Subject: Re: [Ianaplan] what *is* a succession plan?

From: John Curran <[email-masked]>
Date: Sun, 14 Sep 2014 10:33:55 -0400

From Eliot at  Sun, 14 Sep 2014 14:39:41 +0200
> All of this having been written, on this one point:
>          No single entity, not ICANN, not NTIA, not the IAB, _NO_ one, has the ability to define the “authority to continue performing that function”.
> ...

Eliot - 
 
   For protocol parameters which are not assigned to "real world" entities (i.e. the vast
   majority of the thousand or so IANA registries) it is fairly clear that the IETF/IAB does 
   indeed have the sole authority to define these registries, establish the technical registry
   policy for their administration, and ability to arrange/contract for an IANA operator for
   their administration... (if this is not the case, the RFCs 5226 and 6220 should be 
   updated asap to reflect what other entities are claimed to be involved.)

   There are a few registries which are instead "general-purpose" in nature (in which the 
   identifiers are assigned to real-world entities for purposes of unique labeling, rather 
   than representing technical features/codepoints), and these general-purpose registries 
   pose what has been called "policy issues" in past documents.  I would assert that the 
   IETF/IAB, as the entity that defines these registries via the protocol specification, does 
   indeed have the authority to set the registry policy and the registry administrator, but
   instead has shown great wisdom in recognizing that the establishment any registry is 
   meaningless unless the affected user community supports its use.  To this end, the 
   IETF has not directly administered these general-purpose registries (DNS root zone,
   IP address spaces), but has instead opted to work with organizations that are 
   recognized as representing the affected communities.

   It is the combination of the IETF (which brings the registry definition and technical IANA
   considerations) and the affected user community's support of general-purpose registry 
   policy (developed via an open, transparent, and inclusive organization) that results a 
   useful and "authoritative" registry; i.e. this is effectively a restatement of the "No single 
   entity" point above, but _only_ with respect to these general-purpose registries...

   On a related point, it would probably be a good idea if the IETF had clear criteria for 
   the recognition of delegated registries (general purpose or otherwise); I do think that 
   <https://tools.ietf.org/html/draft-iab-iana-framework-02> is a good start to this end.

FYI,
/John

Disclaimer: my views alone.

---

From: "Richard Hill" <[email-masked]>
Date: Sun, 14 Sep 2014 16:43:55 +0200

Dear John,

Thank you for pointing us to the draft IAB document "A Framework for
Describing the Internet Assigned Numbers Authority(IANA)".  I found this
paper to be very clear and very helpful.

But, in section 5.4 "Oversight Examples", I think that it should mention the
NTIA IANA functions contract which, at present is, in my view, very
signficant.

Indeed, as stated before, it seems to me (and others) that the present
discussion is about what, if anything, has to be done to replace the IANA
functions contract.

Best,
Richard

> -----Original Message-----
> From: Ianaplan [mailto:[email-masked]]On Behalf Of John
> Curran
> Sent: dimanche, 14. septembre 2014 16:34
> To: Eliot Lear
> Cc: [email-masked]
> Subject: Re: [Ianaplan] what *is* a succession plan?
>
>
> >          No single entity, not ICANN, not NTIA, not the IAB,
> _NO_ one, has the ability to define the “authority to continue
> performing that function”.
> > ...
>
> Eliot -
>
>    policy for their administration, and ability to
> arrange/contract for an IANA operator for
> _______________________________________________
> Ianaplan mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ianaplan
>
>

---

From: Eliot Lear <[email-masked]>
Date: Sun, 14 Sep 2014 17:19:11 +0200

>    updated asap to reflect what other entities are claimed to be involved.)

The ultimate authority rest with implementers and operators.  THAT was
my point.

Eliot

---

From: David Conrad <[email-masked]>
Date: Sun, 14 Sep 2014 09:19:49 -0700

John,

On Sep 14, 2014, at 7:33 AM, John Curran <[email-masked]> wrote:
>   majority of the thousand or so IANA registries)

I’m not sure this is a good characterization of the distinction. I believe a better distinction is operational impact.  The vast majority of protocol parameter registries have no direct operational impact — the existence of those registries is primarily a convenience publication mechanism, saving (primarily) software and protocol developers from having to scrounge through RFCs and mailing lists to figure out what bit pattern goes where. For example, ports are frequently assigned to “real world entities” yet the registry that records those assignments (http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) has no direct operational impact — if that file were removed, I suspect the only folks who would notice are operating system maintainers who have automated scripts that infrequently mirror (and munge) that registry into /etc/services and perhaps packet decoding software maintainers who do similar mirroring/mangling for new versions of their software.

> it is fairly clear that the IETF/IAB does 

I would agree that the IETF _community_ has the sole authority to define the protocol parameter registries and the IAB (or some other body), _acting on the behalf of that community_, can make the assignment of entities performing the registry maintenance function.  However, I would argue the IAB, on its own and without the consensus of the IETF community, does NOT have that ability — if anyone disagrees, I’d just point to the outcome of the decision by the IAB in the 1991-1992 timeframe regarding the use of the OSI protocol suite.

For registries that have direct operational impact, the most notable of which is the DNS root “registry” (the root zone file), I would agree things are far more complicated, however my impression is that discussions related to the transition of the stewardship of those registries are occurring elsewhere. 

Regards,
-drc

---

From: S Moonesamy <[email-masked]>
Date: Sun, 14 Sep 2014 11:10:46 -0700

Hi John,
>    recognized as representing the affected communities.

In case it has been missed I disclosed my interests at 
http://www.ietf.org/mail-archive/web/ianaplan/current/msg00309.html

I am mentioning this as jurisdiction has been raised as a concern by 
some persons.  Wouldn't giving the IETF/IAB the authority to set 
general-purpose registry policy cause IP addresses to fall within the 
jurisdiction of the United States?

Regards,
S. Moonesamy

---

From: Miles Fidelman <[email-masked]>
Date: Sun, 14 Sep 2014 14:27:35 -0400

> The ultimate authority rest with implementers and operators.  THAT was
And that is a bit of a problem, is it not, if it's even true.

It's always struck me as a gap that IETF protocols do not have test 
suites and some kind of certification of proper operation - as is common 
with other standards bodies.

And for some things - like, say, ethernet mac addresses (yes, IEEE, not 
IETF, but a good example), or TCP port numbers -- the ultimate authority 
does NOT lie with implementors -- yes, nothing forces them to follow the 
standards or the registries, but that's different from "authority."

Miles Fidelman

-- 
In theory, there is no difference between theory and practice.
In practice, there is.   .... Yogi Berra

---

From: John Curran <[email-masked]>
Date: Sun, 14 Sep 2014 16:03:35 -0400

On Sep 14, 2014, at 12:19 PM, David Conrad <[email-masked]> wrote:

> I’m not sure this is a good characterization of the distinction. I believe a better distinction is operational impact.

There are definitely registries which have more operational impact than
others, but that is because of the publication protocol and real-time 
(or near real-time) usage that occurs.  While I believe that is is also
an important distinction, it is independent of the "policy authority"
question that was raised.

>  The vast majority of protocol parameter registries have no direct operational impact — the existence of those registries is primarily a convenience publication mechanism, saving (primarily) software and protocol developers from having to scrounge through RFCs and mailing lists to figure out what bit pattern goes where. For example, ports are frequently assigned to “real world entities” yet the registry that records those assignments (http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) has no direct operational impact — if that file were removed, I suspect the only folks who would notice are operating system maintainers who have automated scripts that infrequently mirror (and munge) that registry into /etc/services and perhaps packet decoding software maintainers who do similar mirroring/mangling for new versions of their software.

Agreed.

> I would agree that the IETF _community_ has the sole authority to define the protocol parameter registries and the IAB (or some other body), _acting on the behalf of that community_, can make the assignment of entities performing the registry maintenance function.  

Also agreed... the community seems content to vest such authority with IETF
(as exercised by the IAB) for most protocol parameters.  I probably should
have been more explicit, given the nature of the discussion.

However, the community would probably not be content with "policy authority"
(beyond purely technical parameters) for the DNS root zone or IP address spaces
being vested with the IETF/IAB; historically, these registries have been 
recognized as somewhat different (even absent any direct operational impact)
and have instead been administered accordingly to registry policy developed
by the community via other organizations (ICANN, RIRs); while all of these 
bodies are open to participation to anyone, the delegation of policy authority
for general-purpose portion of the DNS and IP addresses spaces allows policy 
to be developed "closer" to those affected by these policies. Hence, there is
something fairly important going on when the IETF/IAB wisely recognizes that 
the affected community is making use of other bodies for policy development, 
and allows the IANA to follow the resulting policy.

If IP version 42 or DNS version 12 were to be standardized tomorrow by the
IETF, would the IETF then develop the applicable (non-technical) registry
policy entirely on its own, or would it recognize other bodies for this 
purpose?  If it did recognize circumstances where the community desired use
of another body for this purpose  what criteria would be used by the IETF/IAB
in making the decision to delegate the general-purpose portions of these 
new parameter spaces?

> For registries that have direct operational impact, the most notable of which is the DNS root “registry” (the root zone file), I would agree things are far more complicated, however my impression i…

I believe that as well, but it is fairly important to understand how policy 
authorities for general-purpose (non-specialized/reserved) portions of the
various IANA registries have or will be delegated, as the resulting list of 
parties are the ones likely to also be contracting with an IANA operator, 
and thus interacting with the IETF's own contracting since some of these 
IANA parameter spaces have entries coming from both from the IETF (e.g.
specialized/reserved entries) and these delegated policy authorities.

/John