Subject: [DNSOP] Call for Adoption: DNSSEC as BCP: draft-hoffman-dnssec

From: Tim Wicinski <[email-masked]>
Date: Thu, 24 Mar 2022 19:07:47 -0400

All

If you attended the most recent DNSOP session, you've heard Warren speak
about creating a BCP for DNSSEC, including  all of the DNSSEC related RFCs,
in order to make life easier for implementers and DNS operators.

We want to ask the working group if this is something DNSOP wants to work
on. If so, we can work with Warren to prioritize getting through the
approval process as efficiently as possible.

This starts a Call for Adoption for: draft-hoffman-dnssec

The draft is available here:
https://datatracker.ietf.org/doc/draft-hoffman-dnssec/

Please review this draft to see if you think it is suitable for adoption
by DNSOP, and send any comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This call for adoption ends: 7 April 2022

Thanks,
tim wicinski
For DNSOP co-chairs

---

From: Brian Dickson <[email-masked]>
Date: Thu, 24 Mar 2022 16:23:49 -0700

> Please also indicate if you are willing to contribute text, review, etc.
I support adoption of this by the WG.
I am willing to review, and to contribute text.

Brian Dickson

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Paul Wouters <[email-masked]>
Date: Fri, 25 Mar 2022 11:36:46 +0100

On Mar 25, 2022, at 00:08, Tim Wicinski <[email-masked]> wrote:
> 
> If you attended the most recent DNSOP session, you've heard Warren speak about creating a BCP for DNSSEC, including  all of the DNSSEC related RFCs, in order to make life easier for implementers and DNS operators.

Please do. As an author and reviewer, I have ran into issues and then inconsistencies on how to normatively reference DNSSEC.

Paul

---

From: Ben Schwartz <[email-masked]>
Date: Fri, 25 Mar 2022 11:12:17 -0400

I support adoption of this draft.

I appreciate that it acknowledges that deployment has been lower than some
advocates hoped, but I think the text following that is misplaced:

   However, this low level of implementation
   does not affect whether DNSSEC is a best current practice; it just
   indicates that the value of deploying DNSSEC is often considered
   lower than the cost.

I would suggest a different caveat, perhaps:

Nonetheless, the majority deployment of DNSSEC within certain major
registries [1], and near-universal deployment across Top-Level Domains [2],
demonstrate that DNSSEC is suitable for implementation by both ordinary and
highly sophisticated domain owners.

[1] https://stats.sidnlabs.nl/en/dnssec.html
[2] https://stats.research.icann.org/dns/tld_report/

On Fri, Mar 25, 2022 at 6:37 AM Paul Wouters <[email-masked]> wrote:

> Please do. As an author and reviewer, I have ran into issues and then
> inconsistencies on how to normatively reference DNSSEC.
>
> Paul

---

From: "Wessels, Duane" <[email-masked]>
Date: Fri, 25 Mar 2022 15:34:32 +0000

> On Mar 24, 2022, at 4:07 PM, Tim Wicinski <[email-masked]> wrote:
> 
>  
> All
> 
> We want to ask the working group if this is something DNSOP wants to work on. If so, we can work with Warren to prioritize getting through the approval process as efficiently as possible.
> 
> 
> The draft is available here: https://datatracker.ietf.org/doc/draft-hoffman-dnssec/
> 

I think it is suitable for adoption.

> Please also indicate if you are willing to contribute text, review, etc.

A couple of things from my first read:

Should the abstract perhaps more directly state the goal of documenting DNSSEC as a best current practice?  I find the stated purpose “to introduce all of the RFCs in one place” somewhat unconvincing.

From section 4: "IANA already has two registries that relate to DNSSEC”.  Shouldn’t the DS digest algorithm registry be considered a third?

DW

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 25 Mar 2022 18:25:00 +0000

I'm the author, so I guess it goes without saying that I support its adoption. Given the higher level of scrutiny that BCPs garner, I will incorporate suggested text in versions of the draft if they are likely to reflect changes that would garner consensus.

--Paul Hoffman

---

From: Bill Woodcock <[email-masked]>
Date: Sat, 26 Mar 2022 17:01:45 +0100

> On Mar 25, 2022, at 12:07 AM, Tim Wicinski <[email-masked]> wrote:

I have read the draft, corrected one grammatical nit, and fully support its adoption by DNSOP.

                                -Bill

---

From: Wes Hardaker <[email-masked]>
Date: Sun, 27 Mar 2022 05:56:07 -0700

> This starts a Call for Adoption for: draft-hoffman-dnssec

I support the concept of getting something down to a single reference,
and believe that this document is a good start and should be accepted as
a WG document.

Personally, I'd prefer we produce a STD but that's more work, certainly.

I'll also note it could probably be informational too, since it reads
more like a roadmap than a BCP.  But that's a very subjective statement.

Finally, I have comments/suggestions about some of the text in the
document but I'll refrain from mentioning those until it's adopted.

> This call for adoption ends: 7 April 2022

Final comment: it does feel like the appearance of this document/desire
and its subsequent call for adoption is doing an end-run around the
previous poll for what should be adopted next.  Though I understand the
reasons for it trumping the rest of the "line", though that's a horrible
misuse of a noun as the order of acceptance was never assured based on
the poll results.

-- 
Wes Hardaker
USC/ISI

---

From: Masataka Ohta <[email-masked]>
Date: Sun, 27 Mar 2022 22:45:25 +0900

Paul Hoffman wrote:> Given the higher level of scrutiny that BCPs garner,

Such a false sense of security is quite harmful to reduce
the end to end security of the Internet.

							Masataka Ohta