Subject: [DNSOP] CDS and the RRR model

From: Johan Ihrén <[email-masked]>
Date: Thu, 14 Mar 2013 14:50:15 -0400

I see a lot of talk about need to engage with the TLD community and the registries. 

For the record, I'm completely in agreement with Paul Wouters and Joe Abley that this is not really needed. This is why:

1. CDS will be an option for automation. There is nothing suggested saying that what we use today (i.e. out-of-band communication) should go away. On the contrary, will remain, and has to remain, because CDS cannot solve all problems (f.i. bootstrapping a secure delegation, algorithm rollover, etc). Hence, if a particular TLD doesn't like CDS, that's basically irrelevant.

2. As CDS will be an option I expect some registrants will want to use this (that's the whole point after all, that there is a need). But I also expect some registrants NOT to want to use this. Hence use-of-CDS will basically be on a registrant by registrant basis. Who has the registrant connection? The registrar, not the registry.

I.e. the REGISTRAR may provide the added value service of looking for CDS and automatically convert that into an EPP transaction that goes into the already existing and fully functioning communication channel that the registrar has with the registry. The registry doesn't even have to know that CDS is in use. Hence it is irrelevant whether there's a policy that requires the registry "not to talk directly to registrants" or not.

3. CDS is a protocol feature. It is not a policy issue. There's no need for policy development. Should registries "not like CDS", that's ok (they will not know that a particular EPP update regarding a DS was triggered by a CDS). It does matter that a registrar or two is interested in this. And several registrars do appear interested, so we're fine.

4. There is a rather substantial world out there which is not part of the RRR model. Most of academia and research. Lots and lots of topology in corporate networks. All sorts of hobbyists, etc, etc. There are entire countries that don't use the RRR model. Whenever one gets to close to ICANN it seems like the entire world is shaped into a registry / registrar / registrant model. That is not true. There are other parts. 

Jeopardizing the possibility of automation of DS changes by going too near the registries is likely to be a big mistake. So let's try to not do that for a change.

That said, there are of course lots of clever people working for registries that will provide valuable input. I'm just arguing against allowing "registry buy-in" to be allowed to become a gating factor for determining CDS usefulness.

Regards,

Johan

---

From: Edward Lewis <[email-masked]>
Date: Thu, 14 Mar 2013 15:44:53 -0400

On Mar 14, 2013, at 14:50, Johan Ihrén wrote:
> 
> I'm just arguing against allowing "registry buy-in" to be allowed to become a gating factor for determining CDS usefulness.

Because I'm known as someone working for a TLD operator I will point out that my motivation in this space is primarily as a DNS "hoster".  Imagine, if you will, that I operate DNS zones in every TLD and many zones that are not "children" in the DNS sense of any TLD.  I stress "imagine" because I probably don't have a child zone in each and every TLD.  Maybe "a lot" or "quite a few", I don't know, and for the detail here, it doesn't matter.

I believe there is a gating factor here involving TLDs.  But not that this is acceptable to TLDs, rather that whatever is derived is compatible with all (and I mean *all*) TLDs environments.  TLDs might differ in their policies and that is their prerogative, their right, their duty.  I want to see something defined that is universal and can be used under any environment.  I don't want to build one-offs for TLDs.

Or one-offs for cases where there is no TLD involved.

What I want, as a DNS operator and producer of DS record data, is a standard way to marshall the DS "guts" from the child to the parent.  What I don't care so much about is how the parent comes around to get the guts of the DS from me.  I say "guts" to mean either the hashes or just the identifiers to what is in the DNSKEY set.  Note here that parent refers to a DNS zone that may or may not have any legal/business relationship with me (child zone operator) or my customer.

In napkin scribblings, I envision that a record - possibly CDS - is at the apex of the zone I operate.  In an ICANN-style shared registry model (which is often called RRR) I can see a registrar - for whatever reason - dig from my zone the "CDS" and then stuff the guts into an EPP message and send it off to the registry just as the registrar would today when a DS is pasted into a web form.  This is just a quick, one use-case illustration, given just to separate what I care about (the CDS-maybe record) and what I don't care about (why the registrar digs and how they stuff the EPP).  "Care" in the context of this specific proposal.  Of course I care about the end-to-end....;)....I'm just focusing here.

It's not registry buy-in, it's just that the proposed solution has gotta work with (all) registry arrangements.  Otherwise, the utility is greatly limited and we will still be talking about this in the future.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis             
NeuStar                    You can leave a voice message at +1-571-434-5468

There are no answers - just tradeoffs, decisions, and responses.