Subject: Re: national security

From: "vinton g. cerf" <[email-masked]>
Date: Sun, 30 Nov 2003 23:52:55 -0500

karl, we raised the question of anycast risk with SECSAC in response to your
concerns and the conclusion was that the risks had not materialized in the
operation of anycast in roots that had already deployed it. 

There are lots of ways in which routing can be wedged - until we get some
form of authentication, that risk will be with us. Moreover, even with
authentication it is possible to misconfigure routing. 

Any table driven system that does not have an obvious syntactic or semantic
way of detection a bad configuration is subject to these risks.

vint

At 06:29 PM 11/30/2003 -0800, Karl Auerbach wrote:
>The switch to anycast for root servers is a good thing.  But it was hardly
>without risks.  For example, do we really fully comprehend the dynamics of
>anycast should there be a large scale disturbance to routing on the order
>of 9/11?  Could the machinery that damps rapid swings of routes turn out 
>to create blacked out areas of the net in which some portion of the root 
>servers become invisible for several hours?  Could one introduce bogus 
>routing information into the net and drag some portion of resolvers to 
>bogus root servers?

Vint Cerf
SVP Technology Strategy
MCI
22001 Loudoun County Parkway, F2-4115
Ashburn, VA 20147
703 886 1690 (v806 1690)
703 886 0047 fax
[email-masked]
www.mci.com/cerfsup

---

From: Karl Auerbach <[email-masked]>
Date: Mon, 1 Dec 2003 00:02:41 -0800 (PST)

On 1 Dec 2003, Paul Vixie wrote:

> > ICANN's obligation is to guarantee to the public the stability of DNS at
> > the root layer.
> 
> i disagree...

From ICANN's own bylaws:

  The mission of The Internet Corporation for Assigned Names and Numbers 
  ("ICANN") is to coordinate, at the overall level, the global Internet's 
  systems of unique identifiers, and in particular to ensure the stable 
                                                      ^^^^^^^^^^^^^^^^^
  and secure operation of the Internet's unique identifier systems ...
  ^^^^^^^^^^^^^^^^^^^^
[emphasis added]

According to m-w.com, "ensure" means "to make sure, certain, or safe : 
Guarantee".

In other words, ICANN's mission is a promise, a guarantee.

But that's not all:

ICANN's contract, or rather "Memorandum of Understanding" with the United
States requires, yes requires, that ICANN, yes ICANN, not the RIRs, not
the root server operators, "to design, develop, and test the mechanisms,
methods, and procedures" ... to oversee "the operation of the
authoritative root server system" and "the allocation of IP number 
blocks".

Those are ICANN's own promises that it has made, in legal document after
legal document, to the United States Government.  ICANN may say otherwise,
you may believe otherwise.  But that's the contractual words in black and
white.  It has been the same language since 1998.

In other words, ICANN has made a contractual committment to tell you, as
an operator of a root server, what "mechanisms, methods, and procedures"  
you must follow to operate your servers.

And that word "oversight" in the MoU does not mean that ICANN promises to
merely watch how you and the other root server operators do what you do
very well.  The word "oversight" includes an ability to reject and to
command.  In other words, ICANN has promised the USG that it's authority
over root operations supersedes your own.

We are all well aware that in actual fact that ICANN has no legal
authority over the root server operators.  And we are all aware that the
root server operators have been wary of entering into agreements with
ICANN regarding the operation of the root servers.  That, however, has not
stopped ICANN from making a written promise to the United States govenment
that it will both oversee the root server operations and "formalize" its
relationship with the root server operators.

Perhaps ICANN is willing to admit that it has no real authority -
presumably by declaring to the US Department of Commerce that it considers
those sections that I mentioned to be obsolete and not obligatory upon
ICANN, and by removing the obligation to "ensure the stable and secure
operation" that is contained in its own bylaws - and clearly articulating
to everyone, governments and businesses included, that ICANN is nothing
more than an advisory body that operates only by eminating good vibes in
the hope that others, who do have real power to act, will act in
resonance.

In the meantime ICANN goes about telling governments of the world that it
does far more than emit nudges and hopes;  ICANN tells governments that it
ensures and guarantees.

And outside of the IETF and related communities ICANN does not say that it
is merely an advisory body lacking authority. ICANN's message to the
business and intellectual property communities is that ICANN stands strong
and firm and will let nothing interfere with the stable operation of the
internet.

Your note makes my point - that ICANN is in many regards an empty shell,
and has been one for years, that has no real power except in the realm of
the (over) protection of intellectual property, allocation of a very few
new top level domains, and the determination of who among compeiting 
contenders is worthy to operate contested ccTLDs.

At the end of the day - and it is nearly the end of the day here - the
fact of the matter is that ICANN is telling different stories to different
groups.  To the IETF, ICANN holds itself out as one of the guys, merely a
warm and fuzzy "coordinator".  But to the business community, ICANN holds
itself forth as a guarantor of internet stability.  And to the United
States Govenment, ICANN has undertaken to make legal promises to the
effect that it is in charge of DNS, including root server operations, and
IP address allocation.

		--karl--

PS, if I am "late to the party" on anycast issues than it ought to be easy
for ICANN to articulate the answers to my concerns.  This is not an idle
request.  The internet community deserves proof that these questions are
truly answered by hard, reviewable, analysis.  Moreover, with Verisign and
sitefinder lingering on the horizon it is not beyond conception that
Verisign will wave the flag of bias and ask ICANN to demonstrate why
anycast got such an easy entree.

---

From: Masataka Ohta <[email-masked]>
Date: Mon, 01 Dec 2003 18:34:53 +0900

Paul Vixie;

>>The switch to anycast for root servers is a good thing.

> again there's a tense problem.  there was no "switch to" anycast.  the last
> time those thirteen (or eight) ip addresses were each served by a single host
> in a single location was some time in the early 1990's.

So?

Service by multiple hosts in a single location is hardly anycast.

When it was switched to anycast?

>>                                                        But it was hardly
>>of 9/11?

> yes, actually, we do.  (or at least the f-root operator does.)

Can you explain, the reactions of people who have been engaging
in root server operations against anycast without comprehending
the dynamics of anycast, as observed in the last month in IETF
DNS OP ML?

						Masataka Ohta

---

From: "vinton g. cerf" <[email-masked]>
Date: Mon, 01 Dec 2003 07:24:39 -0500

karl, ICANN has responsibility to do what it can to make sure the DNS and ICANN root system work. It does not have to disenfranchise the RIRs and the root servers to do this.

vint

>anycast got such an easy entree.

because it did not change the results of queries. sitefinder did.

Vint Cerf
SVP Technology Strategy
MCI

---

From: John C Klensin <[email-masked]>
Date: Mon, 01 Dec 2003 10:03:38 -0500

--On Monday, 01 December, 2003 07:24 -0500 "vinton g. cerf" 
<[email-masked]> wrote:

> karl, ICANN has responsibility to do what it can to make sure
> the DNS and ICANN root system work. It does not have to
> disenfranchise the RIRs and the root servers to do this.

Vint,

I would go even further than this.  One of the best actions 
ICANN can take, IMO, is to look at a particular situation (and 
the root system and DNS operations generally are probably good 
examples) and say "yep, it is working" followed by some version 
of "if it ain't broke, don't fix it... or even intervene".  One 
corollary to this is that not only does "it not have to 
disenfranchise..." but that it arguably should not intervene in 
those activities at all unless there is a strong case that they 
are not working in some significant way.

In that sense, the observation that ICANN has not significantly 
intervened in either the root system or with the address 
registry environment should be judged as a success unless it is 
argued that one or the other is seriously not working.

   john

---

From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Date: Mon, 1 Dec 2003 21:32:46 -0500 (EST)

Alas for this rosy vision, ICANN *tried* to boss the RIRs and get them to
sign contracts agreeing to pay it and obey it, but they balked.  So all
credit to the RIRs - and none to ICANN - on this one.

-- 
http://www.icannwatch.org   Personal Blog: http://www.discourse.net
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                         -->It's warm here.<--