Subject: SO vs DNSSEC

From: "Olaf M. Kolkman" <[email-masked]>
Date: Wed, 6 Dec 2006 21:29:20 +0100

Colleagues,

Let us suppose that the Signature Only proposal would end up on  
standards track, what would that mean for DNSSEC?

I think that Mike's and Bert's arguments that SO is less complex and  
easier to deploy than DNSSEC bis, are  valid to some extend. SO  
carries DNSSEC label at less expense than DNSSEC-bis (that is a  
marketing thing). So those that will start to look to DNSSEC at the  
moment SO is available will do a minimal implementation or only  
deploy SO zones. Essentially DNSSEC compliance will probably boil  
down to MUST implement SO and MAY implement DNSSEC-BIS. My crystal  
ball functions well enough to predict that DNSSEC-bis will not be  
implemented/deployed to an extend to achieve useful  
interoperability.  Once SO is standardized then DNSSEC-bis will,  
effectively, be dead.

Personally I try to be open to new ideas and occasionally reread the  
"Emperors clothes" just to remind me of the healthy mindset.  
Nevertheless,  RFC3833 was our requirements document, it is only 2  
years old, and I find it difficult to believe we have worked on all  
the PNE issues without believing in them.

Mentioning "2 years" reminds me of the "15 years argument". While it  
is true that DNSSEC was first thought of 15 years ago, I do not think  
it is fair to compare it to the time DNSSEC had to catch up on  
deployment. RF4033-4035 have been finalized by this group less than 2  
years ago. For TLDs DNSSEC deployment is something that takes a wee  
bit of planning and thinking. I do think that the root and the TLDs  
are important first players. If they play others may play as well.

We, as a working group, have given a number of signals that DNSSEC- 
bis is fixed and that those who do not care about zone enumeration  
can start signing their zones today. Some organizations have actually  
tried to break through the chicken-and-egg problem by investing in  
software, infrastructure and documentation. Effectively  they only  
started about 2 years ago.  In my simple view the SO copes  with the  
lack of deployment by cutting away some of the complexities and turns  
the whole DNSSEC thing into lower-hanging fruit. Are we sure that  
lower hanging fruits taste better in the end? Will those low hanging  
fruits be sold? Why did we invest in growing the tree in the first  
place?

I remember that in 2001, or thereabouts, I had a chat with somebody  
who argued that DNSSEC according to rfc2535 should not be changed  
because the complexities in the key exchange between child and parent  
could be automated. I am happy I did not fully buy-in to his  
statement and that we ended up with DS (as if my buy-in made a  
difference :-)). I do remember a part of his chain of arguments. To  
paraphrase: If you can automate the complexity then only the  
implementor needs to deal with it. But the argument probably does  
hold for PNE; all PNE complexity disappears in the software (and I  
think one may expect some expert trouble shooting tools).

Anyway, this all boils down to the blunt question: Should we flush  
all DNSSEC-bis work and put our bet on SO?

Flushing DNSSEC-bis would mean re-charter of the group. I think that  
would only be prudent for such a drastic change of direction.

--Olaf
   namedropper (no hats)

PS. I can think of fall-back scenarios with ENUM where authenticated  
denial will help you when deciding if your asterisk server falls back  
to a PSTN call, gives a busy tone, or provides a voice message "Sorry  
you are not allowed to call over-seas".

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Mike StJohns <[email-masked]>
Date: Wed, 06 Dec 2006 16:08:52 -0500

>all DNSSEC-bis work and put our bet on SO?

Um... no - and I hope no one thought I was recommending this.

(And isn't DNSSEC 4033-35 + NSEC3 DNSSECtris? :-) )

SO builds on PNE DNSSEC.  The deployment model *is* different though 
and may be more attractive to both some zones and some end-users.  SO 
can use PNE signed zones and trust anchors.  In some ways SO could be 
considered more as competition for NSEC3 than for PNE (as described 
in 4033-4035).

PNE does provide specific functionality that SO does not - I don't 
dispute that.  If 4033-35 had been the end of it and fielding had 
commenced, SO wouldn't have been written for years if ever.  But we 
have NSEC3, we have the issues for trust anchor rollover and we have 
the general issues with how to deploy a given trust anchor in the 
first place as still outstanding issues.  I expect as PNE is fielded 
more things will crop up - it's the nature of the beast.  Some of 
these may be show stoppers - I would hope not, but blind faith that 
there will be only good outcomes is not really a good engineering principle.

In the meantime, SO may be a viable alternative for application 
developers and service providers that don't at this time see a 
requirement for PNE and do see a possible benefit from signed DNS 
data.    If PNE does end up getting deployed widely, an SO zone can 
be converted into a PNE zone rather quickly - as can an SO-aware 
application be converted into a PNE aware one.  It's even possible 
that SO-aware applications might encourage the deployment of PNE zones.

For PNE vs SO - most of the development work is at the application 
rather than the server - and that work has generally been lacking 
while the IETF tries to get the server side correct.  Anybody who 
wants to use SO is going to have to think about application use of 
signed data.  Once you do this, adapting an SO application to PNE 
status is relatively simple.

In any event, I wouldn't at this time recommend stopping further 
development on PNE related DNSSEC items - but ask me again in 2 years.  :-)

Mike

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Thu, 7 Dec 2006 00:33:50 +0100

> (And isn't DNSSEC 4033-35 + NSEC3 DNSSECtris? :-) )

Perhaps. I'm trying to fully grasp NSEC3 and have written
http://ds9a.nl/dnssec/index.html#nsec3 - I hope it makes sense.

If it doesn't, please let me know (off-list) and I'll correct it. Same goes
for the rest of http://ds9a.nl/dnssec btw.

	Bert

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

---

From: Edward Lewis <[email-masked]>
Date: Fri, 15 Dec 2006 10:16:12 -0500

At 21:29 +0100 12/6/06, Olaf M. Kolkman wrote:

>Anyway, this all boils down to the blunt question: Should we flush all
>DNSSEC-bis work and put our bet on SO?

I don't see SO and DNSSECbis/ter as competing.  They aren't solving 
the same problem.  So I would suggest the answer is no.

I don't see much forward momentum for DNSSEC* regardless of DLV, 
NSEC3, SO, or any other factor recently debated on this list. 
There's nothing standing in the way of progress, progress is just not 
happening.  I have seen equally little forward momentum for SO.  Is 
there code for it yet?

Is there evidence that the SO document's presence has stopped someone 
from deploying DNSSEC*?  I'm presuming not, but I wouldn't know.  Has 
anyone been told to hold back on DNSSECbis because there are ongoing 
discussions over NSEC3, etc.?   Are the distractions really 
distracting or just providing an excuse?
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                +1-571-434-5468
NeuStar

Dessert - aka Service Pack 1 for lunch.

---

From: Paul Vixie <[email-masked]>
Date: Fri, 15 Dec 2006 21:48:26 +0000

> I don't see SO and DNSSECbis/ter as competing.  They aren't solving the
> same problem.  So I would suggest the answer is no.

i do see SO and DNSSECbis/ter as competing -- for mindshare, both among the
group of volunteers willing to work on these problems, and among vendors who
may wish to deploy or support Secure DNS, and among domain holders who may
with to adopt Secure DNS.

> I don't see much forward momentum for DNSSEC* regardless of DLV, NSEC3, SO,
> or any other factor recently debated on this list.

my own census among potential deployers indicates that until the DNS community
makes a decision about what Secure DNS will be, nobody's going to wait for it
or plan on it or include it in their plans at all.  introducing SO at this
stage looks like "more dithering".  this working group needs a clear goal set,
a strategy for meeting those goals, and strong leadership to keep us focused
on those goals.  the leadership part is the only thing we've got right so far,
and admitting SO would send the other two requirements in the wrong direction.

> happening.  I have seen equally little forward momentum for SO.  Is there
> code for it yet?

speaking as an implementor, nobody has yet come to ISC asking for SO or 
offering to fund SO.  if any other implementor or potential implementor has
heard EOI's or RFP's for SO or SO-like functionality, that would make the
working group's decision interesting.

> Is there evidence that the SO document's presence has stopped someone from
> deploying DNSSEC*?  I'm presuming not, but I wouldn't know.

in addition to the usual problems in proving negatives, the cases i'm aware
of are of fence-sitters rolling their eyes and saying "AGAIN with the bi-annual
Secure DNS redesign?  what IS it with you people?"  which is to say, in answer
to your question, "yes and/or no".

> Has anyone been told to hold back on DNSSECbis because there are ongoing
> discussions over NSEC3, etc.?  Are the distractions really distracting or
> just providing an excuse?

with respect to DLV adoption, some folks i've approached about using DLV have
said that if the only thing left to do for Secure DNS is sign the root, then
DLV is an appropriate bootstrap mechanism, but with NSEC3 in the offing, they
don't want to adopt Secure DNS at all until it settles down, so DLV is just
useless to them.  i can extrapolate a bitter twisted cynical conclusion about
the appearance of "SO" on the landscape, but noone has actually done more
than roll their eyes (as described above), so it's not conclusive *enough*.

---

From: bert hubert <[email-masked]>
Date: Fri, 15 Dec 2006 22:48:31 +0100

> distracting or just providing an excuse?

I wouldn't be able to distinguish between the two. However, NSEC3 has, to my
experience, extended the perception that, "as usual", DNSSEC wil be ready
six months from now.

	Bert

---

From: Jay Daley <[email-masked]>
Date: Sat, 16 Dec 2006 22:15:58 +0000

> experience, extended the perception that, "as usual", DNSSEC wil be 
ready

That may be in true in some circles.  However NSEC3 has the four largest 
registries in the world (.com, .de, .net, .uk) making committments to 
deploy, funding work on development and deployment, working to get our 
registrars prepared and making real plans on just how we are going to 
implement DNSSEC w/NSEC3.  That more than outweighs any doubts about the 
final date for a critical mass of signed zones.

Jay Daley
Nominet UK