Subject: Re: Last Call: 'Minimally Covering NSEC Records and DNSSEC On-line Signing' to Proposed Standard

From: Edward Lewis <[email-masked]>
Date: Mon, 28 Nov 2005 09:15:37 -0500

At 8:50 +0000 11/28/05, Geoffrey Sisson wrote:

>While online signing may or may not suitable for deployment by large
>TLDs, I suspect there will be interest in using this technique for
>zones further down in the DNS tree -- e.g. organisations with a greater
>need for privacy or secrecy of zone data -- particularly if good
>implementations (say, ASICS-based, HSM-based online signing DNSSEC
>name server appliances) become available.

Well said.  Participants need to balance their views of the problem 
space with other views of the problem space.

>So in this case I would caution against gauging "community interest" by
>the interest of dnsext WG participants to use this technique
>themselves.  While root server operators, TLDs and RIRs are well
>represented in the WG, the potential users of online signing probably
>are not.

This is what bothers me about the process we follow and the 
importance we put on it.  Until the IETF can guarantee that all 
involved parties make comments, the IETF has to treat all of it's 
"decisions" as partial results.  I.e., although consensus is 
"achieved", it is never carved in stone.  All hope is not lost, 
partial results are better than none, but remember to put them in 
their place.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

3 months to the next trip.  I guess it's finally time to settle down and
find a grocery store.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 28 Nov 2005 15:30:30 +0000

# >..., I suspect there will be interest in using this technique for
# >zones further down in the DNS tree -- ...

i'm worried that my most important comment on this thread was buried too
deep in the message where i said it, so let me try again.

in order to preserve or provide the white-lies capability to zone owners
who find it desireable and sufficient, we MUST put the technology on the
standards track.  it has to be mandatory-to-implement for any requestor
who wants to be "DNSSEC compliant".  responders don't have to use it, but
if a responder wants to use it, then all or virtually all requestors must
grok it.  there's no way to do that if 4034/4035 is a proposed standard
and white lies is informational or experimental or a best current practice.