Subject: [Enum] I have one question for list on the "recommendation" to use DNSSEC

From: Richard Shockey <[email-masked]>
Date: Thu, 23 Jan 2003 13:10:48 -0500

Is this something we want to put in the 2916bis?

I do not want to give the impression to implementers or national enum 
administrations that this is requirement.

The current state of DNSSEC deployment is "still under evaluation" and to 
my knowledge none of the major CC or GTLD has implemented it.

Of course at some time in the future DNSSEC will be extremely important but 
do we want to make that kind of statement now.

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 314.503.0640,  Fax: +1 815.333.1237
<mailto:[email-masked]> or <mailto:[email-masked]>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Bill Manning <[email-masked]>
Date: Thu, 23 Jan 2003 11:22:59 -0800 (PST)

DNSSEC (at least SIG/KEY/NXT) is not cooked yet.
 If (big if) we are able to pull it together, those portions of
 the DNSSEC toolkit should be deployable in 2003.

% 
% Is this something we want to put in the 2916bis?
% 
% I do not want to give the impression to implementers or national enum 
% administrations that this is requirement.
% 
% The current state of DNSSEC deployment is "still under evaluation" and to 
% my knowledge none of the major CC or GTLD has implemented it.
% 
% Of course at some time in the future DNSSEC will be extremely important but 
% do we want to make that kind of statement now.
% 
% 
% 
%  >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
% Richard Shockey, Senior Manager, Strategic Technology Initiatives
% NeuStar Inc.
% 46000 Center Oak Plaza  -   Sterling, VA  20166
% Voice +1 571.434.5651 Cell : +1 314.503.0640,  Fax: +1 815.333.1237
% <mailto:[email-masked]> or <mailto:[email-masked]>
%   <http://www.neustar.biz> ; <http://www.enum.org>
% <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
% 
% _______________________________________________
% enum mailing list
% [email-masked]
% https://www1.ietf.org/mailman/listinfo/enum
% 

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Jim Reid <[email-masked]>
Date: Thu, 23 Jan 2003 11:56:44 -0800

>>>>> "Richard" == Richard Shockey <[email-masked]> writes:

    Richard> Is this something we want to put in the 2916bis?

Yes.

    Richard> I do not want to give the impression to implementers or
    Richard> national enum administrations that this is requirement.

It's hard to see how the current text could be interpreted in that
way. Then again, there's plenty of experience of people infering all
sorts of things from standards documents... The current wording seems
fine to me. It says "recommended", not "RECOMMENDED" so DNSSEC is
clearly not a requirement at this time.

I think it's important that implementers and national enum
administrations get some indication in the draft that they should at
least plan for DNSSEC. For instance, by having a play with it in
national trials, as I've discussed with you before.

    Richard> Of course at some time in the future DNSSEC will be
    Richard> extremely important but do we want to make that kind of
    Richard> statement now.

I think so. It's prudent to lay down some sort of marker that DNSSEC
will almost certainly have a major role to play in ENUM. Which is what
the text in the current does IMO. It would be very bad to lose this
reference to DNSSEC since there's a general acceptance that it's going
be critical for ENUM one day. Assuming DNSSEC does eventually get out
of IETF of course as the DNS folks expect/hope.

If there are concerns that the current draft could be interpreted as a
requirement, how about including the text below?

	It is NOT RECOMMENDED at this time that DNSSEC is used as the
	DNSSEC standards are not yet complete. DNSSEC MAY be used to
	gain practical experience and understanding on how it could be
	deployed in future.
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Thu, 23 Jan 2003 12:00:13 -0800

>>>>> "Bill" == Bill Manning <[email-masked]> writes:

    Bill>  DNSSEC (at least SIG/KEY/NXT) is not cooked yet.  If (big
    Bill> if) we are able to pull it together, those portions of the
    Bill> DNSSEC toolkit should be deployable in 2003.

Hmm. This is now the third year in a row when folk have been saying
"DNSSEC could be deployable by the end of this year". :-) :-(
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Richard Shockey <[email-masked]>
Date: Thu, 23 Jan 2003 15:24:39 -0500

>clearly not a requirement at this time.

yes I specifically asked Patrik to use lower case ... but what I do worry 
about  that people read things into 2916bis that were not intentional. We 
had this problem with some of the examples in 2916 ...people see linking 
phone numbers to email addresses and suddenly there articles in the press 
and seminars by privacy advocates that we are creating the ultimate spam 
engine.

"recommend" to some might be interpreted as MUST..

We have to be very very clear about what goes into this document.  That 
does not mean we have to burden it with every possible case but clarity 
here is going to be very helpful.  Which is why I want everyone to read the 
DDDS portions and properly comment.

We ran into lots of problems before in exactly how the NAPTR record should 
be processed by the CU/A

>of IETF of course as the DNS folks expect/hope.

I dont disagree.

>         gain practical experience and understanding on how it could be

I think this is excellent language and I would fully support it 
incorporation in 2916bis this captures very succinctly what I was trying to 
get at.

---

From: Bill Manning <[email-masked]>
Date: Thu, 23 Jan 2003 12:22:14 -0800 (PST)

% >>>>> "Bill" == Bill Manning <[email-masked]> writes:
% 
%     Bill>  DNSSEC (at least SIG/KEY/NXT) is not cooked yet.  If (big
%     Bill> if) we are able to pull it together, those portions of the
%     Bill> DNSSEC toolkit should be deployable in 2003.
% 
% Hmm. This is now the third year in a row when folk have been saying
% "DNSSEC could be deployable by the end of this year". :-) :-(

	from here, it looks like we are ~2.5 generations into 
	the design cycle.  1st gen was not operationaly feasable
	(too much "chatter" between parent and child), 2nd gen
	has issues w/ the installed base (e.g. non-DNSSEC aware
	delegation points see signed delegations disappear) and
	so the trick now is to figure out how to get things 
	deployable while not isolating unsigned delegations.
	
	its a tough nut to crack.  that said, there is a persistant
	testbed where DNSSEC evaluations are being conducted. 
	I'd welcome any enum-test environment to take advantage of
	the dnssec testbed.

--bill

---

From: Jeff Williams <[email-masked]>
Date: Thu, 23 Jan 2003 19:20:52 -0800

RIchard and all,

  Well it is a cinch that Nuestar nor ICANN have implemented DNSSEC
yet or done so successfully anyway...

  In any event, yes DNSSEC is very important now.  The Homeland
Security Department is working on a draft in this regard for further
recommendation to the president, along with other IT security related
matters as I type this response..

>   <http://www.neustar.biz> ; <http://www.enum.org>

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
================================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801

---

From: "Peter Williams" <[email-masked]>
Date: Mon, 27 Jan 2003 10:31:53 -0800

Bill,

Don't worry about the generations or timeline: the
inertia against DNSSEC look almost identical to
that which plagued SSL certs et al for over
10 years (pre 1994) in the IETF. I suspect the motivations
for maintaining the inertia against infrastructure
change (and solving problems) are similar in both
cases - an observation that suggests how to break
the cycle.

Concerning DNSSEC, we have to ignore the ENUM
tiering work - which is a red herring (for DNSSEC
purposes), like hierarchical PKI controls were (for
SSL purposes). We have to remember that
DNS can layer over older infrastructures: DNSSEC
in the ENUM world doesn't have to *start* by
fully integrating with the ICANN-regulated name
registration, or the ITU member databases for
locating which current provider services a phone
address.

The core power of ENUM is still the E.164 address
mapping and the scalability of DNS reach, not the
name re/re/re/registration business and jurisdiction
issues that folks are concentrating on. Its far to
early with ENUM to be focusing on practices
that will one day allow for competitive
positioning and/or dominance; like SSL before
it, this is throttling the more basic
technology adoption, throwing up very similar
defenses justifying inaction!

I can think of several ways to break the cycle
benefiting both ENUM and DNSSEC. Id like
to see a comment attached to the recommendation
concerning DNSSEC - one that captures
the WGs overall sentiment on the issue, and
its expectations.

----- Original Message -----
From: "Bill Manning" <[email-masked]>
To: "Jim Reid" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Thursday, January 23, 2003 12:22 PM
Subject: Re: [Enum] I have one question for list on the "recommendation" to
use DNSSEC

---

From: Richard Shockey <[email-masked]>
Date: Tue, 28 Jan 2003 12:15:15 -0500

A

>the WGs overall sentiment on the issue, and

Well this was my point ...I still agree with Jim Reid's sentiment..

If anyone has better language to suggest to the authors .. please do so.

---

From: Jeff Williams <[email-masked]>
Date: Tue, 28 Jan 2003 19:52:12 -0800

Richard and all,

  It is unfortunately true that the WG for DNSSEC of the IETF has
yet to complete it's work of final standards for DNSSEC despite
several years of working on it.  None the less the private software
industry has working "Versions" that are deployed and being deployed
as well as work well.  Hence this sort of IETF comment/statement
of Jim Reid's, are really misleading and damaging if taken too
seriously...

Regards,

---

From: Richard Shockey <[email-masked]>
Date: Tue, 28 Jan 2003 21:16:41 -0500

>of Jim Reid's, are really misleading and damaging if taken too

I dont think so ...your statement is the one that is totally misleading . 
"Versions" mean only incompatibility in the IETF context.

The DNSOPS community has not issued any formal report on interoperability 
of DNSSEC when they do so, and only when they do so, will I and I believe 
the general ENUM community be prepared to implement the standard.

---

From: Jeff Williams <[email-masked]>
Date: Tue, 28 Jan 2003 20:41:15 -0800

Richard and all,

> "Versions" mean only incompatibility in the IETF context.

  Not always, but sometimes such "Versions" may be.  When
incompatible, such is not always a bad thing.  However all those
"Versions" that I am familiar with are compatible with what
the DNSSEC WG has thus far completed or is considering.
So a "Always" or "Never" response such as yours is obviously
and terribly in and of itself detrimental and misleading.

> the general ENUM community be prepared to implement the standard.

  Some of the ENUM community have already committed to do so.  As
among those our members and my companies as well as affiliate
companies are going to meet the presidents plan despite the less than
effective timetable of IETF, but will indeed share that effort with the
IETF and other standards organizations such as Sans and IEEE.

Regards,

---

From: "Peter Williams" <[email-masked]>
Date: Wed, 29 Jan 2003 11:13:59 -0800

Concerning dns security and ENUM,
I think there are other issues going on here,
which we should air. Choice of lower case or
upper case letters in a single word
in a specification document is not the
main issue.

The current business of locating (and re-registering)
E.164 primitive names is (apparently) managed using
an advanced CMIP deployment, secured with high
speed crypto hardware in which many dollars
are invested; several large operations
contracts maintain this. DNSSEC in this space
competes with several sets of vested interests,
many of which are cultural in nature. Tact
is called for, here. Tact is rarely a
feature of IETF consensus making :(

In the IETF space, E.164 name management is the
basis of ENUM applications, which allow for
convergence of PSTN and Internet worlds. The
initial applications are highly localized in their
needs for Internet infrastructure: we do not need
to first revise the mainline DNS to iron out the
technicalities, to improve voip, say. We
can work on a branch circuit.

I had to go outside IETF in 1994 to make SSL certs
happen: VeriSign was born as a result of
that (temporary) disalignment with IETF process.
The operational need for packet security was
critical, and could not wait for the
required sea-change in consensus in the
then security and application WGs.

The need for securing the DNS infrastructure
is as critical now, as was the need for SSL
certs for e-commerce application, then. We need the
delegation controls; to get them may require
similar handling as we applied to obtain the initial
SSL cert deployment, if we cannot get the IETF
politics untangled, here.

Id like to see an ENUM application group
lead the DNSSEC work in ENUM. Id like
to see the general ENUM leadership here
work more actively to make this latter
action happen.

Peter.

Original Message -----
From: "Richard Shockey" <[email-masked]>
To: "Jeff Williams" <[email-masked]>
Cc: "Peter Williams" <[email-masked]>; "Bill Manning" <[email-masked]>;
<[email-masked]>
Sent: Tuesday, January 28, 2003 6:16 PM
Subject: Re: [Enum] I have one question for list on the "recommendation" to
use DNSSEC

---

From: David Conrad <[email-masked]>
Date: Wed, 29 Jan 2003 11:31:20 -0800

Hi,

On Wednesday, January 29, 2003, at 11:13  AM, Peter Williams wrote:
> many of which are cultural in nature.

Eh?  I don't think so, but maybe I'm confused.

DNSSEC validates that the data returned to the validating recursive 
server is the same data the zone administrator put into the 
authoritative zone.  It has nothing to do with putting the data into 
the authoritative zone (which the CMIP goop does, if I understand 
correctly) -- DNSSEC is only relevant to end users requesting NAPTR 
records.

> Tact

So true.

Rgds,
-drc

---

From: Richard Shockey <[email-masked]>
Date: Wed, 29 Jan 2003 15:59:30 -0500

>>many of which are cultural in nature.

Peter...
Not really ... the probable interface between appropriate ENUM registrar 
and the Tier 1 zone administrator will probably be a variant of the EPP 
protocol now under development in the PROVREG working group .. advanced 
discussions about this are now underway in various national ENUM Forums 
particularly the one in the US.

we already have a preliminary draft on the subject here in the WG and when 
PROVREG completes ist work this WG will undboutly begin discussions on how 
to proceed..we already have the item on our charter.