Subject: Re: DNSSEXT Yokohama Minutes

From: Paul Vixie <[email-masked]>
Date: Mon, 16 Sep 2002 22:35:37 +0000

>> ...  I'm here today renewing my proposal:
>> 
>> Signed zones shall not include RR's with wildcard names.
>
> This will, I'm told by folks who run large zones (other than .COM), will
> result in DNSSEC not being deployed in those zones.

i either disagree or disbelieve, depending.

> Doesn't seem to be an optimal approach if we want DNSSEC deployed.

imho, wildcards will not change dnssec's deployment curve even a little bit.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 16 Sep 2002 23:14:04 +0000

> > I'm looking for the case where wildcards are vital, and for which
> > there is no alternative present. I can't think of any.
> 
> Nor can I.  However, does that matter?

yes, it does.  "design" is a process involving both creativity and tradeoffs.
in order to decide whether our seven year dnssec effort should be turned into
an eight or nine year dnssec effort, we need to know exactly how important
wildcards are and to whom.

several of us here have asserted that there are workarounds for all common
cases and that we can cut wildcards out of the dnssec specification with no
actual loss of functionality.  one of us has even enumerated the common cases.

the onus is now on the other side of the argument.  if there's a common case
we've missed, or an uncommon case that's vital, then enumerate it.  if our
analysis of the common cases was faulty, then correct us.  but don't just
say "if we don't have wildcards, dnssec is not worth doing" because the
argument has since moved to more detailed ground where actual facts are
going to be required to keep it from ending in the "no wildcards in dnssec"
mode.

---

From: Roy Arends <[email-masked]>
Date: Tue, 17 Sep 2002 01:08:18 +0200 (CEST)

On Mon, 16 Sep 2002, David Conrad wrote:

> Roy,
>
> On 9/16/02 3:00 PM, "Roy Arends" <[email-masked]> wrote:
> > Could you phrase their concerns ?
>
> "We use wildards.  Removing them would be annoying."  -- a direct quote from
> someone at a RIPE meeting a while back.

Okay, I can imagine its annoying. But I don't think "annoying" is a strong
case for keeping wildcards in DNSSEC.

> > I'm looking for the case where wildcards are vital, and for which there is
> > no alternative present. I can't think of any.
>

No, who cares what you or I can't think of. I just want to assess
compelling and real arguments for keeping wildcards in DNSSEC ("annoying"
is not one of them), since I don't have any right now.

Roy

---

From: David Conrad <[email-masked]>
Date: Mon, 16 Sep 2002 18:29:02 -0700

On 9/16/02 4:14 PM, "Paul Vixie" <[email-masked]> wrote:
> the onus is now on the other side of the argument.

Hmmm.

Way back in a previous life when I was trying to encourage people to use
DNSSEC and I mentioned BIND didn't support signing zones with wildcards in
them, the vast majority of responses were along the lines of "too much of a
hassle to redo the way we're doing business, particularly as we haven't seen
any attacks that DNSSEC would have helped against, so I guess we won't be
signing our zones".

Perhaps times have changed and the folks who host zones with wildcards in
them might consider taking the onus upon themselves to argue as you assert
they must.  

Or perhaps not.  Particularly given those folks are not likely to found on
namedroppers.

Seems to me if you want to keep DNSSEC from ever getting deployed, then
creating yet another barrier to entry by removing wildcards is a step in the
right direction.

Rgds,
-drc

---

From: David Terrell <[email-masked]>
Date: Mon, 16 Sep 2002 20:07:13 -0700

> going to be required to keep it from ending in the "no wildcards in dnssec"

If I'm a major website that puts different content under different
DNS names, it sure would be nice to catch misspellings and try to
redirect them to an appropriate page without turning an 8 name zone
into a 500 name zone.  Cuts down on the NXT record generation, for
one thing.

I would, however, like to be able to secure the records in this zone,
so that my server addresses can't be spoofed.

How about this:
"A signed zone with a signed wildcard SHOULD NOT have any unsecured
labels."

That eliminates any funny business.  You're not going to put a *
record in .com anyway.  I thought that partially secured zones were
mostly a "only use this if you have a real reason to" thing anyway.

-- 
David Terrell           | If a crypto algorithm is cracked in a forest
Nebcorp Prime Minister  | and a tree falls on a mime, does microsoft
[email-masked]            | need to publish an advisory on it?
http://wwn.nebcorp.com/

---

From: Paul Vixie <[email-masked]>
Date: Tue, 17 Sep 2002 04:08:31 +0000

> any attacks that DNSSEC would have helped against, so I guess we won't be

that turned out to be a good thing, too.  those folks might've ended up using
pre-DS, or using RSA keys, or any of the other things that dnsext/dnssec has
sent to the IESG even though we clearly weren't done baking them yet.

but more fundamentally, i dispute that lack of wildcarding has ever stopped
anyone, even one user, from signing a zone that they would otherwise have
signed.  and also, a continued lack of wildcarding will not stop anyone from
signing a zone that they otherwise want to sign.  whether they otherwise
want to sign or not is the important question, and that will have to do with
factors like a stable specification, decent tools, useful documentation, and
a sense that other people are actually using this stuff.

> Or perhaps not.  Particularly given those folks are not likely to found on

i think name service providers (such as nominum, ultradns, and lots of others)
have employees on this list who know what their customers are using DNS for,
and that this is a fine place to do "feature research" of this kind.  but if
you know of another place, please suggest it.

> Seems to me if you want to keep DNSSEC from ever getting deployed,
> then creating yet another barrier to entry by removing wildcards is a
> step in the right direction.

in december, in salt lake city, the DS plan was hatched and campaigned for,
and my support for it (as well as for opt-in) was contingent on a quick close.
that hasn't happened.  best case, it'll be december -- a full year later --
before we're done arguing about how to prove the unknown (sign wildcards) and
are ready to ask IESG for a last call on some form of dnssec, with or without
opt-in but probably with DS.

unless someone comes forward and says "here is a case of wildcard usage for
which there is no workaround, and here's why the kind of zone or user who
needs it is critical to the success of a dnssec rollout" then there is just
no basis for continuing the argument.