Subject: Re: [Tools-discuss] DNSSEC algorithm used on ietf.org

From: Glen <[email-masked]>
Date: Wed, 23 Mar 2022 15:29:20 -0700

All -

On 3/23/22 17:30, Michael Richardson wrote:
> I would email [email-masked].
> This is something for AMSL (Glen) to consider how/when to replace the KSK and
> ZSK with a newer algorithm. (My zones still use RSASHA1 too)

And Petr replied:
> That is where I started with ticket [rt5.ietf.org #4814] and Glen
> suggested this list might be the best try. Here I am.

Petr did indeed email [email-masked], and I did indeed refer him here.
Here is why:

DNSSEC was set up under the direction of IETF leadership so long ago that I
cannot even find the email thread anymore.  What I do recall is that several
people then in the DNSSEC working group provided me with very detailed and
specific instructions (as in: what specific commands to type!) to set up and
deploy DNSSEC.  I was provided with instructions for re-signing the zones
when I made changes, and we connnected with Afilias to provide the upstream
connectivity.

At the time, it was impressed upon me by those participants that the particular
way this was done was "the right way" to do it, and that any tampering with
or changes made to the configuration and/or setup could cause DNS for the IETF
to fail, thereby "throwing them off" the internet.

Needless to say (as they say where I come from), "I don't need THAT drama!"

With the much looser organization of the IETF in the past, I might long ago
have undertaken - on my own - to reach out to people and try to champion a
change to a new algorithm.  As the structure of the IETF has become more
formalized, such championing is now well out of authority for me in my role as
the IETF's IT operations vendor.  

More recently - maybe a year or two ago? - I was approached by other
participants with this same question.  I responded that I didn't have the
authority to make this change and that - if the IETF wanted to make this
change - I would need to be given specific instructions and steps to follow
to do it "the (current) right way."  Petr has graciously offered to help,
which is great, but, again, I have no authority to act. 

I referred him to this list because this list is where IETF leadership people
with an interest in the IETF's infrastructure and services congregate and
discuss matters of this type.  I don't know who can make this decision, but I
do know that whoever it is is likely on this list, so I sent Petr here so he
could voice his opinion and be heard by those people.

Given that the meeting is in progress, I doubt that a decision will come "now",
but given the confusion on the thread I felt I should step in and explain the
background for everyone's benefit.

As a reminder, I am not normally subscribed to this list, so please direct-CC 
me if you want me to immediately see replies.  I hope this information is
helpful and I apologize for the noise.

Thanks!

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat, and operations *vendor*)

---

From: Glen <[email-masked]>
Date: Wed, 23 Mar 2022 15:34:49 -0700

On Wed, Mar 23, 2022 at 03:29:20PM -0700, Glen wrote:
> ..

I now see that a very detailed discussion of this is taking place on DNSOP
( https://mailarchive.ietf.org/arch/browse/dnsop/ ) and it sounds like there
is a lot of clarifying information being provided to the OP by the WG list
participants.  I'm assuming that they'll take this over there, at least for
the time being, and am (until I'm asked otherwise) now done with this item.

Apologies again for the noise.

Glen
--
Glen Barney
IT Director
AMS (IETF Secretariat)

---

From: Jay Daley <[email-masked]>
Date: Thu, 24 Mar 2022 16:46:15 +0100

Hi Glen

I thought it best if I follow this up on list.

> On 23/03/2022, at 11:29 PM, Glen <[email-masked]> wrote:
> 

I thought this had been made clear on multiple occasions, but I am very happy to state again that you are always welcome to recommend a change to the way things are done, which explicitly includes doing so publicly.  

I would though caution against starting from a position of championing - it’s often the case that areas where the community have made recommendations are complex and any change requires enquiry and discussion before a specific way forward can be identified.  We’ve seen that clearly in this case with the discussion on dnsop, where the complexities are subtle and while there is perhaps consensus on the need for a change, it isn’t there for the timing of that change.

cheers
Jay

> ___________________________________________________________
> Tools-discuss mailing list - [email-masked]
> This list is for discussion, not for action requests or bug reports.
> * Report datatracker and mailarchive bugs to: [email-masked]
> * Report tools.ietf.org bugs to: [email-masked]
> * Report all other bugs or issues to: [email-masked]
> List info (including how to Unsubscribe): https://www.ietf.org/mailman/listinfo/tools-discuss
> 

-- 
Jay Daley
IETF Executive Director
[email-masked]