Subject: repeating my mic comment on auth denial

From: Edward Lewis <[email-masked]>
Date: Mon, 14 Mar 2005 14:12:30 -0500

Since the minutes of the meeting won't be out for a while, I thought 
I would repeat my comments at the mic regarding the authenticated 
denial issue.  (Fresh from a reading of the nsec3 draft, with the 
prospect of reading the bert proposal ahead of me.)

My comment is:

Before the WG commits serious resources to choosing one "new" 
approach to authenticated denial there is a need to hold a number of 
operations oriented workshops.  "Serious resources" means WG last 
calls, anything put before the IESG, etc.  Operations-oriented means 
software tools in our hands, and some semblance of reality in the 
test environment and scenario.

Why:

The NSEC3 document reminds me greatly of RFC 2065, a 
security-oriented document (salts, hashes, iterations, oh my) with 
unclear impacts on operations.  The first workshops based on RFC 2065 
- starting in Knivsta, SE, May, 1999 - represented about 5 years of 
protocol development.   It was still a few more years until the 
operator "friendly" DS RR was defined.

Even with 5 years of security expertise as input RFC 2065 was so 
operations unfriendly that it took years to fix the problem and years 
more to generate a new definition.  I don't want to repeat that 
experience.

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Achieving total enlightenment has taught me that ignorance is bliss.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Ben Laurie <[email-masked]>
Date: Thu, 17 Mar 2005 11:41:30 +0000

Edward Lewis wrote:
> Since the minutes of the meeting won't be out for a while, I thought I 
> would repeat my comments at the mic regarding the authenticated denial 
> issue.  (Fresh from a reading of the nsec3 draft, with the prospect of 
> reading the bert proposal ahead of me.)
> 
> My comment is:
> 
> Before the WG commits serious resources to choosing one "new" approach 
> to authenticated denial there is a need to hold a number of operations 
> oriented workshops.  "Serious resources" means WG last calls, anything 
> put before the IESG, etc.  Operations-oriented means software tools in 
> our hands, and some semblance of reality in the test environment and 
> scenario.
> 
> Why:
> 
> The NSEC3 document reminds me greatly of RFC 2065, a security-oriented 
> document (salts, hashes, iterations, oh my) with unclear impacts on 
> operations.  The first workshops based on RFC 2065 - starting in 
> Knivsta, SE, May, 1999 - represented about 5 years of protocol 
> development.   It was still a few more years until the operator 
> "friendly" DS RR was defined.
> 
> more to generate a new definition.  I don't want to repeat that experience.

Don't worry, we are committed to producing the tools required to test NSEC3.

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html       http://www.thebunker.net/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff