Subject: another's view on zone enum & on-line signing

From: Edward Lewis <[email-masked]>
Date: Wed, 22 Sep 2004 11:25:10 +0100

I spoke with a person who used to be a DNS administrator at a 
well-known content provider (non-ISP, non-registry, etc.).  He told 
be that when he was at that job, he would not have been able to 
justify the deployment of DNSSEC because of zone enumeration.  The 
rationale for this is "the usual" - nothing other than not wanting to 
put certain information "so easily" available on the Internet.

As far as on-line signing as an option, he replied that that was not 
a big deal for him.  "What's the difference between managing extra 
zone keys and managing TSIG keys for XFR's?"

(Just a data point...)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Wed, 22 Sep 2004 17:46:47 +0000

> Yes, this is exactly why a few of us were trying to hold up the
> online signing conversation before the bis drafts were finalized,
> because we realized you COULDN'T do online signing in bis.  :(
> 
> It sucks royally.

i think that sucking royally is the reason a number of people were trying
to hold up finalizing the -bis drafts until they had been relaxed in some
way that would permit online signing without the full transition cost.

"good? bad? i'm the one with the gun."

onward.

---

From: Mark Andrews <[email-masked]>
Date: Thu, 23 Sep 2004 11:38:26 +1000

> * Alex Bligh:
> 
> > --On 22 September 2004 11:25 +0100 Edward Lewis <[email-masked]> wrote:
> >
> >> (Just a data point...)
> >
> > another data point (and I only bring this up because it's something I
> > could say earlier):
> > http://tinyurl.com/6datz
> 
> > We've now had a first ruling in court showing registries do hold
> > copyright in their own zone files (at least in Australian law)
> 
> WHOIS data or zone file data?  The press release only mentions WHOIS
> data.

	http://www.austlii.edu.au/au/cases/cth/federal_ct/2004/1244.html
 
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: David Blacka <[email-masked]>
Date: Fri, 24 Sep 2004 11:26:55 +0100

On Sep 23, 2004, at 11:56 PM, Paul Vixie wrote:

>>> word on the street is, online signing isn't allowed in the 
>>> dnssec-bis spec.
>>
>> What about a signed zone that is dynamically updated - doesn't that
>> physically require on-line signing?
>
> i meant online signing of negative responses, without precomputed 
> NSECs.

So the problem you were referring to wasn't online signing, it was NSEC 
synthesis at (otherwise) non-existent names, right?

--
David Blacka    <[email-masked]>
Sr. Engineer    Verisign Applied Research

---

From: Paul Vixie <[email-masked]>
Date: Fri, 24 Sep 2004 18:08:00 +0000

> >>> word on the street is, online signing isn't allowed in the dnssec-bis
> >>> spec.
> >>
> > i meant online signing of negative responses, without precomputed NSECs.
> 

yes.