Subject: Re: [DNSOP] automatic update of DS records

From: Alfred Hönes <[email-masked]>
Date: Tue, 2 Mar 2010 19:08:54 +0100 (MEZ)

At Tue, 2 Mar 2010 16:53:53 +0100, Antoin Verschuren wrote:

> The path is usualy even more complicated.
> I've identified this stream of contractual relationships in a
> registration process:
>
> registry-registrar-reseller-registrant-dns_operator
>
> (some roles may be duplicated or absent, some market players
>  may perform 2 or more roles at once, ...
> ...

Don't we talk about pushing the information from the child
to the parent?
So there's one more logical entity involved; most likely this way:

 vvvvvvvvvvvvvvv                                       vvvvvvvvvvvvv
 dns_op(parent)-registry-registrar-reseller-registrant-dns_op(child)

The dns_op(child) might alternatively have a direct contractual
relationship with the reseller, registrar, or even registry instead
-- depending on business model, regulation, location in the DNS tree,
etc.
Many of {registrant, reseller, registrar} will not be interested
in tracing or even seeing the DNSSEC 'anchor' data passing by,
or might not even be on the administrative path "naturally"
being taken by the data (in the alternative cases).
The only party doubtlessly interested in such seems to be the
responsible for the parent zone content, i.e. the registry.

But that does not exclude a priori direct in-band communication
between dns_op(child) and dns_op(parent), with a 'gating' function
located at the registry for the actual updates at the parent
(similar to the way how NTIA acts on the root zone).

Thus one _possible_ communication model might be:

 dns_op(parent) registry registrar reseller registrant dns_op(child)
    ^    \_<_b_>__/                                         |
    |                        a                              |
    `-------------------------------------------------------'

o   a could be in-band with good authentication and integrity protection
    (or RFC 1149/2549, if needed/preferred),

o   b could be EPP (+ suitable extension); and

o   the workflow management within dns_op(parent) is a local matter.

Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: (+49)7156/9635-0, Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [email-masked]                     |
+------------------------+--------------------------------------------+

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 03 Mar 2010 11:28:36 +0100

Antoin says:

  etc.
  
This type of reasoning implies that there is an (implicit) model
of business relarionships. I do think that we want a protocol which
doesn't not imply a certain model and can therefore be can used in
multiple situations.

	jaap

---

From: [email-masked]
Date: Wed, 3 Mar 2010 19:30:37 +0000

On Wed, Mar 03, 2010 at 11:28:36AM +0100, Jaap Akkerhuis wrote:
> _______________________________________________

	did i miss something?  Antoin sez that where?

--bill

---

From: Alfred Hönes <[email-masked]>
Date: Wed, 3 Mar 2010 20:57:11 +0100 (MEZ)

>   did i miss something?  Antoin sez that where?

That's been me, in my response to Antoin:
  <http://www.IETF.ORG/mail-archive/web/dnsop/current/msg08108.html>

BR,
  Alfred.

---

From: Jaap Akkerhuis <[email-masked]>
Date: Wed, 03 Mar 2010 21:29:41 +0100

Oops, apparently Alfred said so. But who sais what is irrelevat on the
discussion. The oint I was making is that there should not be a fixed
aministrative model.

	jaap

---

From: Alfred Hönes <[email-masked]>
Date: Wed, 3 Mar 2010 22:23:19 +0100 (MEZ)

To avoid further confusion on who said ...

<snip> <snip> <snip> ...

> discussion. The oint I was making is that there should not be a fixed

However, I didn't suggest that either.
I noted that there is an additional logical entity to consider (i.e.,
if you properly unsplice the roles), painted an extension to Antoin's
picture to show where it "most likely" lives in his entity map,
and then continued with pointing out that there are alternatives
for the direct contractual relationships.

In fact, I see a parallel to the "SIP trapezoid":

  The direct (RTP) media path between the communication peers
  corresponds to DNS transactions between the child and parent
  DNS operators, and the SIP signalling path through <n> proxies
  and intermediaries corresponds to the chain of organizatorial
  entities and relationships in our picture.
  In both cases, the 'signalling' transactions carried out in the
  'upper arc' control what eventually happens in the 'bottom arc'.
  In both cases, what most matters eventually is the timing in the
  conceptional 'bottom arc'.

  The possible diversity in the upper arc seems to be an argument in
  favor of a solution employing direct communication in the bottom arc.

It _may_ be that studying this parallelism (and the experiences
with the SIP trapezoid) in more detail could result in useful
insight(s) -- but please don't overstress this comparison!

Kind regards,
  Alfred.