Subject: [DNSOP] On resolver priming

From: Andrew Sullivan <[email-masked]>
Date: Thu, 11 Nov 2010 05:03:51 -0500

Hi all,

The last discussion of signing ROOT-SERVERS.NET involved the arguments
that there's no real value in signing the zone and that there is a
non-zero cost to doing so.

I agree with both of those arguments, but I wonder whether it might
not be a better sales job if we just accepted it maybe ought to be
signed anyway.  I'm aware that it runs against the grain to do
something purely for theatrical reasons, but sometimes people like a
good show.  Every time this topic comes up (especially outside IETF
circles, where one can perhaps be expected to understand the detailed
arguments), a number of people argue that it's really necessary to
sign the zone, or that having an exception for this sets some kind of
precedent, or something.  I think these discussions waste a lot of
time, and so as a purely tactical measure it strikes me that we could
shut down that line of argument by just signing the data.

Thoughts?

A

-- 
Andrew Sullivan
[email-masked]
Shinkuro, Inc.

---

From: Frederico A C Neves <[email-masked]>
Date: Thu, 11 Nov 2010 08:26:24 -0200

> shut down that line of argument by just signing the data.

That is the most sensible way to go and finaly cease upper layers
comments.

So +1.

Fred

---

From: Joao Damas <[email-masked]>
Date: Thu, 11 Nov 2010 11:46:19 +0100

lowering the noise generated by this discussion by just doing it seems to shift the balance towards the benefit rather than the cost, so +1

On 11 Nov 2010, at 11:03, Andrew Sullivan wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: "Griffiths, Chris" <[email-masked]>
Date: Thu, 11 Nov 2010 10:50:16 +0000

>shut down that line of argument by just signing the data.

This seems like a completely sensible solution and makes sense.

+1
--
Chris Griffiths
Comcast Cable Communications, Inc.

---

From: Tony Finch <[email-masked]>
Date: Thu, 11 Nov 2010 11:27:40 +0000

On Thu, 11 Nov 2010, Andrew Sullivan wrote:
> signed anyway.

Yes.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.

---

From: Matt Larson <[email-masked]>
Date: Thu, 11 Nov 2010 13:49:14 -0500

On Thu, 11 Nov 2010, Andrew Sullivan wrote:
> I think these discussions waste a lot of time, and so as a purely
> tactical measure it strikes me that we could shut down that line of
> argument by just signing the data.

So we should alter critical infrastructure to stifle argument and, by
extension, for "optics"?  That's no way to run a railroad.

The effort of signing root-servers.net is non-trivial and will involve
layer nine.  (Change authorization for this zone rests with the
U.S. DoC NTIA, the same as the root zone.)  Further, we just got the
root signed not even six months ago and more big DNSSEC changes are
still to come: a signed .net is right around the corner and a signed
.com is coming early next year.

If there is desire to change critical infrastructure that's part of a
system that we're still getting operational experience with, the
justification needs to be better than "let's just do it".  Let's have
a discussion of the merits, but, speaking on behalf of one of the
organizations that operates the root zone infrastructure, I am opposed
to signing root-servers.net any time within at least the next year.
That's simply the conservative, operationally prudent course of
action.

Matt

---

From: [email-masked]
Date: Thu, 11 Nov 2010 19:39:38 +0000

> shut down that line of argument by just signing the data.

	Political coordination issues aside, there are some interesting
	technical issues here that have to do with the priming query
	and response.  In the absence of 100% EDNS0 penetration, making
	this change will result in priming failuers.  In the interests
	of security and stability, is this a reasonable tradeoff?

--bill

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 12 Nov 2010 08:32:48 +0800

>extension, for "optics"?  That's no way to run a railroad.

...says the man who participates in video-taped key signing ceremonies with people flying in from all over the world to stand near opaque boxes. :-)

>U.S. DoC NTIA, the same as the root zone.) 

The request for signing the zone is a one-time thing, even if the zone changes. You don't need new permission to sign each TLD when the information changes, do you?

>Further, we just got the

How long do you feel that each signing action needs to take to test in the wild? Measurements would help here.

>justification needs to be better than "let's just do it". 

Andrew gave that justification.

>Let's have

Conservative, yes; operationally prudent, no. This type of thing can be pre-tested fairly easily. For example, once .net starts signing, make a private signing of root-servers.net and hand it out to friends and family and watch for any anomalous results.

--Paul Hoffman, Director
--VPN Consortium

---

From: Mark Andrews <[email-masked]>
Date: Fri, 12 Nov 2010 20:45:54 +1100

> 	of security and stability, is this a reasonable tradeoff?

Non-EDNS recursive nameservers won't see anything different.

The only one that could fail are those that do EDNS + DO and block
large DNS responses and also block outgoing DNS/TCP queries.

Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: "W.C.A. Wijngaards" <[email-masked]>
Date: Fri, 12 Nov 2010 16:46:47 +0100

Hi,

> That's simply the conservative, operationally prudent course of

I suspect there is cause to be conservative.  Thus, I have performed a
test with BIND 9.7.1 and NSD 3.2.6, signing root-servers.net (test
RSASHA256 2048 ksk and 1024 zsk).  And checked the response sizes for
the prime query and a query to a.root-servers.net.  These results:

. NS (BIND): 4525
. NS (NSD): 829 (unchanged from today)

a.root-servers.net A (BIND): 4557
a.root-servers.net A (NSD): 4575

The difference for a.root-servers.net is because of compression
implementation, and on UDP most likely would be cut off at 40xx.  The
prime response from BIND includes the RRSIGs over the root server A and
AAAA records (at 164 bytes data each, 21 times).

This is of course a very quick test, and details would need a serious
investigation.

Best regards,
   Wouter

---

From: David Conrad <[email-masked]>
Date: Fri, 12 Nov 2010 12:34:06 -0800

> The request for signing the zone is a one-time thing, even if the zone changes. You don't need new permission to sign each TLD when the information changes, do you?

No, but you shouldn't underestimate the amount of layer-9 used food that must be processed to get even the one time thing done, particularly now with the current IANA functions contract approaching its sell-by date.

> Conservative, yes; operationally prudent, no. This type of thing can be pre-tested fairly easily. For example, once .net starts signing, make a private signing of root-servers.net and hand it out t…

I have a high level of confidence that folks at ICANN and VeriSign can and will come up with a quite effective testing regime for root-servers.net.  They've done so for other inconsequential zones like the root in the past...

To me, It doesn't make a whole lot of sense to sign root-servers.net before .net is signed.  As long as there is commitment from relevant parties that root-servers.net will be signed within some fixed timeframe after .net is signed, I'd be satisfied.  But that's just me...

Regards,
-drc

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 13 Nov 2010 07:17:21 +0800

>To me, It doesn't make a whole lot of sense to sign root-servers.net before .net is signed.  As long as there is commitment from relevant parties that root-servers.net will be signed within some fix…

I didn't hear anyone asking for root-servers.net to be signed before .net is signed; it's kind of hard to sign a zone before its parent is, unless you are going to sign with a super-parent. To me, it would make more sense to sign root-servers.net with the .net key, not the root key.

A different way to think of this problem is that the registrant of this zone, VeriSign, should simply sign the zone just like it does other zones it controls, such as verisign.net. It would be hard for VeriSign to claim that signing verisign.net is of more security value than signing root-servers.net.

--Paul Hoffman, Director
--VPN Consortium

---

From: Joao Damas <[email-masked]>
Date: Sat, 13 Nov 2010 18:02:47 +0100

> I didn't hear anyone asking for root-servers.net to be signed before .net is signed; it's kind of hard to sign a zone before its parent is, unless you are going to sign with a super-parent. To me,…

I would hope root-servers.net would have its own key and not simply use some other key that happens to be "lying around". Or did you mean signing of the DS record for root-servers.net?
In any case .net is going to be signed within 6 weeks. I would be surprise if root-servers.net can get all the rubber stamps in place by then, so not having .net signed right now is not an argument against starting the root-servers.net process now.

> A different way to think of this problem is that the registrant of this zone, VeriSign, should simply sign the zone just like it does other zones it controls, such as verisign.net. It would be hard…

the admin contact is the IANA, not Verisign.

Joao

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 14 Nov 2010 05:37:21 +0800

>I would hope root-servers.net would have its own key and not simply use some other key that happens to be "lying around". Or did you mean signing of the DS record for root-servers.net?

Yes, of course.

+1

>the admin contact is the IANA, not Verisign.

Indeed, but according to whois, VeriSign is both the registrant and the technical contact. Having said that, it is quite reasonable for the admin contact to decide to sign a zone and ask the parent to publish the keys.

--Paul Hoffman, Director
--VPN Consortium

---

From: Florian Weimer <[email-masked]>
Date: Tue, 16 Nov 2010 08:13:00 +0000

* Paul Hoffman:

> Conservative, yes; operationally prudent, no. This type of thing can
> be pre-tested fairly easily. For example, once .net starts signing,
> make a private signing of root-servers.net and hand it out to
> friends and family and watch for any anomalous results.

This is not sufficient because DNSSEC does not prescribe response
contents, so different (root) servers (instances) will generate
different responses from the same zone data, unless the specification
is tightened considerably.  In particular, such variation affects
response sizes, which used to be a primary concern during the DURZ
phase.

-- 
Florian Weimer                <[email-masked]>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99