Subject: [DNSOP] Signing the root == end of ITAR?

From: Roy Arends <[email-masked]>
Date: Wed, 7 Oct 2009 14:13:53 +0200

I understand that six month after root-signing is fully deployed, that  
the ITAR will cease to exist.

Since a date was announced yesterday (July 1st) for a fully deployed  
signed root, can we expect ITAR to Go Away on Januari 1st 2011 ?

Thanks,

Roy

---

From: Jim Reid <[email-masked]>
Date: Wed, 7 Oct 2009 13:35:53 +0100

> signed root, can we expect ITAR to Go Away on Januari 1st 2011 ?

Will DLV go away then too?

---

From: Tony Finch <[email-masked]>
Date: Wed, 7 Oct 2009 14:18:03 +0100

On Wed, 7 Oct 2009, Jim Reid wrote:
> > Since a date was announced yesterday (July 1st) for a fully deployed signed
> > root, can we expect ITAR to Go Away on Januari 1st 2011 ?
>

I doubt it because it's likely to still be necessary for bridging trust
gaps below the root. For example it looks like nic.at aren't in any rush
to deploy DNSSEC.

http://www.nic.at/fileadmin/www.nic.at/documents/dnssec/nicat_and_DNSSEC.pdf

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
GERMAN BIGHT HUMBER: SOUTHWEST 5 TO 7. MODERATE OR ROUGH. SQUALLY SHOWERS.
MODERATE OR GOOD.

---

From: joao damas <[email-masked]>
Date: Wed, 7 Oct 2009 14:30:46 +0100

DLV doesn't only address the lack of a signed root. In fact I would  
argue that the (un)signed root is the smallest of the problems it  
addresses.

Joao

On 7 Oct 2009, at 13:35, Jim Reid wrote:

>> Since a date was announced yesterday (July 1st) for a fully  
>> deployed signed root, can we expect ITAR to Go Away on Januari 1st  
>> 2011 ?
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: joao damas <[email-masked]>
Date: Wed, 7 Oct 2009 14:32:14 +0100

On 7 Oct 2009, at 13:13, Roy Arends wrote:

> I understand that six month after root-signing is fully deployed,  
> that the ITAR will cease to exist.
>

I would hope it stays around. Having an "out of band" way of  
contrasting the info in the root zone is a valuable service to have.

Joao

---

From: Joe Baptista <[email-masked]>
Date: Wed, 7 Oct 2009 09:44:27 -0400

On Wed, Oct 7, 2009 at 9:32 AM, joao damas <[email-masked]> wrote:

> I would hope it stays around. Having an "out of band" way of contrasting
> the info in the root zone is a valuable service to have.
>

Don't expect that to happen. Once the root is signed it is prudent to remove
DLV so as to ensure complete root slavery.

regards
joe baptista

---

From: Chris Thompson <[email-masked]>
Date: 07 Oct 2009 15:59:59 +0100

>argue that the (un)signed root is the smallest of the problems it

Well, no doubt Jim would *like* it to go away, as I have had his "DLV is evil"
lecture delivered to me on a previous occasion :-)

We have had at least one person from ISC in the past saying they won't be
in any hurry to get rid of dlv.isc.org just because the root is signed.
[I'll try and find the reference(s) if anyone doubts that.] No doubt
they will stop importing the IANA ITAR into it at some stage, though.

There's an interesting technical question about DLV in this context, by
the way. Would a DLV rrset at the apex (e.g. for dlv.isc.org) work as
a substitute for an explicit root zone trust anchor?

-- 
Chris Thompson               University of Cambridge Computing Service,
Email: [email-masked]    New Museums Site, Cambridge CB2 3QH,
Phone: +44 1223 334715       United Kingdom.

---

From: joao damas <[email-masked]>
Date: Wed, 7 Oct 2009 16:06:58 +0100

wasn't talking about DLV

On 7 Oct 2009, at 14:44, Joe Baptista wrote:

> Don't expect that to happen. Once the root is signed it is prudent  
> to remove DLV so as to ensure complete root slavery.
>
> regards
> joe baptista

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 7 Oct 2009 16:13:53 +0100

On Wed, Oct 07, 2009 at 02:13:53PM +0200,
 Roy Arends <[email-masked]> wrote 

> signed root, can we expect ITAR to Go Away on Januari 1st 2011 ?

As someone in the public (at the RIPE meeting) mentioned, the timeline
presented by ICANN/Verisign said nothing about the inclusion of DS
records in the root (remember that each KSK rollover will require the
prior approbation, in writing, of the US government).

So, there will be no reason to shut down ITAR.

---

From: Roy Arends <[email-masked]>
Date: Wed, 7 Oct 2009 17:33:59 +0200

> So, there will be no reason to shut down ITAR.

Full deployment july 1st. That means inclusion of DS records.

Roy

---

From: Jim Reid <[email-masked]>
Date: Wed, 7 Oct 2009 16:39:41 +0100

> prior approbation, in writing, of the US government).

Dave Knight is due to talk about the ITAR in the DNS WG tomorrow. We  
might have more news then about how the ITAR might morph into the way  
for TLDs to lodge their KSKs with the signed root.

---

From: John Schnizlein <[email-masked]>
Date: Wed, 7 Oct 2009 16:41:16 +0100

That was my question.  Matt's answer was that he did not remember that  
detail of the design.  Not remembering the detail that happened to be  
omitted from the slide is not really the same as not in the design.  I  
am sure Matt and Joe know that signing the root means nothing without  
the DS records.

John

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 7 Oct 2009 16:44:03 +0100

On Wed, Oct 07, 2009 at 05:33:59PM +0200,
 Roy Arends <[email-masked]> wrote 

> Full deployment july 1st. That means inclusion of DS records.

That's not what I understood from the talk and from the question and
from the discussion IRL with Joe Abley afterwards.

Was someone else here and listening more seriously?

---

From: Mark Andrews <[email-masked]>
Date: Thu, 08 Oct 2009 08:15:56 +1100

In message <[email-masked]>, Chris Thom
> they will stop importing the IANA ITAR into it at some stage, though.

I'll leave that for the DLV program manager.

One should note that until a validator is upgraded to support SHA2
signatures that it will still need the DLV entries for the TLDs as
the root will remain unsigned as far as that validator is concerned.

> a substitute for an explicit root zone trust anchor?

Yes.  Why would anyone think otherwise?
 
Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]