Subject: [DNSOP] Feedback on draft-koch-dnsop-resolver-priming (fwd)

From: Lucy Lynch <[email-masked]>
Date: Thu, 10 May 2007 16:05:52 -0700 (PDT)

All -

Whatever Mr. Moreau's intentions, I *got* a copy of this message as it was
cc:ed to [email-masked]

This communication was, in fact,  posted to the list.

- Lucy

---------- Forwarded message ----------
Date: Mon, 30 Apr 2007 10:00:43 -0400
From: Thierry Moreau <[email-masked]>
To: [email-masked], [email-masked], [email-masked], [email-masked]
Cc: [email-masked]
Subject: [DNSOP] Feedback on draft-koch-dnsop-resolver-priming

To:
 	Peter Koch,
 	Matt Larson,
 	Joe Abley,
 	Roy Arends,

CC:	ietf dnsop mailing list

Dear four gentlemen:
 			according to DNSOP Prague meeting minutes, you are the 
co-editors of the revision -01 for the document 
draft-koch-dnsop-resolver-priming-00. I also looked at the slides presented by 
Peter at the Prague meeting (now at 
http://www3.ietf.org/proceedings/07mar/slides/dnsop-4.pdf).

 	I appreciate this work, and I believe that I made a related 
contribution in Appendix A of the draft draft-moreau-srvloc-dnssec-priming-00, 
in which I omitted to refer to Peter's draft as I should have; my apologies for 
this omission.

 	The present message is to assist you in your editing work, as this 
subject matter would be best covered by reference to your work in my draft. 
I.e. I would like to drop Appendix A in my draft, which main part is concerned 
with something different, i.e. using SLP for DNSSEC priming assistance, giving 
that "DNSSEC priming" is specified somewhere. (Maybe you don't need to care for 
what I intend to do, it's FYI.)

 	Let's go back to your priming draft.

 	First, referring to the last question in Peter's presentation Question 
page: "Root server address validation needed?" I answer YES. If you find a 
consensus on a NO answer, you don't need to consider my second point.

 	My second point is about the first issue in Peter's presentation page 
6:
"Issues with DNSSEC validation
   o	 NET-related information not (readily) available to root servers
 	  -	Rename root servers (only zones root servers are authoritative 
for)
 	  -	Use a second trust anchor"

 	An idea (borrowed from a DNSSEC opt-in scheme which by itself  IS NOT 
BROUGHT as an ietf contribution) is to add a third alternative above:

 	  -	Use RRSIGs for A and AAAA RRsets using a signature key "shared" 
with the root

 	You may be able to get the idea from my draft appendix A. So my second 
point is that you may consider integrating this idea into the contents of the 
draft. If you need clarifications, let me know.

 	Now, let me make a few observations about the IPR status of the above 
idea. Generally, these observations apply irrespective if the idea remains in 
my draft, or is integrated in yours, since either way it's part of an ietf 
contribution.

 	DNSSEC priming specifications is only facilitating deployment at the 
root, which is by itself challenging in many different aspects. The theoretical 
benefits of using the above idea are 1) a quicker resolution of an important 
issue in your draft, 2) an opportunity for software development shortcut when 
implementing priming on the resolver side, and 3) lesser need to move the root 
server from ROOT-SERVERS.NET. These benefits are very hypothetical since DNSSEC 
deployment at the root is delayed by so many things.

 	In this context, I intend to file an IPR disclosure statement offering 
a free, universal, non-exclusive, time-unlimited license to use the above idea 
(that is conveniently defined by reference to the claims as they stand) for DNS 
root zone file publishing by any DNS root zone operator, conditional to the 
approval of your draft with the above idea included. (If you don't find the 
idea useful to the point of including it in your draft, you don't need and/or 
deserve any information about what I might do.) This message is not a formally 
legal commitment, only an indication of the most likely course of events. This 
indication should be sufficient for revision -01 draft preparation purposes.

 	Anyway, I'll have to wait a few weeks for the patent application to be 
published by the patent office (early publication has been requested) before 
filing an IPR disclosure.

 	In summary, I suggest you adopt the idea of having the authoritative 
*.ROOT-SERVERS.NET A or AAAA RRsets signed with a public signature key value 
present in the DNSKEY RRsets present at both ROOT-SERVERS.NET and the root, 
provided that the DNSKEY RRset present at ROOT-SERVERS.NET is not self-signed 
by this common signature key value.

Thanks for this work, and best regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Dean Anderson <[email-masked]>
Date: Thu, 10 May 2007 20:12:27 -0400 (EDT)

Oops. First version had some gramatical errors. This is better edited. 
Please disregard the earlier message.

---------- message ----------
Date: Thu, 10 May 2007 16:46:44 -0400 (EDT)

On Thu, 10 May 2007, Dave Crocker wrote:

> 
> 
> Thierry Moreau wrote:
> > Rob's message is replying on the mailing list to a private e-mail 
> > message from me to the four authors for the -01 revision of 
> > draft-koch-dnsop-resolver-priming (Prague dnsop meeting minutes section 
> 
> Rob's note is not a "reply".  It well might be pursuing a matter you raised 
> privately, but his note follows none of the syntax, style or even semantics of 
> a "reply".

I think the issue is that Mr. Austein would not have even known about
the private communication unless the authors had told him of it.

Further, without any substantive consideration on-list by the WG of the
proposal, Mr. Austein has "directed" the WG not to even consider the
proposal.  This seems a little bit "back-alley", and not the open
discussion that ought to happen.

It seems Mr. Koch hasn't recused himself, but merely asked Mr. Austein
to act for him. That isn't recusal.

> Besides that, you sent a note to folks who are formally acting in a wg role, 
> and your note pertained to a fundamental wg issue, and you somehow think that 
> your sending it to them privately means that they shouldn't even raise the 
> topic on the list?  (Note that your message was not quoted, so we can dispense 
> with "copyright" related issues.)

The 4 authors aren't formally acting in a WG role. Mr. Koch (one of the
4)  said he "recused". Its not that the |authors| couldn't raise the
proposal on the list, (the authors didn't do so). The Working Group
Chair, abruptly, and without due consideration, directed the WG not to
even consider Mr. Moreau's proposal.

> My own view is they would have been derelict if he had *not* pursued the 
> matter with the public wg mailing list.  That's what IETF transparency is 
> supposed to be about.

Transparancy is what the IETF is about. A transparent act would be for
the authors, acting only as authors, to come forward to the working
group to discuss Mr. Moreau's suggestion, or to reject it privately, at
which point Mr. Moreau would be free to bring it up to the Working Group
himself.

> > In terms of wg governance, I doubt the wg chair has the authority to so 
> > unilaterally "direct" a wg draft editor on a specific technical issue, 
> 
> Oh boy.  What you don't know about IETF wg management methods...

Didn't you recently say the IETF wasn't a non-profit???  It seems to me
that your recollections may occasionally be faulty.

In fact, this issue of WG 'direction' was just recently discussed. Jeff
Schiller pointed out that a 'direction' of this sort is only appropriate
when the working group has deadlocked and can't proceed. Plainly, the
back-channel discussions don't represent the working group and don't
show the working group is dead-locked. So 'direction' is inappropriate
at this time.

> Rob carefully qualified his directive, to be contingent upon the
> absence of wg consensus to the contrary.  This is a time-honored wg
> management method for making progress.

Actually, the working group hasn't had a chance to develop a consensus.  
Mr. Austein's direction is premature.  Such direction is only
'time-honored' when the working group can't agree.  We haven't gotten to
the point of hearing all the details, so how can one claim we can't
agree and therefore need direction from the chairs?

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Dean Anderson <[email-masked]>
Date: Thu, 10 May 2007 20:12:27 -0400 (EDT)

---------- message ----------

		--Dean