Subject: RE: I-D ACTION:draft-ietf-dnsext-rollover-requirements-00.txt

From: Russ Mundy <[email-masked]>
Date: Fri, 24 Feb 2006 16:46:26 -0500

On 2/23/06 at 8:01 AM -0500, Scott Rose <[email-masked]> wrote: 

>> -----Original Message-----
>> From: [email-masked]
>> [mailto:[email-masked]]On Behalf Of Thierry Moreau
>> >
>> >    Title       : Requirements related to DNSSEC Trust
>> Anchor Rollover
>> >
>> >    Author(s)   : S. Crocker, et al.
>> >    Filename    : draft-ietf-dnsext-rollover-requirements-00.txt
>> >    Pages       :
>> >    Date        : 2006-2-21
>> >
>>
>> This document essentially says that manual methods of trust anchor key
>> management *are* adequate.
>>
>
>I believe that manual methods may be adequate for some zones - it is
>certainly not adequate for the majority, but depending on security goals, it
>may be an acceptable design choice.
>
>> In my opinion, the remaining contents can only trigger unproductive
>> discussions. I whish I'm wrong on this!
>
>I read both requirements drafts, and I think it may be a good idea to merge
>some of the ideas in both documents into a unified draft of technical
>requirements.

This I-D was finished except for final formatting when Thierry announced his
I-D.  I reviewed that I-D prior to submitting this one and do think that there
might be some things that the Working Group might want to incorporate into
this one but (as the final 'clean-up' editor) I did not incorporate any items
into this draft for several reasons - it would have further delayed getting
this draft out, items from that draft can be incorporated into subsequent
versions of this draft, the requirements in Thierry's draft seemed to be
addressing what would be needed for a full-blown pki which I think is more
than the WG wants for rollover, and there seemed to be some different usage of
terms from what is defined in rfc-4033.

At the risk of repeating, I think that it's certainly possible that there are
some things from Thierry's draft that should be incorporated into this one -
Working Group participants really need to speak up (or would that be 'mail up'
:*) their views to namedroppers.

Russ

>
>Scott
>
>>
>> Regards,
>>
>> --
>>
>> - Thierry Moreau
>>
>> CONNOTECH Experts-conseils inc.
>> 9130 Place de Montgolfier
>> Montreal, Qc
>> Canada   H2M 2A1
>>
>> Tel.: (514)385-5691
>> Fax:  (514)385-5900
>>
>> web site: http://www.connotech.com
>> e-mail: [email-masked]
>>
>>
>> --
>> to unsubscribe send a message to [email-masked] with
>> the word 'unsubscribe' in a single line as the message text body.
>> archive: <http://ops.ietf.org/lists/namedroppers/>
>>
>
>
>
>--
>to unsubscribe send a message to [email-masked] with
>the word 'unsubscribe' in a single line as the message text body.
>archive: <http://ops.ietf.org/lists/namedroppers/>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Thierry Moreau <[email-masked]>
Date: Sat, 25 Feb 2006 12:02:22 -0500

Russ Mundy wrote:

"[...] the requirements in Thierry's draft seemed to be addressing what
would be needed for a full-blown pki which I think is more than the WG
wants for rollover [...]"

This assessment of draft-moreau-dnsext-tak-req-00.txt is unsupported,
expeditious, imprecise, and misleading. You may infer that I disagree.

The document draft-moreau-dnsext-tak-req-00.txt is an independent I-D
submission addressing the automated trust anchor key rollover
requirements for DNSSEC. The dnsext wg is chartered to work on this
automated rollover.

Regards,

-- 

- Thierry Moreau

Tel.: (514)385-5691
Fax:  (514)385-5900

---

From: Mike StJohns <[email-masked]>
Date: Sat, 25 Feb 2006 15:33:26 -0500

Hi Russ -

I'm going to have to object to the 12 month period in 5.5 as a 
requirement.  It's a nice to have, but we should consider any box 
that's been sitting on the shelf for 12 months as the equivalent of a 
freshly manufactured box for purposes of ANY configuration.

If this requirement stands, it eliminates any possibility of doing 
this in-band with the DNS protocol and will require an external 
key-management system that can handle being disconnected for 12 
months.  (And I'm not sure I know of any one).    [OK - I know I have 
to explain this.  Basically, DNS is two different protocols - a 
two-way transport protocol and a one-way data protocol.  It's 
possible to query a server if you get problematic - protocol-wise - 
answers during a query, but it's currently not possible to do 
something like ask an authoritative server for all the changes that 
were made over the last twelve months - e.g. what the database folks 
call "journaling".  To accomplish a recovery from 12 month down time 
you're going to need to be able to chain all the changes at the 
appropriate times and even, if your original trust anchor is 
compromised, I'm not sure you can trust your answer.  This would 
suggest using a set of signatures completely outside of DNSSEC - 
maybe even something based on 509 certs and messages]

Mike

---

From: Paul Vixie <[email-masked]>
Date: Sat, 25 Feb 2006 21:38:07 +0000

# "[...] the requirements in Thierry's draft seemed to be addressing what
# would be needed for a full-blown pki which I think is more than the WG
# wants for rollover [...]"
# 
# This assessment of draft-moreau-dnsext-tak-req-00.txt is unsupported,
# expeditious, imprecise, and misleading. You may infer that I disagree.

since your work on this is patented, most of us have not reviewed it.

# The document draft-moreau-dnsext-tak-req-00.txt is an independent I-D
# submission addressing the automated trust anchor key rollover
# requirements for DNSSEC. The dnsext wg is chartered to work on this
# automated rollover.

and what is the IPR status of your requirements document?

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Mon, 27 Feb 2006 11:40:03 +0100

> requirements for DNSSEC. The dnsext wg is chartered to work on this

And we do so by keeping focus on the working group requirements  
document.

If anybody would like to see requirements changed or added then, as  
always, the suggestion is to write a "patch" to the WG requirements  
document (wording as it should appear in the document) and argue why  
you would like to have it there.

Some participants are already following that strategy.

If there is consensus for your position the modification goes in.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/