 
>act which would provide data to a user wherein that data is 
>controlled by a Privacy Act or likewise the EU Data Integrity Act, 
>would also constrain here as well. The funniest part is that I bet 
>that the RFC3161 crowd still doesnt get that the EU Timestamping 
>Directives apply directly to the management of systems logs in the 
>EU as well. - Cracks me up!

There isn't any "EU Data Integrity Act".  Securing information 
through DNS won't get you far.

>http://www.cdt.org/privacy/eudirective/EU_Directive_.html#HD_NM_2 - the

You could at least use a source of information from the European 
Union if you are going to paint pictures about Europe.

Regards,
-sm

---

From: Ralf Weber <[email-masked]>
Date: Thu, 19 Mar 2009 11:03:58 +0100

Moin!

On 18.03.2009, at 17:37, TSG wrote:

> EU's Data Integrity Directive which in fact will effect the  
> operations of all public content systems including the DNS servers  
> which are operated in the EU. Why was this never designed into the  
> spec is interesting since the specification may "by law not be used  
> in about 1/3 of the populated world now" without that consideration  
> being in place.
I'm not sure where you get the numbers, but the EU's population is  
around 499 million, the worlds population is 6700 million, to me that  
makes roughly 8%. Also every EU directive has to be set into law by  
the member states, and in that case at least in the federal system of  
germany and austria this had to be done by the states. So the rough  
count I had this directive has been passed into 46 different laws, of  
course in different languages. Are you going to check them all?

Of course operators in the respective legislations are required to  
obey to the law, and working for an pan european ISP I can tell you  
that this is not easy sometimes, because law differs from country to  
country, but we still provide services based on the standards set bey  
the IETF. These have to be technically sound but IMHO it is not the  
task of this working group to see if they, or to be more precise  
implementation of these standards may impose legal risks in certain  
countries.

I know the implementation of this directive in germany (Bundes/ 
Landesdatenschutzgesetz for the germans around here) and I can not see  
how it would apply to this draft, then of course IANAL.

So long
-Ralf
---
Ralf Weber
Platform Infrastructure Manager
Colt Telecom GmbH
Herriotstrasse 4
60528 Frankfurt
Germany
DDI: +49 (0)69 56606 2780 Internal OneDial: 8 491 2780
Fax: +49 (0)69 56606 6280
Email: [email-masked]
http://www.colt.net/
Data | Voice | Managed Services

Schütze Deine Umwelt | Erst denken, dann drucken

*****************************************
COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland  
* Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222 *

Geschäftsführer: Dr. Jürgen Hernichel (Vors.), Rita Thies *  
Amtsgericht Frankfurt/Main HRB 46123 * USt.-IdNr. DE 197 498 400

---

From: Jim Reid <[email-masked]>
Date: Thu, 19 Mar 2009 10:10:21 +0000

Can we *please* get back to a discussion of WGLC on this ID?

The (largely ill-informed) debate about EU Data Protection Directives  
can be taken somewhere else. It's not even remotely relevant to this  
WG or the draft that's under consideration.

---

From: Peter Koch <[email-masked]>
Date: Thu, 19 Mar 2009 11:44:23 +0100

> around 499 million, the worlds population is 6700 million, to me that  

[... others omitted ...]

Folks, please.
We're trying to discuss <draft-ietf-dnsop-name-server-management-reqs-02.txt>
and potential issues with it.

Absent any evidence of its relevance, I consider the sub-thread on the
EU Directive on data protection closed.

-Peter [co-chair hat on]

---

From: TSG <[email-masked]>
Date: Thu, 19 Mar 2009 06:46:26 -0700

Ralf Weber wrote:
>> Data Integrity Directive which in fact will effect the operations of 
>> all public content systems including the DNS servers which are 
>> operated in the EU. Why was this never designed into the spec is 
>> interesting since the specification may "by law not be used in about 
>> 1/3 of the populated world now" without that consideration being in 
>> place.
> I know the implementation of this directive in germany 
> (Bundes/Landesdatenschutzgesetz for the germans around here) and I can 
> not see how it would apply to this draft, then of course IANAL.
Ralf - where I got that number is based on the populated areas of the 
planet. That said, the EU based on Europe and Canada & Australia 
(including India's population + the EU) falls somewhere roughly from 1/3 
to 1/2 of the global population

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 20 Mar 2009 17:40:28 +0100

On Wed, Mar 18, 2009 at 05:04:57PM -0700,
 TSG <[email-masked]> wrote 
 a message of 55 lines which said:

> Attack is seamlessly functional. [...] This is a specific hack where
> DNS would be used effectively to kill someone by redirecting the
> Medical Records Bureau [...]

I'm not an expert in people killing but this method seems quite
convoluted and I hope that the IETF will standardize something much
simpler and which works ("Rough consensus and running weapons").

---

From: Doug Barton <[email-masked]>
Date: Sat, 21 Mar 2009 22:44:42 -0700

>  <http://tools.ietf.org/html/draft-ietf-dnsop-name-server-management-reqs-02>.

I've read the draft at the URL above and am generally supportive of
its moving forward. I noticed the following nits. Assuming that the
grammatical issues could be sorted out down the road I would not
object to the draft moving forward without the other issues I mention
below being addressed.

hope this helps,

Doug

Abstract: "not a interoperable" should be "not an ..."
Abstract: The last paragraph is awkward. Perhaps:
	This document discusses the requirements of a management
	system for DNS name servers and can be used as a shopping
	list of needed features for such a system.

1. Introduction: "not a interoperable" should be "not an ..."
1. Introduction: The awkward paragraph from the Abstract is repeated here.
2.1.1 Zone Size Constraints: The last sentence is awkward. Perhaps:
	Both deployment scenarios are common.
2.1.3 Configuration Data Volatility: Same as 2.1.1 above.
2.1.5 Common Data Model: "is needed for of the operations discussion"
	the "of" there should be removed
3.1.1 Needed Control Operations
	The ability to do a reload on an individual zone should probably be
mentioned here.

---

From: Todd Glassey CISM CIFI <[email-masked]>
Date: Sun, 22 Mar 2009 11:02:28 -0700

> 	list of needed features for such a system.

As long as you are being nit picky the phrase "(Domain Name Service) 
name servers" reads kinda funny. How about just DNS Resolver's or 
something like that?

T.

---

From: Doug Barton <[email-masked]>
Date: Sun, 22 Mar 2009 11:40:35 -0700

> name servers" reads kinda funny. How about just DNS Resolver's or

That part of the sentence I quoted verbatim from the existing text in
an effort to minimize the changes. I think removing "DNS" from the
original further improves the text along the lines you pointed out.

Good catch,

Doug

---

From: SM <[email-masked]>
Date: Sun, 22 Mar 2009 13:42:39 -0700

>         draft-ietf-dnsop-name-server-management-reqs-02.txt

 From the Abstract:

   "Management of name servers for the Domain Name Service (DNS) has
    traditionally been done using vendor-specific monitoring,
    configuration and control methods."

Shouldn't that be Domain Name System?  That's what DNS stands for in 
RFC 1034.  "Domain Name Service" could be changed throughout the 
document to "Domain Name System".  There are several places in the 
document where "DNS service" is used.

In Section 2.1.2

   "Finding and managing large quantities of name servers would be a useful
    feature of the resulting  management solution."

I suggest "a large number" instead of large quantities".

Regards,
-sm