Subject: Section 5.2 (IPR encumberance) in TAK rollover requirement draft

From: Thierry Moreau <[email-masked]>
Date: Sun, 05 Mar 2006 11:58:26 -0500

Dear all:

This message discusses the implications of a no-IPR  encumberment
requirement for trust anchor key rollover in DNSSEC, being
considered by ietf dnsext wg in section 5.2 in
draft-ietf-dnsext-rollover-requirements-00.txt.

First of all, here is a relevant citation from an ietf wg process
perspective, from RFC 3668 section 8:
      "But IETF working groups have the discretion to adopt
      technology with a commitment of fair and non-discriminatory
      terms, or even with no licensing commitment, if they feel
      that this technology is superior enough to alternatives with
      fewer IPR claims or free licensing to outweigh the potential
      cost of the licenses."

In other words, there exists an *opportunity* for an IETF wg to
evaluate alternate technologies in the presence of IPR claims.
The current wording of section 5.2 in
draft-ietf-dnsext-rollover-requirements-00.txt is an a-priori
option abandonment formulation.

In rational terms, a person or organization having an option
would not renounce of it or abandon it earlier than the option
exercise time. In saying e.g. "... in applying the discretion
granted by RFC3668 section 8, as the case may be, the evaluation
process should assign heavy ponderation to IPR hindrance ..." the
wg governance would have kept its options open and, at the same
time, give a clear indication for its future solution assessment.
A working group is a political entity to which a single-actor
rationale behavior model does not always apply.

Why did the editors of
draft-ietf-dnsext-rollover-requirements-00.txt jumped into the a-
priori option abandonment formulation in the drafting of section
5.2? I suggest the following answer: the editors (or someone who
influenced them) saw that an IPR-encumbered solution was
technologically superior to another one that they preferred, so
an a-priori abandonment strategy would fit their own purpose. If
the IPR-encumbered technology is inferior or even equal to the
free and preferred alternative, the a-priori option abandonment
would have no appeal to the proposer.

Then why nobody in the community yet objected to the a-priori
option abandonment (once proposed)? Suppose DNSSEC has a greater
than negligible value for some participants. A rational behavior
would be to optimize its implementation, given the engineering
constraints. If such participant has no bias for a trust anchor
key solution, he/she would normally argue against an a-priori
option abandonment.

In the present case, trust anchor key configuration is the very
first thing to do when a DNSSEC-aware resolver is installed. The
need for rollover comes from the need to preserve security over
time (i.e. maintaining the end-to-end cryptographic assurance
about data retrieved from the DNS). It is thus somehow linked to
the DNSSEC implementation optimization in the previous paragraph.

So there are two possible conclusions: a) some active
participants are biased towards a free alternative that they are
satisfied with, and/or b) no remaining active participants see
value in DNSSEC to the point where its implementation
optimization is worth some efforts.

Having reviewed the DNSSEC deployment issues, I think DNSSEC is
almost worthless. So the dnsext active participants would be
justified to let the requirement draft proceed with the a-priori
option abandonment formulation of section 5.2. A separate message
is posted about "DNSSEC is almost worthless!"

Does anybody knows why DNSSEC deployment would be significantly
valuable but keeping open an option (to study an IPR-encumbered
implementation alternative) should be banned?

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 06 Mar 2006 04:14:38 +0000

# >  (including yours, hilarie, while at DoD) 
# 
# Goodness, Paul, that was US taxpayer money!

the US taxpayers weren't who i would've felt like i'd disappointed if i'd
screwed up, though.  (i suspect that most folks on namedroppers don't know
that without you and russ mundy, BIND9 would have been designed without any
kind of DNSSEC or even the latent capability for adding it in later, which
is my real reason for mentioning it here.)