Subject: Re: Key Rollover: proposed way forward

From: Rob Austein <[email-masked]>
Date: Thu, 13 Jul 2006 17:28:14 -0400

At Thu, 13 Jul 2006 17:11:08 -0400, Olafur Gudmundsson wrote:
> ...
> The chairs then proposed that the timers proposal be selected.
> After open discussion, the sense of the room was that this was an
> acceptable choice.
> ...
> The purpose of this message is get confirmation from the mailing list
> on this path forward.
> 
> Please reply to namedroppers if you support or object to this path forward.

I support this path forward.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Frederico A C Neves <[email-masked]>
Date: Thu, 13 Jul 2006 19:10:47 -0300

On Thu, Jul 13, 2006 at 05:11:08PM -0400, Ólafur Guðmundsson /DNSEXT co-chair wrote:
...
...
> 	Olafur 

I support this proposal,

Fred

---

From: Ólafur Guðmundsson /DNSEXT co-chair <[email-masked]>
Date: Thu, 13 Jul 2006 18:13:43 -0400

At 18:11 13/07/2006, Edward Lewis wrote:
>At 17:11 -0400 7/13/06, Ólafur Guðmundsson /DNSEXT co-chair wrote:
>
>Would that be the following document?
>
>http://www.ietf.org/internet-drafts/draft-ietf-dnsext-trustupdate-timers-02.txt
>
>--

Yes, and its successors.

         thank you for pointing this out.

         Olafur

---

From: Gustavo Lozano <[email-masked]>
Date: Thu, 13 Jul 2006 18:19:29 -0400

>Please reply to namedroppers if you support or object to this path forward.

I support this path.

Gustavo Lozano
NIC Mexico

---

From: Kenji Rikitake <[email-masked]>
Date: Fri, 14 Jul 2006 09:47:09 +0900

On Thu, Jul 13, 2006 at 05:11:08PM -0400, Olafur Gudmundsson /DNSEXT co-chair wrote:
...
...
> Please reply to namedroppers if you support or object to this path forward.

I support the proposal mentioned above.

// Kenji Rikitake

---

From: Thierry Moreau <[email-masked]>
Date: Thu, 13 Jul 2006 21:34:13 -0400

Dear all:

I must thank the DNSEXT wg co-chairs for allowing the discussion on 
trust anchor key rollover solution selection to proceed in the 
namedroppers mailing list (this discussion started during the IETF-66 
DNSEXT wg meeting despite lack of formal notice in the meeting agenda).

It appears that the TAK rollover requirement document will not change 
significantly from draft-ietf-dnsext-rollover-requirements-02. I do not 
put into question that this document is likely to reflect the wg 
consensus on requirements. The fact that I object to the contents of 
this document now becomes irrelevant.

In this perspective, the Paul Vixie approach verbally presented at 
IETF-64 becomes the logical selection, except for the minor defect that 
it is not in a draft document (Paul recently re-affirmed his proposal in 
http://ops.ietf.org/lists/namedroppers/namedroppers.2006/msg00843.html). 
(Those who have followed the TAK debate may whish to read the preceding 
sentence more than once.) Indeed, I now support a TAK rollover scheme 
with the limited security effectiveness for reasons of deployment 
streamlining and protocol efficiency. The document 
draft-ietf-dnsext-rollover-requirements-02 does not justify anything 
more complex and/or larger response sizes than the simple Paul Vixie 
approach.

As a security expert, when the DNSEXT wg clearly shows a don't care 
attitude with respect to ultimate TAK rollover security, there is a 
danger in pursuing the deployment of more complex solutions, e.g. 
-threshold, or -timers. This danger is apparent security through mere 
complexity. In the present case, there is no DNSEXT wg agreed-upon 
requirement which justifies the added complexity. The incremental 
security in moving from the Paul Vixie approach to either -threshold or 
-timers is marginal and not justified by any requirement in the document 
draft-ietf-dnsext-rollover-requirements-02.

For response size issues, I suggest that 
http://www.dnssec-tools.org/docs/trust-anchor-comparison-v02.htm 
contains an error in assessing the "general applicability" of the Paul 
Vixie's approach in "Needs to have ZSK and KSK separation."

For to reduce deployment complexity, I would suggest that the Paul Vixie 
approach can be specified and implemented without the additional RR type 
which is merely "an opportunistic optimization" (see page 5 
http://www3.ietf.org/proceedings/05nov/slides/dnsext-3.pdf).

The present message is an advance notice that I will write a draft along 
the above ideas in a short time frame. Thus, an automated TAK rollover 
solution can be offered by DNSEXT consistently with its view of the 
relevant requirements (even if I don't share this view). DNSSEC is too 
important (for both organizations who committed resources to its 
development and application protocol designers who expect the global DNS 
data integrity vulnerability to be addressed) for me to abstain from 
this voluntary contribution.

A side note to any DLV taker at this time: while the IANA assignment of 
an RR type code to DLV seems to point to RFC4431, the IETF-66 reference 
document for it is draft-weiler-dnssec-dlv (see page 11 in 
http://www3.ietf.org/proceedings/06jul/slides/dnsext-4.pdf).

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: Paul Vixie <[email-masked]>
Date: Fri, 14 Jul 2006 06:12:00 +0000

not so fast.

Thierry Moreau <[email-masked]> wrote:

> significantly from draft-ietf-dnsext-rollover-requirements-02. I do not put
> into question that this document is likely to reflect the wg consensus on
> requirements.  The fact that I object to the contents of this document now
> becomes irrelevant.

as long as we mostly have reasons to respect the recognizers of consensus
here (the wg chairs), then the eventual irrelevancy of individual objections
is inevitable, for all of us.

> In this perspective, the Paul Vixie approach verbally presented at IETF-64
> becomes the logical selection, except for the minor defect that it is not
> in a draft document (Paul recently re-affirmed his proposal in

i've offered to put it in i-d format, which really means editing j.ihren's
proposal to remove some options and add an apex RR, but so far only one
person has said that they were interested in reading such a thing, and the
WG chairs have asked for consensus around the existing proposals, and the
poll is running 100% in favour of -timers (whereas my work is based on
-threshold).  there is no motivation to i-d-ify my riff on -threshold now.

> sentence more than once.) Indeed, I now support a TAK rollover scheme with
> the limited security effectiveness for reasons of deployment streamlining
> and protocol efficiency.  The document
> draft-ietf-dnsext-rollover-requirements-02 does not justify anything more
> complex and/or larger response sizes than the simple Paul Vixie approach.

i agree, but i also respect consensus here, which is around -timers now.

> http://www.dnssec-tools.org/docs/trust-anchor-comparison-v02.htm contains
> an error in assessing the "general applicability" of the Paul Vixie's
> approach in "Needs to have ZSK and KSK separation."

i disagree, i think that my approach does need to have a zsk/ksk separation.

> http://www3.ietf.org/proceedings/05nov/slides/dnsext-3.pdf).

i disagree, the opportunistic optimization is the main difference between
my approach and basic -threshold, and because it has a better steady-state
network footprint, i consider this feature essential to a -threshold
approach.  but since consensus is occuring around -timers, who really cares?

> the above ideas in a short time frame.

please just don't.  if it was to be written up, i am qualified to do so.
what i lack, and what you should lack based on the chair's consensus call,
is any motivation whatsoever to do so.

> A side note to any DLV taker at this time: while the IANA assignment of an
> RR type code to DLV seems to point to RFC4431, the IETF-66 reference

that's unfortunate, since draft-weiler-dnssec-dlv may or may not be the same
protocol as <http://www.isc.org/pubs/tn/isc-tn-2006-1.txt>, and BIND 9.3/9.4
is using the DLV RR type as specified in isc-tn-2006-1.  my advice to 
implementors of "weiler DLV" is that they seek a second DLV-related RR type.

---

From: [email-masked]
Date: Fri, 14 Jul 2006 11:17:54 +0000

> Please reply to namedroppers if you support or object to this path forward.

	with the modifications suggested, I can see -timers being a workable
	solution for the working group to move forward and so support this
	work.  I do recognise that there may continue to be private work in
	other areas, but the WG needs a common goal.

--bill

---

From: "Scott Rose" <[email-masked]>
Date: Fri, 14 Jul 2006 13:48:38 -0400

> [mailto:[email-masked]]On Behalf Of Ólafur Guðmundsson
> /DNSEXT co-chair
> Sent: Thursday, July 13, 2006 6:14 PM
> To: Edward Lewis
> Cc: [email-masked]
> Subject: Re: clarification...Re: Key Rollover: proposed way forward
>
>

I support the proposal on -timers.

After all the discussion and (several) reviews of all the propsals, it is
good to see a common agreed upon method.

Scott

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 14 Jul 2006 16:11:02 -0400

> The purpose of this message is get confirmation from the mailing list

I hereby express my support.

A

-- 
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
jabber: [email-masked]                 +1 416 646 3304 x4110

---

From: "Howard J. Eland" <[email-masked]>
Date: Fri, 14 Jul 2006 16:06:52 -0500

On Thu, 2006-07-13 at 18:13 -0400, Ólafur Guðmundsson /DNSEXT co-chair

>          thank you for pointing this out.

Indeed - since this draft expires today.  Sounds like an reason to
change the filename.

After getting back up from the barrage of flying vegetables, I'll also
say that I support the continued work on the timers draft.

-- 
Howard J. Eland
Afilias USA
+1 215 366 2758
http://www.afilias.info

---

From: Roy Arends <[email-masked]>
Date: Sun, 16 Jul 2006 10:57:46 +0200

Olafur wrote on 07/13/2006 11:11:08 PM:

> The chairs also noted that some of the proposals looked complete while
> others needed more work. The chairs asked for the sense-of-the-room
> if the working group was ready select one proposal for in depth
> review with the goal of selecting that proposal for advancement, unless
> problems where discovered during this process.
> The sense of the room was that the members of the WG present
> supported this.
> 
> The editor noted that text in one section (Trust Anchor deletion)
> needed minor word tuning and will issue a new draft soon.
> 

Roy Arends
Nominet