Subject: [DNSOP] Limiting duration for Negative Trust Anchors, was Re: New I-D on Negative Trust Anchors

From: Shane Kerr <[email-masked]>
Date: Tue, 10 Apr 2012 16:06:44 +0200

Jason,

On Tuesday, 2012-03-27 15:19:23 +0000,
"Livingood, Jason" <[email-masked]> wrote:
> I posted a –01 a short time ago
> (http://tools.ietf.org/html/draft-livingood-negative-trust-anchors-01)
> and listed this in open items for the next version. I may have some
> questions on the best way to include that.

I like this idea; it was something I planned on including in BIND 10
for a while, although we've got other higher-priority things to add
first (like DNSSEC validation). ;)

One tiny bit:

   Furthermore, a Negative Trust Anchor should be used only for a short
   duration, perhaps for a day or less.

While for larger ISPs a top-100 approach makes sense, and so a 1 day fix is reasonable to expect, other operators will have other concerns. For example, you may have a distributor for your business that has a crappy IT department and simply can't get their zones fixed in a reasonable time, or you may have a department at your university that is literally gone for the summer.

The approach I had planned on taking is simply to require that an
administrator specify the ending time of the Negative Trust Anchor. If
they want to, of course they can put 30 years (or perhaps however much
time is left until their retirement), but at least they would have had
to think about the issue!

--
Shane

---

From: Paul Wouters <[email-masked]>
Date: Tue, 10 Apr 2012 10:37:21 -0400 (EDT)

> to think about the issue!

What's wrong with the proven method of exponential back-off ?

Paul

---

From: Shane Kerr <[email-masked]>
Date: Wed, 11 Apr 2012 12:18:33 +0200

Paul,

On Tuesday, 2012-04-10 10:37:21 -0400,
Paul Wouters <[email-masked]> wrote:
> > administrator specify the ending time of the Negative Trust Anchor.
> > If they want to, of course they can put 30 years (or perhaps
> > however much time is left until their retirement), but at least
> > they would have had to think about the issue!
> 

I'm not sure what you mean. This is a manual process.

Software could suggest an ending time to an administrator, and even use
exponential back-off, but I don't think such an algorithm would be
especially helpful. Probably we want more human-oriented suggestions
like "3 days" or "2 weeks" rather than "1d 12:24:32.0".

--
Shane

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 16 Apr 2012 17:28:33 +0000

Inline below.

- JL

On 4/10/12 10:06 AM, "Shane Kerr" <[email-masked]> wrote:

>> I posted a 01 a short time ago
>While for larger ISPs a top-100 approach makes sense, and so a 1 day fix
>is reasonable to expect, other operators will have other concerns. For
>example, you may have a distributor for your business that has a crappy
>IT department and simply can't get their zones fixed in a reasonable
>time, or you may have a department at your university that is literally
>gone for the summer.

This is indeed an issue we have observed. Here are some recent examples
where we've not seen a 1 or 2 day resolution:

http://dnsviz.net/d/www.bayfieldelectric.com/T4wofg/dnssec/

http://dnsviz.net/d/www.bayfieldelectric.com/T4wofg/dnssec/

>to think about the issue!

I think that is a great approach! And perhaps have a default TTL in there
for the NTA of X hours.

- Jason

---

From: "Livingood, Jason" <[email-masked]>
Date: Mon, 16 Apr 2012 17:31:04 +0000

Had a double copy & paste error! Here is the 2nd domain:

http://dnsviz.net/d/www.bitcoinica.com/T4pqsA/dnssec/