Subject: Zone security status draft

From: Edward Lewis <[email-masked]>
Date: Mon, 10 Apr 2000 10:48:55 -0400

Comments on the slides Olafur used in Adelaide, and the reported discussion
that followed:

0) My email is lewis@, not elewis@...

1) The term "privately secure" was not my choice either.  I had preferred
"partially secure" but was coerced out of it when the draft was internally
discussed.

      The issue here is terminology.  In defining the stages at
      which a zone admin can set up their zone, a zone could be
      configured to be as secure as can be, as secure as the admin
      wants it, or unsecured.

      Keep in mind that security of a zone is really in the eye of
      the resolver.  Still, I want to define a guidance for server
      admins, so I chose terms assuming the "canonical secure resolver,"
      i.e., one that uses the DNS tree as an authorization-to-sign
      tree and isn't very liberal in trust.

      Fully secure is meant to define a zone that is pristine in the
      ways of security and interoperability, going as far as using
      just the mandatory-to-implement crypto algorithms.  At the
      other extreme end of the scale is unsecured, meaning that the
      admin is essentially running DNS as it is now.

      In between is a significant situation in which an admin applies
      all the rules, but uses a crypto algorithm that is not mandatory
      to implmement in the spec (e.g., RSA/MD5) or uses a non-parent
      signer to back the zone.  The term in the draft is "private,"
      but I prefer "partial" as the zone is seen as secure by a partial
      audience - only those understanding the protocol or authorizing
      the non-parent signer to back the key's validity.

So, the issue before the group - given that "private" isn't a good term to
use in this context?  I am open to suggestions.

2) The draft talks terminology and also introduces a new way to signify the
status of a child zone.  Should this draft be split into two?

There is time pressure due to BIND 9's release in the near future to have
this solid soon, leaving the two issues together might drag this out.  On
the other hand, the two issues are interrelated, and there would be an
editing delay in trying to split the document.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"Trying is the first step to failure." - Homer Simpson
"No! Try not. Do... or do not. There is no try." - Yoda
"It takes years of training to know when to do nothing" - Dogbert 1/21/00

Opinions expressed are property of my evil twin, not my employer.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.