Subject: Re: opt-in and wild card discussion

From: Alex Bligh <[email-masked]>
Date: Mon, 29 Aug 2005 08:54:55 +0100

--On 25 August 2005 22:29 -0400 Edward Lewis <[email-masked]> wrote:

> I recall a conversation amongst those of us working in close quarters in
> the early days (close quarters meaning, in office, hence nothing in
> email) on the purpose of DNSSEC.  One opinion was that DNSSEC was meant
> solely to say that what goes into the master server comes out of the
> resolver - no changes, no deviations.  The contrasting opinion of the day
> was that the resolver would return the data it received along with some
> measure of surety of the data so that the application could act
> accordingly.

I think I'm even less ambitious than that. I thought the idea was that IF a
resolver made a query AND received a reply, it could determine whether (i)
the resolver ought to have expected a signed reply, and (ii) whether that
if the reply WAS signed, it was signed a key possessed by an authoritative
server. No more, no less.

That's a bit different from the first opinion, as it worked on the
presumption that DNSSEC would not prevent denial of service attacks (either
packet loss, or through injection of SERVFAIL etc.) and (less
significantly) presumption of continuing legacy support. It also means
DNSSEC is not in itself responsible for ensuring security of private keys
etc. Perhaps that's why I'm less worried about opt-in than some.

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Mon, 29 Aug 2005 08:59:25 -0400

>etc. Perhaps that's why I'm less worried about opt-in than some.

I don't think there is a semantic difference between the first 
opinion and what you describe, but there is a syntactic difference. 
I failed to comprehensively capture the old conversation - things 
like denial of service attacks weren't part of the thought then.

What was meant by "what goes in" and "what goes out" referred to the 
extent of the protection, i.e., DNSSEC would not go up into 
application space.  (This is describing the first opinion, not a 
consensus.)  Perhaps what I should have said was "what goes out" is 
"what went in" and not the other way around.

The syntactic difference is steps i and ii are one way to carry out 
the mission, and although that is how we have approached it, that was 
more detail than the conversation had at that time.  (I mean, we were 
already writing code, the conversation was just "higher level.")

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

If you knew what I was thinking, you'd understand what I was saying.