Subject: Re: [dane] Meeting in Hawaii?

From: Dan York <[email-masked]>
Date: Wed, 1 Oct 2014 11:49:48 +0000

Warren, (and everyone else)

On Sep 29, 2014, at 4:10 PM, Jakob Schlyter <[email-masked]<mailto:[email-masked]>> wrote:

On 27 sep 2014, at 02:52, Warren Kumari <[email-masked]<mailto:[email-masked]>> wrote:

Please let us know if you'd really like to meet, and open issues on
documents that need discussing. Also, if you have a doc, we'd like it
revised *soon*.

All the authors of the various drafts on DANE for email (S/MIME and OpenPGP) will be there, and we will have discussions on the list beforehand. Given this, I for one, hope we can meet and flesh out any details left on this topic.

To Jakob's point, we're going to have a significant number of the DANE-related authors and implementors all together at IETF and I think a general topic of "What Else Do We Need To Do For DANE For Email" could be a good discussion topic.

While we have this great big "DANE brain trust" all in one location (and also coming in remotely), I would be interested in having (and would be willing to lead, if necessary) a discussion around "What Else Do We Need To Do To Get DANE More Widely Deployed".  Now that we are seeing actual deployment and usage, are there things we have learned that can guide us in accelerating the deployment of DANE?

We've captured a good bit of implementation guidance in Viktor and Wes' https://tools.ietf.org/html/draft-ietf-dane-ops-06 and so perhaps a review of that document would help, but I'm also interested in questions like:

- what roadblocks are people running into with implementing DANE?  (outside of the broader issue of getting DNSSEC validation and signing more widely available)

- are there more "Using DANE with <foo>" types of documents that we can or should create? (and who is willing to do so)

- have we seen areas where more standardization would help?

- are there some good examples/case studies of DANE implementations that we could perhaps capture as informational RFCs?  (the Jabber community's implementation comes to mind)

- are there places where it would be helpful if there were reference implementations of DANE support?  For example, DANE for email got a boost when Viktor added it to postfix.  Are there other commonly-used open source projects where the addition of DANE support would help move deployment along?   (I'm NOT saying that the DANE WG would be involved with these implementations... but brainstorming together and identifying a list could help other people and groups (ex. Internet Society, Verisign Labs, NLNet Labs) advocate and perhaps fund efforts to get that DANE support added.)

- are there test tools that need to be developed? or existing ones that need to be better promoted?  are there interop tests we can arrange?

I realize some of this may seem outside our charter, but if I look at the charter, it includes these phrases:
-----
The
DANE WG shall also produce a set of implementation guidance
for operators and tool developers.

<big snip>

The group may also create documents that describe how protocol
entities can discover and validate these bindings in the execution
of specific applications. This work would be done in coordination
with the IETF Working Groups responsible for the protocols.

The group may in addition encourage interoperability testing and
document the results of such testing.
-----

So I do see a good bit of this covered under that.

The end result I'd like to see out of this discussion would be:

- guidance for the WG on what, if any, additional documents we need to create (and identification of who might write them)
- potential interoperability testing
- guidance to WG members and other organizations on how we can get DANE more widely deployed

Obviously I have an interest in this because I'm employed by the Internet Society in large part to do whatever possible to accelerate the deployment of DNSSEC (and IPv6 and... ), but this really means that I'm here for *you* all to help do what needs to be done.  I'd definitely appreciate a sense of the group about what we can all collectively do to make DANE more widely used.  Certainly we can have some of this discussion on the list... but in a f2f meeting we can have a much more engaged discussion.

So if we have time on the agenda and you all feel it would be appropriate, I'd like to have a discussion along these lines.

I'm not sure we need 2 hours though - 1,5 hours should be enough.

I'm also not sure we need 2 hours... although this discussion I outlined above could wind up occupying some time.

Dan

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 2 Oct 2014 23:30:17 +0000

On Wed, Oct 01, 2014 at 11:49:48AM +0000, Dan York wrote:

> All the authors of the various drafts on DANE for email (S/MIME
> and OpenPGP) will be there, and we will have discussions on the
> list beforehand. Given this, I for one, hope we can meet and flesh
> out any details left on this topic.

FWIW, I will not be present.

> To Jakob's point, we're going to have a significant number of
> the DANE-related authors and implementors all together at IETF and
> I think a general topic of "What Else Do We Need To Do For DANE
> For Email" could be a good discussion topic.

I am at Frankfurt Airport after a trip to speak about DANE at the
DENIC registrar technical conference.

You may be aware that the most substantial DANE deployments are
for now in Germany, and this is likely to continue through the rest
of 2014, with additional .de deployments, with little progress
elsewhere.

[
  Many SMTP domains with TLSA RRs are listed at:

      https://www.tlsa.info/statistics/best_results

  though this site may not actually be checking that
  the servers actually have a matching certificate chain,
  rather it looks like it just checks for the presence of
  DNSSEC validated TLSA RRs.  Ironically, the site's HTTPS
  server has an expired stapled OCSP response at the moment.
]

It seems that DNSSEC deployment *is* by far the main obstacle.
Registrars need to support DS RRs and ideally be able to host DNSSEC
domains.  Unlike registries looking after one or a handful of
domains, registrars host thousands to millions of domains.  One of
the issues raised at the DENIC meeting, is that DNSSEC-capable
nameserver software that scales well to very large zone counts is
by no means abundant.  Reportedly only PowerDNS comes close, and
at least some registrars are reluctant to put all the eggs in one
basket and rely on just a single software platform.

So if there is anything that can be done to spur deployment of
additional scalable nameservers, that would be great.

Of course there is also impedance at the consumer end, with a lot
of cable-modems and the like acting as DHCP server + DNS proxy,
but not supporting DNSSEC.

Once DNSSEC is working, the actual DANE deployment is rather a lot
simpler.  Just publish some TLSA RRs and implement the right
key-rotation strategy.

For now, only Postfix implements DANE outbound (inbound any MTA
will do, all the DANE-specific code is on the client).  Adoption
beyond .de would be greatly advanced if at least one large email
provider published TLSA RRs and/or implemented DANE outbound.

Gmail, Microsoft Office365, Yahoo, AOL, should at least seriously
consider plans towards SMTP with opportunistic DANE TLS.  If you can
do anything to prod the right people, that would be great.

Beyond SMTP, it would be great to get some early design work underway
for opportunistic DANE TLS with "h2" (HTTP).  I don't see DANE
adoption for HTTPS any time soon (at least not until EV certs go
out of style).  DANE can however substantially harden opportunistic
security with HTTP, provided last-mile is under control.

This runs into the "last-mile" problem for DNSSEC.  Where are we
with that?

I explained to the DENIC registrars how DANE simplifies virtual
hosting, obviates CRLs and improves effectiveness of "revocation"
(de-publishing bad data from DNS).  These are good features for HTTP
to have, but we seem to be no closer to DANE for HTTP.

In the pipeline we have just Exim, some XMPP software, and more
German domains.

> - are there places where it would be helpful if there were
> reference implementations of DANE support?  For example, DANE for
> email got a boost when Viktor added it to Postfix.  Are there other
> commonly-used open source projects where the addition of DANE
> support would help move deployment along?

Well, Sendmail support would also be nice.  But more importantly
some of the closed MTAs would probably be more important:

    * Microsoft Exchange
    * Ironport, Barracuda and similar appliances
    * Gmail, Yahoo, AOL, Office365, ...

Of course having reasonably feature-complete support for DANE in
TLS toolkits would really help.  This is why I've joined the OpenSSL
team, with a mission to work on integrated DANE support, once some
of the more urgent priorities in OpenSSL are resolved.

It would be helpful to have sound DANE support in NSS, GnuTLS,
PolarSSL, ...  provided these were designed and implemented with
care and are not just incomplete prototypes.  In particular, I
don't have the cycles to design-review/code-review all DANE
implementations, but such reviews are likely necessary.  Yes,
testing can find many classes of bugs, and a DANE test-suite would
be useful.

-- 
	Viktor.

---

From: Warren Kumari <[email-masked]>
Date: Thu, 2 Oct 2014 20:36:19 -0400

On Wednesday, October 1, 2014, Dan York <[email-masked]> wrote:

>   On Sep 29, 2014, at 4:10 PM, Jakob Schlyter <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
> On 27 sep 2014, at 02:52, Warren Kumari <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
> All the authors of the various drafts on DANE for email (S/MIME and
> OpenPGP) will be there, and we will have discussions on the list
> beforehand. Given this, I for one, hope we can meet and flesh out any
> details left on this topic.
>
>
>  To Jakob's point, we're going to have a significant number of the
> DANE-related authors and implementors all together at IETF and I think a
> general topic of "What Else Do We Need To Do For DANE For Email" could be a
> good discussion topic.
>
>  While we have this great big "DANE brain trust" all in one location (and
> also coming in remotely), I would be interested in having (and would be
> willing to lead, if necessary) a discussion around "What Else Do We Need To
> Do To Get DANE More Widely Deployed".  Now that we are seeing actual
> deployment and usage, are there things we have learned that can guide us in
> accelerating the deployment of DANE?
>
>  We've captured a good bit of implementation guidance in Viktor and Wes'
> https://tools.ietf.org/html/draft-ietf-dane-ops-06 and so perhaps a
> review of that document would help, but I'm also interested in questions
> like:
>
>  - what roadblocks are people running into with implementing DANE?
>  (outside of the broader issue of getting DNSSEC validation and signing
> more widely available)
>
>  - are there more "Using DANE with <foo>" types of documents that we can
> or should create? (and who is willing to do so)
>
>  - are there some good examples/case studies of DANE implementations that
> we could perhaps capture as informational RFCs?  (the Jabber community's
> implementation comes to mind)
>
>  - are there places where it would be helpful if there were reference
> implementations of DANE support?  For example, DANE for email got a boost
> when Viktor added it to postfix.  Are there other commonly-used open source
> projects where the addition of DANE support would help move deployment
> along?   (I'm NOT saying that the DANE WG would be involved with these
> implementations... but brainstorming together and identifying a list could
> help other people and groups (ex. Internet Society, Verisign Labs, NLNet
> Labs) advocate and perhaps fund efforts to get that DANE support added.)
>
>  - are there test tools that need to be developed? or existing ones that
> need to be better promoted?  are there interop tests we can arrange?
>
>  - guidance for the WG on what, if any, additional documents we need to
> create (and identification of who might write them)
>  Obviously I have an interest in this because I'm employed by the
> Internet Society in large part to do whatever possible to accelerate the
> deployment of DNSSEC (and IPv6 and... ), but this really means that I'm
> here for *you* all to help do what needs to be done.  I'd definitely
> appreciate a sense of the group about what we can all collectively do to
> make DANE more widely used.  Certainly we can have some of this discussion
> on the list... but in a f2f meeting we can have a much more engaged
> discussion.
>
>  So if we have time on the agenda and you all feel it would be
> appropriate, I'd like to have a discussion along these lines.
>
Great -- we'll meet. I'll chat with Olafur re: 1.5h vs 2h.

It is nice to see that there is this much interest / desire to meet -- a
cynical reader might assume that this was all a nasty, but clever ploy to
get folk to promise to rev docs, and come up with interesting topics... but
we are not that inventive / evil :-P

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf

---

From: Michael Richardson <[email-masked]>
Date: Thu, 02 Oct 2014 21:02:05 -0400

> basket and rely on just a single software platform.

Is it a question of the signing infrastructure, or the publication
infrastructure?

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 3 Oct 2014 02:11:56 +0000

> Is it a question of the signing infrastructure, or the publication

I don't understand the issues in detail.  Perhaps Jens Wagner will
respond.

-- 
	Viktor.

---

From: Jens Wagner <[email-masked]>
Date: Sun, 05 Oct 2014 23:01:50 +0200

Hi Viktor, Hi Michael,

> I don't understand the issues in detail.  Perhaps Jens Wagner will

It's a question of the publication infrastructure.

Right now, PowerDNS is the only (open source) DNS server supporting both 
DNSSEC and large zone counts (unlike the typical registry setup, where 
you manage a small number of huge zonefiles).

As a registrar, we allow our customers to add, remove and update DNS 
zones, and all those updates get pushed to our publication 
infrastructure immediately (~4 seconds delay). Those updates should not 
interfere with the resolution of other zones.

Also, to prevent DNS outages caused by attacks and other reasons, we do 
not want to rely on a single vendor solution, so we use MyDNS and 
PowerDNS together (both implement database backed, cached responses).

However, MyDNS never implemented DNSSEC (and is sort of abandoned), 
BIND10/Bundy is (was?) not production ready, and others like YADIFA and 
Knot are optimized for TLD operations only. So our options are:

- run DNS using PowerDNS only (works perfectly, but SPOF)
- implement DNSSEC into MyDNS ourselves
- wait for Bundy (or another product) to become production ready

Do you have any suggestions?

Best regards,
- jens

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 6 Oct 2014 02:05:41 +0000

On Sun, Oct 05, 2014 at 11:01:50PM +0200, Jens Wagner wrote:

> DNSSEC and large zone counts (unlike the typical registry setup, where you
> manage a small number of huge zonefiles).

Can you shed a bit more light on the ways in which BIND/unbound/...
are not entirely suitable to serving a very large dynamic number
of zones?

What are the main obstacles? Does, for example, BIND take too long
to start/reload? Is adding a new zone too disruptive? Something
else?

-- 
	Viktor.

---

From: Jens Wagner <[email-masked]>
Date: Mon, 06 Oct 2014 10:22:39 +0200

> to start/reload? Is adding a new zone too disruptive? Something

According to http://unbound.net/ , Unbound is a validating, recursive, 
and caching DNS resolver. So it cannot be used as an auth nameserver.

BIND9 itself takes too long to reload, when e.g. adding new zones, and 
also needs to load everything into memory.

BIND9 + DLZ patches would work (http://bind-dlz.sourceforge.net/), but 
it has a low performance (iirc, it uses the DB driver for all queries 
then, and does not use in memory caches). I found some data here: 
http://www.sanog.org/resources/sanog14/sanog14-devdas-dns-scalability.pdf

Basically, we are looking for nameservers, that:

1. allow you to add, remove and update zones online, anytime
2. do not 'stutter' or even stop resolving while getting updated, no 
matter if single records are updated, or new zones added
3. do not need to keep all zones and records in memory
4. support DNSSEC + NSEC3
5. use internal caching for performance reasons

PowerDNS provides all of the above, BIND9+DLZ does everything but 5., 
MyDNS does everything but 4. (and is outdated).
Most servers that are written for TLDs fail at 2. and or 3. Do you know 
any other products? Still hope for BIND10/Bundy.

Best,
- jens

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 6 Oct 2014 13:45:38 +0000

On Mon, Oct 06, 2014 at 10:22:39AM +0200, Jens Wagner wrote:

> According to http://unbound.net/ , Unbound is a validating, recursive, and
> caching DNS resolver. So it cannot be used as an auth nameserver.

Sorry, should have said "nsd".  I assume same issues as BIND...

> 2. do not 'stutter' or even stop resolving while getting updated, no matter
> if single records are updated, or new zones added
> PowerDNS provides all of the above, BIND9+DLZ does everything but 5., MyDNS
> does everything but 4. (and is outdated).
> Most servers that are written for TLDs fail at 2. and or 3. Do you know any
> other products? Still hope for BIND10/Bundy.

Thanks, that's roughly the level of detail I was looking for.

-- 
	Viktor.

---

From: Carsten Strotmann <[email-masked]>
Date: Mon, 6 Oct 2014 16:00:50 +0200

Hello Jens,

> 5. use internal caching for performance reasons

NSD, BIND9 and Knot should all satisfy the above, except for 3. YADIFA
might also, but I have no experience with it so far.

Is memory really an issue these days?

Microsoft WinDNS 2012R2 satisfies all points above, but has other
issues (no support for TLSA-RRs).

> Most servers that are written for TLDs fail at 2. and or 3. Do you
> know any other products? Still hope for BIND10/Bundy.

Bundy-DNS would be an alternative satisfying all your requirements, but
it might not be "polished" enough in its current state. Bundy-DNS today
does not have full-time developers, no sponsor and is moving
slow. Please contact me off-list if you (or anyone) is interested to
testdrive Bundy-DNS or change the situation for the Bundy-DNS project.

--
Carsten Strotmann 
Email: [email-masked] 
Blog:strotmann.de

---

From: James Cloos <[email-masked]>
Date: Mon, 06 Oct 2014 10:59:41 -0400

>>>>> "JW" == Jens Wagner <[email-masked]> writes:

JW> - run DNS using PowerDNS only (works perfectly, but SPOF)

I find that using power as a hidden master and nsd as the advertized
auths works very well.

Nsd is very efficient.

And one can use sql replication w/ or w/o heartbeat to have live backups
for the hidden master.

-JimC
-- 
James Cloos <[email-masked]>         OpenPGP: 0x997A9F17ED7DAEA6