Subject: RE: [Enum] I have one question for list on the "recommendation" t o use DNSSEC

From: Kevin McCandless <[email-masked]>
Date: Wed, 29 Jan 2003 06:38:55 -0800

I have to agree with Jeff's statements.  The proposal by Richard is very
limiting and there is no reason not to recommend DNSSEC.  If the opt-in
principal is adopted for DNSSEC, then for example a TIER 2 that is not using
DNSSEC can interact with a TIER 1 that is using DNSSEC.  

As I mentioned before DNSSEC is the recommendation in the Unified document
developed by the ENUM Forum.  Why would we suggestion or go against that
recommendation?  Many of the people on this list have had more then enough
opportunity to participate in the ENUM forum and make their recommendations.
Even our chairman here has been involved in the ENUM forum and many of his
colleagues.  

Let's move forward with the recommendation of using DNSSEC.  This is an IETF
supported security protocol!

Kevin...........

> -----Original Message-----
> From: Jeff Williams [mailto:[email-masked]]
> Sent: Tuesday, January 28, 2003 9:52 PM
> To: Richard Shockey
> Cc: Peter Williams; Bill Manning; [email-masked]
> Subject: Re: [Enum] I have one question for list on the 
> "recommendation"
> to use DNSSEC
> 
> 
> Richard and all,
> 
>   It is unfortunately true that the WG for DNSSEC of the IETF has
> yet to complete it's work of final standards for DNSSEC despite
> several years of working on it.  None the less the private software
> industry has working "Versions" that are deployed and being deployed
> as well as work well.  Hence this sort of IETF comment/statement
> of Jim Reid's, are really misleading and damaging if taken too
> seriously...
> 
> Richard Shockey wrote:
> 
> > A
> >
> > >I can think of several ways to break the cycle
> > >benefiting both ENUM and DNSSEC. Id like
> > >to see a comment attached to the recommendation
> > >concerning DNSSEC - one that captures
> > >the WGs overall sentiment on the issue, and
> > >its expectations.
> >
> > Well this was my point ...I still agree with Jim Reid's sentiment..
> >
> > It is NOT RECOMMENDED at this time that DNSSEC is used as the
> >          DNSSEC standards are not yet complete. DNSSEC MAY 
> be used to
> >          gain practical experience and understanding on how 
> it could be
> >          deployed in future.
> >
> > If anyone has better language to suggest to the authors .. 
> please do so.
> >
> >  >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> > Richard Shockey, Senior Manager, Strategic Technology Initiatives
> > NeuStar Inc.
> > 46000 Center Oak Plaza  -   Sterling, VA  20166
> > Voice +1 571.434.5651 Cell : +1 314.503.0640,  Fax: +1 815.333.1237
> > <mailto:[email-masked]> or <mailto:[email-masked]>
> >   <http://www.neustar.biz> ; <http://www.enum.org>
> > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> >
> > _______________________________________________
> > enum mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/enum
> 
> Regards,
> --
> Jeffrey A. Williams
> Spokesman for INEGroup LLA. - (Over 129k members/stakeholders strong!)
> ================================================================
> CEO/DIR. Internet Network Eng. SR. Eng. Network data security
> Information Network Eng. Group. INEG. INC.
> E-Mail [email-masked]
> Contact Number: 214-244-4827 or 214-244-3801
> 
> 
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
> 
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jim Reid <[email-masked]>
Date: Wed, 29 Jan 2003 09:45:20 -0800

>>>>> "Kevin" == Kevin McCandless <[email-masked]> writes:

    Kevin> I have to agree with Jeff's statements.  The proposal by
    Kevin> Richard is very limiting and there is no reason not to
    Kevin> recommend DNSSEC.

I think recommend (lower case) is OK. A RECOMMEND is too strong at
this time as the DNSSEC protocol is not mature enough. That does not
mean DNSSEC should not be tried. I most definitely want this to figure
in the UK ENUM trial.

    Kevin> As I mentioned before DNSSEC is the recommendation in the
    Kevin> Unified document developed by the ENUM Forum.  Why would we
    Kevin> suggestion or go against that recommendation?  

The US ENUM Forum is not the only body who have input into the IETF's
ENUM efforts.

    Kevin> Let's move forward with the recommendation of using DNSSEC.

This worries me, even though I very much want to see DNSSEC deployed
for ENUM. There isn't yet a specification for DNSSEC that's nailed
down. Which one should be recommended, RFC2535 which the DNSSEC folk
want to kill, or the one with Delegation Signer? Or the one with
Opt-In? [That's the DNSSEC context of opt-in which means changing the
semantics of the NXT record, not some privacy context of the term for
end users.] AFAIK, the only public DS-aware DNSSEC implementation are
snapshots of BIND9.3 which have pretty much only been used by the
engineers bashing on DNSSEC. That code has not been released yet.

So for now DNSSEC should be considered experimental and most
definitely something to evaluate in trials: especially the
nitty-gritty of key management, signing policies and processes, etc. 
Hopefully there will soon be production code and a complete protocol
spec that would mean RFC2916bis could RECOMMEND DNSSEC (or even MUST).
_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jeff Williams <[email-masked]>
Date: Wed, 29 Jan 2003 22:09:58 -0800

Davie and all,

David Conrad wrote:

> On Wednesday, January 29, 2003, at 07:00  PM, Jeff Williams wrote:
> >   This is not accurate Jim.  Several well publicized commercial based
> > and developed public DS-aware products are well known to the
> > IETF and have been for some time now and are compatible
> > directly with the present position of DNSSEC.
>
> Please name these "well publicized commercial based and developed
> public DS-aware products" known to the IETF.

  As you are frequently on the Name Droppers ML, I would have thought
you were more "Aware" yourself.  >;)  I must be mistaken in that regard.
Live and learn I suppose.  In any event, here are a FEW links for you.
 http://www.microsoft.com/poland/windows2000/technic/terminology/activedirectory.asp

 http://developer.novell.com/support/sample/tids/nw_icons/nw_icons.htm
http://josefsson.org/walker/

> Thanks,
> -drc

Regards,

---

From: Jeff Williams <[email-masked]>
Date: Wed, 29 Jan 2003 22:24:11 -0800

Jim and all,

Jim Reid wrote:

> >>>>> "Jeff" == Jeff Williams <[email-masked]> writes:
>
>     >>  This worries me, even though I very much want to see DNSSEC
>     >> deployed for ENUM. There isn't yet a specification for DNSSEC
>     >> that's nailed down. Which one should be recommended, RFC2535
>     >> which the DNSSEC folk want to kill, or the one with Delegation
>     >> Signer? Or the one with Opt-In?
>
>     Jeff>   Why not both Jim?
>
> I mentioned 3 possibilities for DNSSEC. They are not compatible with
> each other and can't interoperate. That's why DNSSEC isn't finished yet.
> Please read the latest drafts of these things if you won't take my
> word for it.

  I have again just recently Jim.  Thanks for suggesting it anyway.  I don't

currently agree that the three possibilities as you mention them are not
compatible however.  I do understand fully that the IETF effort on
DNSSEC isn't finished yet as I have already mentioned in this thread
twice.

>
>
>     >> [That's the DNSSEC context of opt-in which means changing the
>     >> semantics of the NXT record, not some privacy context of the
>     >> term for end users.] AFAIK, the only public DS-aware DNSSEC
>     >> implementation are snapshots of BIND9.3 which have pretty much
>     >> only been used by the engineers bashing on DNSSEC. That code
>     >> has not been released yet.
>
>     Jeff>   This is not accurate Jim.
>
> It's all true. And it's also what I know is inside my head. I'm
> surprised you would know more about that than I do.

  I don't know that I know more than you about it or not.  I certainly
didn't intend to intimate as much.  I just technically don't agree with this

evaluation.  So from one technical view point indeed what you said
above is all true.  That doesn't make it accurate or etched in stone,
Jim.  Hence my brief comment in disagreement.  Certain commercial
technical developers concentrating on DS-aware apps for DNS
and applicable for ENUM, show clearly that other work or works
are underway that you may not be aware of, and I am sure several
I am not aware of either.  Hence a IETF centric solution is not
always advantageous from a business point of view.  Computability
and interoprability is of course desirable, and in my view, necessary
however...  As we have learned recently (This week) IETF protocols
are not always "Best Practice" for a number of reasons i.e. RFC2068
debacle.

>
>
>     Jeff>   Several well publicized
>     Jeff> commercial based and developed public DS-aware products are
>     Jeff> well known to the IETF and have been for some time now and
>     Jeff> are compatible directly with the present position of DNSSEC.
>
> Please name them so my ignorance can be enlightened. The people who
> have developed these things must have kept a very low profile
> bordering on invisibility at IETF meetings, various DNSSEC mailing
> lists and workshops. Which suggests implementation would have been
> very hard. And interoperability testing even harder.

  Good testing is always difficult in my view.  That is as it should be
however.  Reliable and stable protocols that are adequately secure
are paramount in today's ever demanding environment and becoming
demanded more and more by user communities.  The challenge
is high indeed!  We must meet that demand or those demands,
and we shall.

Regards,

---

From: Randy Bush <[email-masked]>
Date: Wed, 29 Jan 2003 19:35:19 -0800

> To: Jeff Williams <[email-masked]>

helloooo!  feeding trolls, are we?  bored?  not enough email because spam
filters are working too well?

randy

---

From: David Conrad <[email-masked]>
Date: Wed, 29 Jan 2003 17:12:21 -0800

Thanks,
-drc

---

From: Jim Reid <[email-masked]>
Date: Wed, 29 Jan 2003 17:54:07 -0800

Jeff>   Why not both Jim?

---

From: Jeff Williams <[email-masked]>
Date: Wed, 29 Jan 2003 19:00:54 -0800

Jim and all,

Jim Reid wrote:

> Opt-In?

  Why not both Jim?

> spec that would mean RFC2916bis could RECOMMEND DNSSEC (or even MUST).

RFC2916bis  is already well behind the development curve from a commercial

point of view...

Regards,

---

From: Jeff Williams <[email-masked]>
Date: Wed, 29 Jan 2003 18:29:12 -0800

Kevin and all,

  Thank you for chiming in Kevin.  My point is that not using what
is available with industry modified "Versions" is less than what
can be done as development from within the IETF and other
standards or development organizations on improving
DNSSEC continues makes little if any sense and leaves
exposures that are unnecessary and potentially damaging.

Regards,

---

From: David Conrad <[email-masked]>
Date: Wed, 29 Jan 2003 23:37:05 -0800

Randy is right.  One shouldn't feed the trolls.  I knew better, but  
still allowed myself to be slimed.

Apologies, folks.

For those that aren't aware of what "JeffreyA.  Wiliiams" is, see  
http://www.gtld-mou.org/gtld-discuss/mail-archive/08030.html

Sigh.