Subject: nsec3 and opt-in

From: Roy Arends <[email-masked]>
Date: Mon, 8 Aug 2005 08:14:14 +0200 (CEST)

At the Paris ietf dnsext wg meeting I was allowed to steal a few minutes
presenting the differences between versions 01 and 02 of
draft-ietf-dnsext-nsec3. One question that came up was why the
specification for NSEC3 was bundled with opt-in.

Without iterating the discussions we had years ago about the applicability
of optin and without giving a value judgement on the usefulness or
quality of either nsec3 and opt-in I'd like to shed light on my motivation
for bundling nsec3 with opt-in.

Not so long ago, the opt-in draft was baptized experimental, since at the
time, we (the wg) came to the conclusion that publishing the dnssec-bis
drafts had higher priority than breaking up the specification at the
eleventh hour, effectively delaying progress.

Since then, the dnssec-bis drafts have been published and we've moved on
to other fronts. Addressing the last mile, trust achor management and
measures against enumeration (not an exhaustive list).

It is the authenticated denial of existence that allows for enumeration of
a zone, regardless of policy decisions of the zone owner. It is this same
record that was used in the past to signal authenticated denial of
existence of signatures for unsigned delegations (opt-in).

Even though anti-enumeration and opt-in techniques offer solutions for
different problems (in fact, I see them as orthogonal) they have
authenticated denial in common, and authenticated denial is based on a
single resource record type.

I argue that it is far more complex to separate these solutions into
different signaling schemes using different resource records or
meta-types. I view it as logical to signal opt-in using NSEC3 instead of
signaling opt-in by some other means.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Mon, 08 Aug 2005 10:29:42 +0100

Roy,

> signaling opt-in by some other means.

All of the above I agree with.

The "do we do these at the same time" question should thus depend
on the following two thing:
1. Does incorporation of opt-in make the standards process and deployment
   of NSEC3 significantly harder? (for instance, because it at least
   arguably introduces a new state - non-authenticated denial within
   a signed zone - for the next layer up)
2. If the answer to Q1 is yes, does this matter (for instance, taking
   an extreme example, if there were 100 other showstopper issues with
   DNSSEC-bis that suddenly arose and required a lot of protocol
   reengineering to fix, (1) becomes irrelevant).

Those arguing against opt-in were arguing the answer to (1) was either
"yes" or at best "it will taking some serious thinking an argument to
come to an answer".

Alex