Subject: Re: opt-in and large zones

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 18 Sep 2002 11:17:02 +0200

The current opt-in thread is really bothersome to me - it's too 
    polarized to be helpful.

Yes, I don't think "believes" has a place in a technical discussions.

    But I just have one question along the 
    lines that I am dying to ask, yet I don't want to be drug into the 
    current conversation.  The question is:
    
          Do other (not com.) large zone registrars feel that opt-in is
          necessary?  I'm assuming that there are zones other than com. with
          over a million subdomains.

That was my point. There are zones out there which are bigger then
.net & .org, and thus far I haven't noticed that folks
maintaining these zones want OPT-IN.
    
    I'd really like to see a working prototype of an opt-in server - so 
    we can play.

That would be a rational thing to do.

	jaap

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Mark Kosters <[email-masked]>
Date: Wed, 18 Sep 2002 16:49:02 -0400

>      over a million subdomains.

There are a few. Many aspire to get there someday :^).  Have you seen any 
other registries directly participate in any of this? I've had a number of
informal conversations with some of them but are relucant to expose
their business plans - esp publically on a list (which I understand).

> I'd really like to see a working prototype of an opt-in server - so 

look at http://www.dnssec.verisignlabs.com

Mark

-- 

Mark Kosters          [email-masked]       Verisign Applied Research

---

From: Mark Kosters <[email-masked]>
Date: Wed, 18 Sep 2002 16:56:07 -0400

> maintaining these zones want OPT-IN.

Devil's advocate time. Have these zone maintainers taken the time to 
understand what it takes to deploy dnssec? I surmise that interest may not 
be there since there is no immediate demand from their customers to deploy 
dnssec. I base my assertion on that fact that I have yet to hear any interest 
either directly or indirectly from any registrar that deals with com/net/org 
that they want dnssec.

Mark

--

---

From: bert hubert <[email-masked]>
Date: Wed, 18 Sep 2002 23:23:24 +0200

> either directly or indirectly from any registrar that deals with com/net/org 

While large registrars are part of our customer base, none has requested
DNSSEC as a 'must have' feature. So far people have assumed that DNSSEC was
deployable, right now it is starting to get known that there are major
issues separating DNSSEC from an infrastructure that can be deployed as a
money-making service.

Kind regards,

bert hubert
PowerDNS

-- 
http://www.PowerDNS.com          Versatile DNS Software & Services
http://www.tk                              the dot in .tk
http://lartc.org           Linux Advanced Routing & Traffic Control HOWTO

---

From: "Jason Coombs" <[email-masked]>
Date: Wed, 18 Sep 2002 12:19:20 -1000

Okay, here's my devil's advocate viewpoint.

It wouldn't be hard to muster an army of volunteers who would gladly spend
many man-years signing zones on behalf of domain registrants who think they
don't want/need DNSSEC enough to pay for it if registrars who think they
can't afford to deploy DNSSEC agree to let volunteers do all of the work for
free that the registrars would otherwise have to do without additional
compensation from registrants.

Likewise, volunteers would gladly manage all extra burdens placed on TLD
zone managers other than hardware, bandwidth, and electricity costs. All
manpower costs are irrelevant when it comes to deploying DNSSEC because if
the people who read this list really need manpower help to get the job done
and really can't afford to pay for it all they need to do is explain the
predicament in a public plea for help and give volunteers appropriate access
permissions and software tools that enable them to shoulder the burden
instead.

Even with potential threats of key theft caused by the probable necessity of
distributing many copies of the TLD zone signing private key to various
volunteer coordinators and the possibility of cryptanalysis by way of chosen
plaintext oracle attacks where a lazy volunteer coordinator fails to detect
and prevent such a thing, the security improvement provided by signed DNS
zones is critically-important to the integrity of Internet infrastructure
and less-than-perfect is better than what we've got today with DNS.

Considering that deployment and operations are the crux of the issue here,
hasn't anyone drafted detailed business scenario and security scenario
analysis documents that frame this debate?

The technical issues are minor and somewhat philosophical. We're not talking
about updating end-user client resolver libraries any time soon, that will
always be optional... Either the client node wants DNSSEC and therefore
updates its resolver or it is satisfied with IPSec-protected DNS where the
DNS server does support DNSSEC otherwise the client node doesn't benefit
from signed zones. However, automated DNSSEC crawlers can and should be
implemented that verify signatures obtained from authoritative DNSSEC
servers and then query every DNS server looking for poisoned RRs. Poisoned
DNS servers can quickly be taken offline and daily security alerts could be
issued by ICANN or CERT detailing known-poisoned DNS servers. With such a
system in place we could deploy a good-enough initial protection simply by
coordinating authentic communications from registrants to a single DNSSEC
server that never gets queried by anything but the crawler and is managed
entirely by volunteer staff.

The nameservice protocol would still be DNSSEC and we would still need each
TLD to have a key pair but the deployment could actually succeed in the
near-term without convincing everyone that they need and want DNSSEC badly
enough to invest money in it. And the initial population of the
authoritative DNSSEC server would still be complete and automatic based on
the current (perceived) contents of the authoritative nameservers for each
domain. This way "opt-in" is unnecessary and those domains that are already
compromised remain so in the DNSSEC until we receive authentic
communications from the domain registrant offering corrections.

Sincerely,

Jason Coombs
[email-masked]

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Mark Kosters
Sent: Wednesday, September 18, 2002 10:56 AM
To: Jaap Akkerhuis
Cc: [email-masked]
Subject: Re: opt-in and large zones

dnssec. I base my assertion on that fact that I have yet to hear any
interest

Mark

--

---

From: Jaap Akkerhuis <[email-masked]>
Date: Thu, 19 Sep 2002 10:59:23 +0200

Devil's advocate time. Have these zone maintainers taken the
    time to understand what it takes to deploy dnssec?

We, (.nl, 750 K delegations) are serious looking at this. Also, I
know that (.de, 5++ M delegationsis looking at this as well. As far
I know theyare on this maillists as well. Someother european
registries are paying attention as well.

    I surmise that interest may not be there since there is no
    immediate demand from their customers to deploy dnssec. I base
    my assertion on that fact that I have yet to hear any interest
    either directly or indirectly from any registrar that deals
    with com/net/org that they want dnssec.

We get occasional requests from domain name holders when we are
going to do this in production (note when, not if), likewise, I
heard the Germans do.  Also, (some) registrars are interested.

Our standard answer is that we have to wait until the protocol is
done.

	jaap