Subject: Re: Trust anchor key IPR issues within existing DNS operations business model

From: Mike StJohns <[email-masked]>
Date: Tue, 22 Nov 2005 17:39:21 -0500

I would normally just leave this one alone, but ....

At 05:00 PM 11/22/2005, Thierry Moreau wrote:
>The current business model for DNS is registration fees paid by
>registrants to registrars covering retail value of name
>registration.

Yes.  And from registrars to registries for the wholesale value.

>  DNSSEC is a value-added service for DNSSEC-aware
>registrants who will pay some extra money for the registrar
>(and/or registry) to maintain a secure delegation to the
>registrant's zone.

No. This is an assumption and a bad one at that.   There is no 
evidence either way on whether or not a registry will charge 
additional fees to sign a delegation.   It's possible that there may 
be some "high-assurance" domains that charge additional monies for a 
higher quality delegation (similar to the certificate model), but if 
.COM/.NET etc go secure I would anticipate no additional fee in the 
long run (with maybe some fees in the short run).

>  Part of the registration fees is passed at the
>wholesale level represented by the registries, and then some
>money goes to ICANN. As far as I can browse, the ICANN documents
>seem silent about the registry right to charge extra fees for
>secure delegations, but for IETF purposes, it is reasonable to
>use this assumption.

See above.

>For IETF purposes, it can be assumed that an IPR holder for a
>trust anchor key management scheme would behave rationally (in
>the economic sense) in shaping licensing arrangements along the
>current business model with the assumed secure delegation addenda
>explained in the above paragraph. Thus, the IPR licensing fees
>would be included in DNS registration fees, no explicitly visible
>impact for the masses of second level domain owners who are the
>target of secure delegation service offering.

This paragraph betrays a complete lack of understanding of the 
difference between DNS software which might incorporate the use of 
such technology (including specifically the clients and servers) and 
some registry which is signing delegations.  In the "ideal" DNSSEC 
model, there is only one trust point (with multiple trust anchors) 
(e.g. the root) and that trust point actually exists outside the 
current registry model as none of the registrations in the root done 
through a registrar, but through ICANN actions.   And the IPR for 
trust anchor has nothing at all to do with secure delegations so I'm 
not sure why it's even being brought up here.

>It can be argued that the DNS registration fees already include
>compensation for proprietary systems. This is hinted by the
>Verisign financial statements for proprietary protocols between
>registrars and registries (reference: search the Verisign
>financial statements for the word "proprietary"), and by some of
>the patent applications assigned to Verisign in the US patent
>office database.

No, actually it can't.  Verisign and other registries have 
implemented internal procedures.  On the balance sheet this comes 
under "overhead".  The registrant isn't paying verisign for the use 
of the proprietary system, but for the registration - how Verisign 
chooses to implement the registration is its own business.   DNS 
registration fees include compensation for all costs of doing 
business plus their profit (hopefully :-) ).

>Trust anchor key management has server-side procedures and
>resolver-side procedures. The other participants are thus DNS
>resolver software users, developers, and vendors. It would not be
>rational for an IPR holder to impose licensing requirements to
>users beyond embedded provisions in software licenses for
>proprietary DNS resolver software.

If what you're saying is that the only way to extract money out of 
the end-user (e.g. guy on a computer at home) is to impose a fee on 
the software he uses I believe that's the normal approach to 
technology IPR licensing.

>So, proprietary DNS resolver
>software vendors might be the target of IPR holder greediness.
>Again, this is without explicit visible impact to the masses,

Except for additional cost to them when the software vendor passes on 
the IPR cost.

>because proprietary software customers are already paying for
>software licenses. I.e. for software distributed without
>restriction on multiple copy usage, it would be unrealistic for
>an IPR holder to expect licensing revenues based end-user license
>count.

Naive assumption at best.  Self-serving mis-statement at 
worst.  Again, this is the normal IPR licensing model.  Go have a 
talk with a lawyer.

>So, a rational behavior from the part of IPR holder would hide
>the IPR licensing mechanisms from the mass market participant
>categories that are the second level domain owners and DNS
>resolver software users. This is simply so because the existing
>business models (and institutional framework) for Internet DNS
>operations has been worked out quite well, in economic terms.

At this point - I'm going back into ignore mode.  My opinion is that 
this document is pretty much a commercial for the individual's IPR 
masquerading as a semi-engineering analysis.  As such, it's 
inappropriate for this mailing list.

>Furthermore, still for IETF purposes, it can be argued that an
>IPR holder would behave rationally in negotiating licensing fees,
>simply because the Internet DNS is a de-facto monopoly (i.e.
>there is no more a global X.25, SNA, or IPX network where trust
>anchor key IPR would allow a competitive advantage over
>Internet).
>
>I believe the above observations could have been made by some
>other (moderately educated and knowledgeable) participants. I.e.
>someone who can take a broader view on protocol engineering that
>encompasses Internet governance, business strategy, economics,
>and IPR management. I was assisted in these aspect by many
>fascinating documents which I omit to refer for sake of brevity.
>
>If the above observations facilitates the DNSEXT wg study of
>competing proposals for DNS trust anchor key management, so much
>the better.
>
>Finally, the current IPR holder of the TAKREM for DNSSEC proposal
>is my privately owned company. This may not be the case in the
>future, so the above description of a rational economic behavior
>is not a commitment from my part.
>
>Regards,
>
>--
>
>- Thierry Moreau
>
>CONNOTECH Experts-conseils inc.
>9130 Place de Montgolfier
>Montreal, Qc
>Canada   H2M 2A1
>
>Tel.: (514)385-5691
>Fax:  (514)385-5900
>
>web site: http://www.connotech.com
>e-mail: [email-masked]
>
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Tue, 22 Nov 2005 23:48:34 +0000

--On 22 November 2005 17:00 -0500 Thierry Moreau 
<[email-masked]> wrote:

> trust anchor key management scheme would behave rationally

The IETF should assume no such thing, not least as rationality appears not
to be a particular objective concept when it comes to IPR; we should not be
attempting to reinvent IETF IPR policy in DNSEXT. At least one rational
behaviour for IPR holders (FOC licensing) remains open.

I don't think it's worth spending too many recycled electronics on this
issue here, but I'll point out you seem to assume the IPR user here is
an ICANN registrar. In fact, it's a software vendor, whose customer
may be an ICANN registrar, may be a ccTLD, or may be an end registrant.
Why it would be to these guys advantage to use an IPR-encumbered trust
anchor scheme is beyond me.

Alex

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 22 Nov 2005 22:35:30 -0800 (PST)

Could somebody please point me to the draft (or section of it or some 
other document or presentation) that explains trust anchor issues.
I would prefer to see some neutral document, i.e. not written by
proponent for particular solution.

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 23 Nov 2005 09:25:14 +0100

On Nov 23, 2005, at 07:35 , william(at)elan.net wrote:

>
> Could somebody please point me to the draft (or section of it or  
> some other document or presentation) that explains trust anchor  
> issues.

Would what we try to do with getting requirements (see:
http://ops.ietf.org/lists/namedroppers/namedroppers.2005/msg01564.html )
satisfy your needs.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Edward Lewis <[email-masked]>
Date: Wed, 23 Nov 2005 08:54:26 -0500

At 17:00 -0500 11/22/05, Thierry Moreau wrote:

>registration. DNSSEC is a value-added service for DNSSEC-aware
>registrant's zone. Part of the registration fees is passed at the

 From my perpective, the above isn't a good reflection of reality. 
ICANN does not have purview over many or most registries (I haven't 
counted, so I won't make a definitive statement).  I.e., looking at 
ICANN's environment isn't sufficient.

Also, from what I've learned, heard, discussed, I wouldn't count on 
there being any or many registrants willing to pay "some extra 
money...to maintain a secure delegation."

>target of secure delegation service offering.

This being an engineering forum, you would need to define what 
behaving rationally in an economic sense means in the above 
paragraph, or at least provide a reference to a document that does so.

However, by this time I can't justify volunteering any more review on 
this.  Even if I were to take the time to thoroughly understand the 
issue, it seems that the proposal is built upon a world view that I 
see as wrong.  Count me as someone that is not interested in pursuing 
this proposal.

...

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

3 months to the next trip.  I guess it's finally time to settle down and
find a grocery store.

---

From: Andrew Sullivan <[email-masked]>
Date: Wed, 23 Nov 2005 10:00:06 -0500

> money...to maintain a secure delegation."

In addition, I'll be completely astonished if most registrars in the
ICANN world are even slightly interested in DNSSEC if the registry
charges a service fee for it.  The ICANN registry market doesn't seem
to work that way.  (Other registries may be a different matter, of
course.)

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                        +1 416 646 3304 x4110