Subject: Re: DNSSEXT Yokohama Minutes

From: [email-masked]
Date: Tue, 17 Sep 2002 15:24:54 +1000

> unless someone comes forward and says "here is a case of wildcard usage for
> which there is no workaround, and here's why the kind of zone or user who
> needs it is critical to the success of a dnssec rollout" then there is just
> no basis for continuing the argument.

	Well gatewaying of ACSNet mail (*.oz.au) would have been
	such a case.  No node in ACSNet knew all the other nodes
	so it was impossible to enumerate the space.  However not
	being able to spoof the wild card MX's would have prevented
	mail being intercepted.

	To mail to foo.bar.xxx.oz.au you only needed to know how to
	reach a machine in xxx.oz.au.  You had to ensure that one of
	you machines was visible but not all of your machines.

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Conrad <[email-masked]>
Date: Tue, 17 Sep 2002 10:51:09 -0700

Paul,

On 9/16/02 9:08 PM, "Paul Vixie" <[email-masked]> wrote:
> but more fundamentally, i dispute that lack of wildcarding has ever stopped
> anyone, even one user, from signing a zone that they would otherwise have
> signed.  

I am not saying it has.  What I am saying is that removal of functionality
from the DNS that people use today is going to impede the deployment of
DNSSEC in the future.

> in december, in salt lake city, the DS plan was hatched and campaigned for,
> and my support for it (as well as for opt-in) was contingent on a quick close.
> that hasn't happened.  best case, it'll be december -- a full year later --
> before we're done arguing about how to prove the unknown (sign wildcards)

It is not unknown.  There is at least one implementation that fully supports
wildcards in DNSSEC.

Rgds,
-drc