Subject: Re: part II - Re: Remarks on the DNS Security Extension Clarification on Zone Status draft

From: Roy Arends <[email-masked]>
Date: Fri, 26 May 2000 16:59:52 +0200 (CEST)

Dear mr. Lewis,

Thanks for pointing out that we have used different definitions of
"off-tree" signing.  Indeed we interpreted "off-tree" as what you
call "intrinsically trusted". What you meant by "off-tree" is
something we did not take into consideration, because we thought
of that as a too weak implementation of DNSSEC, and we were unaware
of the discussions about section 6 of RFC 2535.

I think we are in full agreement that: 

1. Security starts at one or more well defined secured entry-points in the
   DNS-tree and follows delegations until security ends verifyably.

2. Signing random RR's by an external (non-parent) signer is vulnerable
   to spoofing for all resolvers that are not pre-configured to know
   who the signer is and what it has signed exactly.
   Such detailed pre-configuration seems impractical and scales badly.

About the Draft: 
Perhaps a clarification of secured entry-points, and the possible
existance of "mini trusted trees" is useful.

Our tests to deploy DNSSEC on the largest ccTLDs convinced us that
a NULL-KEY is not so bad in terms of size and effort, that it calls
for a major update of the current proposed standard. (NULL-KEY's
are temporal, small, and signing them is not a big issue.)
We think it is best to put our effort to do large scale testing of
the current RFC.

And finally, about your remarks on loose versus tight policies, we
probably agree on that, and it was certainly not our intention to
plead for a weak DNSSEC implementation.

Regards,
-- Roy and Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Fri, 26 May 2000 15:10:00 -0400

At 10:59 AM -0400 5/26/00, Roy Arends wrote:

I figured that, with the similarity in our assumptions, the differences in
our conclusions probably meant that there were misinterpretations of terms
and phrases happening.  Which leads to...

>existance of "mini trusted trees" is useful.

...thanks for the suggestion.  I have realized that I need to improve the
introduction section to avoid misunderstandings.  I have omitted too many
ideas that are well-known-in-the-hallway but not expressed in drafts.

>We think it is best to put our effort to do large scale testing of

Keep us posted!  We need real-life experience to go along with the
philosophical musings of people like me.

It is interesting that you say that the NULL key isn't a problem.  I'll
look into that, I had heard differently from other large-domain operators.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

"It takes years of training to know when to do nothing" - Dogbert

Opinions expressed are property of my evil twin, not my employer.