Subject: RE: zone naming terms (*and* Opt-in wg last call)

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 11 Apr 2002 16:48:52 -0400

I guess I just never liked the usage of the term "secure"
to describe things in RFC XXXX (and subsequent), and now
that we're changing the model significantly I'd love to
clean up the terminology.  (Up 'til now, I've used the
non-standard terminology "DNSSEC signed zones" instead.)

Security is *always* a continuum, but labeling a zone as
"secure" during the time between a key compromise and the
key supersession seems a little...odd.

> What is needed is a term that captures:
> 
>   "...means that the resolver should expect to get a 
>    signature with this data set.  Failing to do so means
>    that the data set in hand is to be disposed of and
>    every effort made to retrieve a new one."

I'm not sure why--can you give a specific example of
why we need such a term (and to whom might it be useful?)
In the opt-in New World Order, it seems that every data set
has to be handled on a case-by-case basis in most situations.

The best phrases I could use to describe the above
situation are "possibly signed" or "signature expected"
and I'm not sure either has enough semantic content to
be useful.

  <TOPIC CHANGE>
As an off-topic tangent, or possibly on-topic for the
original topic above:  For the record, I still disagree
with opt-in since I don't agree that objections previously
stated were "moral" in nature.  IMHO, adding granularity of
security within a zone makes it more difficult to describe
and understand security, and therefore makes it more
difficult to maintain--and that's a technical problem not
a moral one.

Have any of the people advocating Opt-In ever tried to
explain *basic* DNSSEC to a *basic* DNS administrator?
I have, and it's not pretty.  Opt-in adds another layer
of complexity.  I fear complexity.

More importantly:  We're changing the goal of
DNSSEC from what was clearly stated in the past--providing
a method so that *all* DNS data could be clearly verified.
I can believe that for large zones that primarily consist
of delegations, Opt-in is useful and perhaps financially
necessary.  I *don't* like the "full opt-in" that seems to
now be the sense of the WG, because it makes it *less* likely
that every node in DNS will ever be signed.

I'm normally a libertarian, but as a security weenie I want
to force DNSSEC to be available.  I don't want security to
only be applied to a small subset of DNS data but I think
that's where we're heading.  I think that ship has already
sailed though, along with AAAA -vs- A6.

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Secure Business Solutions Group         www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>