Subject: [dnsext] draft-diao-aip-dns

From: Fred Baker <[email-masked]>
Date: Mon, 18 Jun 2012 13:17:28 -0700

This is a resend, copying the right list.

I'm reading draft-diao-aip-dns, and wonder what the context is. Is this related to the BRICI proposal in WCIT, for support for a DNS root modeled on the International Calling Code structure of the telephone system?

My concern is for the possibility of disruption to Internet communications. If a country (or for that matter a business that simply decides to sell access to its own autonomous root) acts autonomously and unilaterally to add a TLD, other countries/services may or may not know about it, and the names may therefore not be usable in any context other than the country/service itself. If DNS resolution of names that are not from the country/service in question are forced to channel through the autonomous root, there are "interesting" questions of scale.

Comments on the paper itself:

The Introduction opens with the sentence

  Internet Domain Name System (DNS) distributes domain name and IP      
  address for the host on the Internet. DNS automatically translates    
  the domain name into IP address when user accesses Internet using     
  domain name. 

I would dispute that. The DNS enables a client to obtain a resource record from a name service; the resource record might be for an IPv4 or IPv6 address (A/AAAA), for the name of one or more mail servers (MX), an encryption/signature key, or a variety of other types of information.

In section 3.2, if I understand the document correctly, the document proposes to use recursive DNS access between AIPs. I have no problem with recursive translation; it is defined and works now. However, it would appear that this recursive translation happens between AIP DNS roots, as opposed to happening from a DNS server closer to the original request. I think that is likely to have serious scaling issues.

One general comment on sentence structure: in English, it is considered poor form to start a sentence with "And". For example

                                And any IP node's external domain     
  name is consist of its internal domain name and its AIP network       
  default domain name suffix.    

should read

                                  Any IP node's external domain     
  name consists of its internal domain name and its AIP network       
  default domain name suffix. 

While the specific point is a nit, I see it frequently in the paper.

I'm not sure I understand rule 3 in section 2.2. If, for example, I am in a Chinese AIP and want to access www.example.com, but I want to get to the one that would be accessible from Brazil, do I access "www.example.com", "www.example.com.ex", www.example.com.br.ex", or something else? Is there any reason to believe that the resource record for www.example.com within the AIP is the same as the one for the same name in some other AIP? I worry about that, as much as anything, because international business and communication depends on a common understanding of resource records; if a vendor in country A wants to make a product or service available to a potential customer in country B (or for that matter in all countries), it gives one URI/URL to all of them and they all have access to it. If there is significant confusion at this level, sending for example requests intended for Google to Baidu, it will have a significant and negative effect on international business and communications. That not only doesn't bode well for the Internet as an international communication vehicle, it portends poor economic results for the countries that deploy autonomous internets.

Last time China proposed this (October 2000), John Klensin and I flew to Beijing to discuss it with Professor Qian Hua-lin. He agreed that the economic importance of international trade far outweighed the value of having an autonomous naming system...

Could you comment on the proposal, explaining in more detail what you have in mind, and how (a) the service remains scalable, and (b) the service supports the international objectives of business interests that use it?

---

From: Nicholas Weaver <[email-masked]>
Date: Wed, 20 Jun 2012 08:31:44 -0700

My own $.02 as well, on just one little piece...

> 5.  Security Considerations
> 
>    There is no additional security requirement than current domain name
>    system. Security issues are not discussed in this memo.

To put this succinctly, Hu?!?

The point of this is to allow a country to "override the root": provide its own DNS hierarchy which it controls to create an "Autonomous Internet", namely, a namespace which deliberately excludes "undesirable" names.  Because unless you are excluding "undesirable" names, what is the benefit of having two separate namespaces for the same name in different countries? [1]

This goes strictly contrary to DNSSEC, where, out of operational concerns, all validators know the same universal root signing key.  

Each "Autonomous Internet" would require its own root key, and any client which may move between multiple AIPs would need to either a-proiri know all distinct AIP root keys or somehow securely discover the individual AIP's root key (HOW?!)

There is also the namespace confusion problem, which is a security problem:  www.example.com in AIP A ?= www.example.com in AIP B.

This is a huge concern, even if you solve the DNSSEC key problem, since subverting either AIP will affect all clients in that AIP, and any client who goes between AIPs.

Fragmenting the namespace IS a security problem.

[1] And if you want to block undesirable names, the existing infrastructure does a good job of it.

---

From: Doug Barton <[email-masked]>
Date: Wed, 20 Jun 2012 13:16:07 -0700

On 06/20/2012 08:31 AM, Nicholas Weaver wrote:
> The point of this is to allow a country to "override the root"

s/the root/ICANN/

... where overriding the root is just a tool. It should be pretty
obvious where I stand on this, but for the record, I'm vehemently
opposed to the draft (speaking only for myself of course).

Doug

---

From: Ralph Droms <[email-masked]>
Date: Fri, 22 Jun 2012 16:54:42 -0400

FYI - reposted to the IESG by Stephen Farrell:

Chinese Operators Hope to Standardize a Segmented Internet
Posted on Monday Jun 18, 2012 10:20 AM by Mikael Ricknäs

A technology draft written by employees at China Mobile and China
Telecom and submitted to the Internet Engineering Task Force describes
how the Internet could be split into several parts using the Domain Name
System and in the process give countries more control over their own
segment of the network.

The DNS is one of the key building blocks of the Internet. Its most
important task is translating IP (Internet Protocol) addresses to host
names, which is done by a distributed system based on one unique root
that is used all over the world.

The technology is developed by the IETF, on whose website the Chinese
"DNS Extension for Autonomous Internet" draft is available for
viewing.<https://tools.ietf.org/html/draft-diao-aip-dns-00>

Today, China blocks Internet access to some foreign websites. The goal
outlined by the new document is to make it easier and cheaper for
countries to create independent root DNS servers and realize Internet
autonomy. Today, that is both costly and technically difficult,
according to the draft.

"When you read the document it very much comes across as a way to
severely segment the Internet," said Patrik Wallström, CEO at OpenDNSSEC
AB, a not-for-profit company with the mission to facilitate the
deployment of DNSSEC, which is used to secure DNS.

If the draft is adopted it would give, for example, China full control
of content on the Internet for users in the country as well as how it
can be accessed and by whom, Wallström said.

The reason for adopting the draft into a standard architecture would not
be just for control, according to the authors. The current central
architecture of DNS can't keep up with the fast development of Internet,
they say.

That argument doesn't ring true, according to Jakob Schlyter, a DNS
expert at Swedish consultancy Kirei.

"When you say something like that you have to back it up with some
facts, which I don't think they have ... the DNS root has an extreme
overcapacity," said Schlyter.

However, the chances of the draft being adopted is very remote,
according to both Wallström and Schlyter.

Anyone can individually submit an Internet draft to the IETF. But since
the intended goal with the Chinese document is standardization, it first
has to be picked up by one of the IETF's working groups, and that isn't
going to happen, Wallström said.

"It is a controversial subject, and the IETF works on standards that, in
principle, are for the global Internet," said Wallström.

The idea of moving away from a central DNS root also goes against the
IAB's (Internet Architecture Board's) technical comment from 2000,
detailing the need for a unique DNS root to ensure the future of the
Internet, according to Wallström. The comment came after several
alternative roots came into existence during the nineties, he said.

"The Chinese draft would be a return to that," said Wallström.

Schlyter is equally convinced that nothing will become of the draft.

"There is an extremely small risk of it going anywhere. I say risk
because I am proponent of a common namespace, and all that comes with
that," said Schlyter.

Because of the minuscule chance of the draft ever becoming a standard,
the underlying reason for publishing it may be something altogether
different, according to Wallström.

"This is just me speculating, but with the arrival new generic top-level
domains (gTLDs) a document like this one can be published to put more
pressure on ICANN with the aim of maybe even splitting the organization
into different parts where China has more power," Wallström said.

Today, ICANN (Internet Corporation for Assigned Names and Numbers),
which is also a big proponent of a unique root, coordinates the DNS as
well as a whole host of other Internet-related components. These were
originally performed under a U.S. government contract.

Send news tips and comments to [email-masked]

---

From: Eric Brunner-Williams <[email-masked]>
Date: Fri, 22 Jun 2012 22:26:53 -0400

> Last time China proposed this (October 2000), John Klensin and I flew to Beijing to discuss it with Professor Qian Hua-lin. He agreed that the economic importance of international trade far outweig…

I was there too Fred, speaking with Professor Qian Hua-lin and others,
and Madame Hu Qiheng on the range of choices

---

From: "Jiankang YAO" <[email-masked]>
Date: Mon, 25 Jun 2012 13:10:13 +0800

I just called one of china mobile friends, who said that China mobile headquarter did not know about this draft and the idea in this draft. They are trying to learn what the draft is and what the idea in this draft is. At least, it is not the official idea from China mobile.
Some colleagues from china mobile may respond to it later.

Jiankang Yao

----- Original Message ----- 
From: "Ralph Droms" <[email-masked]>
To: "dnsext List" <[email-masked]>
Sent: Saturday, June 23, 2012 4:54 AM
Subject: Re: [dnsext] draft-diao-aip-dns

Send news tips and comments to [email-masked]
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: "Jiankang YAO" <[email-masked]>
Date: Mon, 25 Jun 2012 15:41:37 +0800

I have talked to one of the authors for this draft, who said "this draft is mainly due to individual research interests, it is not organiations' research interests."

In 01 version, they have removed the organizaitons' name from the author information.

Pls see https://tools.ietf.org/html/draft-diao-aip-dns-01#page-11

Jiankang Yao

----- Original Message ----- 
From: "Jiankang YAO" <[email-masked]>
To: "Ralph Droms" <[email-masked]>; "dnsext List" <[email-masked]>
Sent: Monday, June 25, 2012 1:10 PM
Subject: Re: [dnsext] draft-diao-aip-dns

Jiankang Yao