Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right

From: "Jeffrey A. Williams" <[email-masked]>
Date: Wed, 8 Sep 2010 16:32:55 -0500 (GMT-05:00)

Phillip and all,

  Not acting decisively, with due diliberation in as short
a period of time is necessary.  Wheather or not ICANN and/or
it's Registries/Registrars whom are supposedly 'Accredited'
by and too ICANN are the right decision makers to do such
certainly in a matter of some contention and debate.  As such
perhaps ICANN leadership has thus chosen not to take any action
accordingly which leaves you back to square one as many of the
ICANN accredited Registries/Registrars are also hosting providers,
which is where most of this problem begins and CAN end.

  My guess is that Gen. Alexander will at some point in the not
too distant future recomend to the current administration's
Cybersecurity Czar that ICANN's Registries/Registrars and their
corresponding or related hosting providers either get off the
dime, or be regulated to the point being required under threat
of law and punishment to do so.  I don't think this is scenerio
that most Domain Name holders, hosting companies, zone operators,
or ICANN Registries/Registrars would desire.

-----Original Message-----
>From: Phillip Hallam-Baker <[email-masked]>
>Sent: Sep 7, 2010 8:31 PM
>To: "Jeffrey A. Williams" <[email-masked]>
>Cc: [email-masked]
>Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right
>
>What a lot of people miss is that maybe it is not a good idea if ICANN
>is responsible for bouncing the phishing gangs, fake pharmacies and
>other malefactors off the net.
>
>ICANN has to move with deliberation, they cannot be cutting people off
>the net in seconds. But that is exactly what you want for protection.
>
>
>On Tue, Sep 7, 2010 at 7:21 PM, Jeffrey A. Williams
><[email-masked]> wrote:
>> Phillip and all,
>>
>>  Very good point and one that should not be discounted
>> or missed.  Additionally the channel approach doesn't
>> deal well with bad domains that proliferate phishing or
>> pharming E-mail scams either.
>>
>>
>> -----Original Message-----
>>>From: Phillip Hallam-Baker <[email-masked]>
>>>Sent: Sep 7, 2010 5:17 PM
>>>To: Stephane Bortzmeyer <[email-masked]>
>>>Cc: Jiankang YAO <[email-masked]>, [email-masked]
>>>Subject: Re: [dnsext] Re: MSIG proposal (on-the-fly sigs for ordinary records) Was: DNSSECis hard to get right
>>>
>>>The channel approach is definitely not suited for inter-domain trust.
>>>
>>>It does have definite advantages for intra-domain trust however. It
>>>allows the resolver to be used as a security proxy, filtering out
>>>known bad domains (e.g. malware infested, run by the mafia), caching
>>>DNSSEC results, using state to establish security context etc.
>>>
>>>
>>>On Tue, Sep 7, 2010 at 10:16 AM, Stephane Bortzmeyer <[email-masked]> wrote:
>>>> On Tue, Sep 07, 2010 at 04:03:53PM +0800,
>>>>  Jiankang YAO <[email-masked]> wrote
>>>>  a message of 139 lines which said:
>>>>
>>>>> frankly said, I got the inspiration from the DNScurv draft
>>>>> draft-dempsky-dnscurve-01 - DNSCurve,
>>>>
>>>> Indeed, MSIG is in the same league than DNScurve (and TSIG and IPsec),
>>>> it protects the channel, not the message. For instance, it does not
>>>> protect you against a rogue slave authoritative name server.
>>>>
>>>>> MSIG is very useful for the registries or the DNS zone which has the
>>>>> millions of domain names since it will reduce the size of the zone
>>>>> dramatically.
>>>>
>>>> NSEC3+opt-out is sufficient for me.

Regards,
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827