Subject: Re: wildcards, dnssec, and opt-in

From: Greg Hudson <[email-masked]>
Date: 17 Sep 2002 11:47:45 -0400

On Tue, 2002-09-17 at 08:28, Edward Lewis wrote:
> As far as whether wild cards stay or go, I think it is up to the 
> users of DNS to determine, not the protocol designers.  Whether they 
> are a pain or not, if the use of wild cards is deemed necessary, it 
> is up to the engineers to answer the requirement.

When security is on the line, it is reasonable for engineers to draw the
line at a feature which provides nothing of substance.

I would rather have 30% deployment of a DNSSEC which is simple enough to
actually be secure than 100% deployment of a DNSSEC which is too
complicated to evaluate.  (Not that I think wildcards would account for
a 70% swing.)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Sep 2002 14:42:47 -0400

Looking at "wild cards vs. dnssec" it seems to me that the issue is 
that wild cards makes achieving the service of authenticated denial a 
bit harder than the non wild card case.  Wild cards do not complicate 
the security of explicitly-there data.

What I would like to know is how widely practiced is the use of 
multi-label depth wild cards?  If these are not that widely deployed, 
then using a clunky, non-scaleable solution to the issue is 
acceptable.  I'd like to see completeness of the security coverage, 
and if this means that multi-label depth wild cards suffer - so much 
more the incentive to limit their use.

I don't believe that we will come down to having to make a hard 
choice between wild cards and dnssec.  I fail to see how wild cards, 
even with the complexity of multi-label depth situations, create a 
situation that is undecidable.  I think that there may be ugly 
situations for the odd ball cases, but I think that odd ball cases 
are rare enough that they deserve to bite the bullet in this case.

As far as opt-in vs. wild cards, I don't know yet.  Is anyone 
prototyping a server that implements opt-in so that we can take shots 
at it?  I think that would do us a lot more good than continually 
haggling over words in mail and the specs.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer