Subject: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt

From: Richard Shockey <[email-masked]>
Date: Mon, 30 Jun 2003 09:55:20 -0400

FYI

A useful document to keep in mind considering our ongoing discussions of 
DNSSEC.

>To: IETF-Announce: ;
>Cc: [email-masked]
>From: [email-masked]
>Reply-to: [email-masked]
>Subject: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt
>Date: Mon, 30 Jun 2003 07:37:45 -0400
>Sender: [email-masked]
>
>
>A New Internet-Draft is available from the on-line Internet-Drafts 
>directories.
>This draft is a work item of the DNS Extensions Working Group of the IETF.
>
>         Title           : Threat Analysis Of The Domain Name System
>         Author(s)       : D. Atkins, R. Austein
>         Filename        : draft-ietf-dnsext-dns-threats-03.txt
>         Pages           : 15
>         Date            : 2003-6-27
>
>Although the DNS Security Extensions (DNSSEC) have been under
>development for most of the last decade, the IETF has never written
>down the specific set of threats against which DNSSEC is designed to
>protect.  Among other drawbacks, this cart-before-the-horse situation
>has made it difficult to determine whether DNSSEC meets its design
>goals, since its design goals are not well specified.  This note
>attempts to document some of the known threats to the DNS, and, in
>doing so, attempts to measure to what extent (if any) DNSSEC is a
>useful tool in defending against these threats.
>
>A URL for this Internet-Draft is:
>http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-threats-03.txt
>
>To remove yourself from the IETF Announcement list, send a message to
>ietf-announce-request with the word unsubscribe in the body of the message.
>
>Internet-Drafts are also available by anonymous FTP. Login with the username
>"anonymous" and a password of your e-mail address. After logging in,
>type "cd internet-drafts" and then
>         "get draft-ietf-dnsext-dns-threats-03.txt".
>
>A list of Internet-Drafts directories can be found in
>http://www.ietf.org/shadow.html
>or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
>Internet-Drafts can also be obtained by e-mail.
>
>Send a message to:
>         [email-masked].
>In the body type:
>         "FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt".
>
>NOTE:   The mail server at ietf.org can return the document in
>         MIME-encoded form by using the "mpack" utility.  To use this
>         feature, insert the command "ENCODING mime" before the "FILE"
>         command.  To decode the response(s), you will need "munpack" or
>         a MIME-compliant mail reader.  Different MIME-compliant mail readers
>         exhibit different behavior, especially when dealing with
>         "multipart" MIME messages (i.e. documents which have been split
>         up into multiple messages), so check your local documentation on
>         how to manipulate these messages.
>
>
>Below is the data which will enable a MIME compliant mail reader
>implementation to automatically retrieve the ASCII version of the
>Internet-Draft.
>Content-Type: text/plain
>Content-ID:     <[email-masked]>
>
>ENCODING mime
>FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt
>
><ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dns-threats-03.txt>

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or <mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Richard Shockey <[email-masked]>
Date: Mon, 30 Jun 2003 10:37:06 -0400

At 10:23 AM 6/30/2003 -0400, McCandless, Kevin wrote:

>So, is DNSSEC within the scope of our discussions or not.  During the last
>IETF meeting I thought I heard that DNSSEC is out of scope.

Correct.. working on DNSSEC is not within our scope..

>  My opinion is
>that DNSSEC is relevant when security issues are discussed for ENUM.

You are also correct.. but this is clearly a document we need to keep in 
mind when those discussions occur from time to time.

>Kevin...
> > --

---

From: "Stastny Richard" <[email-masked]>
Date: Mon, 30 Jun 2003 17:09:06 +0200

Hi all,

I have a minor problem here:

Up to now ENUM WG was not dealing with administrative and management
issues
in ENUM, this was left to other bodies like ITU-T, ETSI and the national
ENUM fora and platforms.

If we now start dealing with:

> stuff like signing policies, key management, dealing with signed 
> and unsigned NAPTR RRsets, etc -- probably should be in the 
> scope of the WG IMO.

we are jumping head-on in the middle of these issues.

I have no problem with dealing with admin and management issues
in ENUM WG, but maybe we are getting a bit ahead of ourselves then
and have to do the basics first.

best regards
Richard

> -----Original Message-----
> From: Jim Reid [mailto:[email-masked]] 
> Sent: Monday, June 30, 2003 4:50 PM
> To: McCandless, Kevin
> Cc: 'Richard Shockey'; [email-masked]
> Subject: Re: [Enum] Fwd: I-D 
> ACTION:draft-ietf-dnsext-dns-threats-03.txt 
> 
> 
> >>>>> "Kevin" == McCandless, Kevin <[email-masked]> writes:
> 
>     Kevin> So, is DNSSEC within the scope of our discussions or not.
>     Kevin> During the last IETF meeting I thought I heard that DNSSEC
>     Kevin> is out of scope.  My opinion is that DNSSEC is relevant
>     Kevin> when security issues are discussed for ENUM.  
> 
> This subject is one of the things I intend to raise in the 
> Future Directions slot at the WG in Vienna. DNSSEC should be 
> out of scope for this WG. How the protocol works is not our 
> concern. However how DNSSEC gets applied to ENUM -- stuff 
> like signing policies, key management, dealing with signed 
> and unsigned NAPTR RRsets, etc -- probably should be in the 
> scope of the WG IMO. Let's see how others feel either on this 
> list or at the Vienna meeting.
>

---

From: Richard Shockey <[email-masked]>
Date: Mon, 30 Jun 2003 11:10:33 -0400

> > and unsigned NAPTR RRsets, etc -- probably should be in the

Well as a reminder ....the charter of this WG has those things in scope...

Working Group Revised Goals and Scope:

1. The working group will update RFC 2916 to reference the DDDS system
   (revision of RFC 2915) and advance RFC 2916 to Draft Standard.

2. The working group will examine and document various aspects of ENUM
   administrative and/or operational procedures as Informational.
   Issues to be considered include privacy and security considerations
   in storing ENUM related data as well as validation and
   authentication of data, including DDDS NAPTR records in the DNS. The
   working group will coordinate activities in these areas with the
   DNSEXT WG and PROVREG WG when appropriate.

3. The Working Group will continue to maintain appropriate contact and
   liaison with standards bodies and groups, specifically ITU-T SG2,
   in order to provide technical or educational information as needed,
   such as the appropriate use of DNS.  The Working Group will
   encourage the exchange of technical information within the
   emerging global ENUM community as well as documentation on practical
   experiences with implementations or administration of RFC 2916.

>and have to do the basics first.

Then I trust you would like to make a small presentation in Vienna on your 
views of WG next steps? :-)

---

From: "Stastny Richard" <[email-masked]>
Date: Mon, 30 Jun 2003 17:26:28 +0200

Many thanks to Rich reminding me of section 2
of our charter. There is only one issue:
the interest of the group in these topics up to now
has been from -1 to zero. So I am glad to hear that
there may be interest now.

> views of WG next steps? :-)

ok, I will try ;-)

Richard

> From: Richard Shockey [mailto:[email-masked]] 
> Sent: Monday, June 30, 2003 5:11 PM
> To: Stastny Richard; Jim Reid; McCandless, Kevin
> Cc: [email-masked]
> Subject: RE: [Enum] Fwd: I-D 
> >issues in ENUM, this was left to other bodies like ITU-T, 
> ETSI and the 
> >national ENUM fora and platforms.
> >
> > > stuff like signing policies, key management, dealing with 
> signed and 
> > > unsigned NAPTR RRsets, etc -- probably should be in the 
> scope of the 
> > > WG IMO.
> 
> 
> >I have no problem with dealing with admin and management 
> issues in ENUM 
> >WG, but maybe we are getting a bit ahead of ourselves then 
> and have to 
> >do the basics first.
> 
> 
> > > This subject is one of the things I intend to raise in the Future 
> > > Directions slot at the WG in Vienna. DNSSEC should be out 
> of scope 
> > > for this WG. How the protocol works is not our concern. 
> However how 
> > > DNSSEC gets applied to ENUM -- stuff like signing policies, key 
> > > management, dealing with signed and unsigned NAPTR RRsets, etc -- 
> > > probably should be in the scope of the WG IMO. Let's see 
> how others 
> > > feel either on this list or at the Vienna meeting.
> > >
> Richard Shockey, Senior Manager, Strategic Technology 
> Initiatives NeuStar Inc.
> Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 
> 815.333.1237 <mailto:richard(at)shockey.us> or 
<mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<