Subject: RE: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt

From: "Stastny Richard" <[email-masked]>
Date: Tue, 1 Jul 2003 08:38:37 +0200

I fully agree with Patrik.

IMHO dnssec should come up with a solution workable for all existing
DNS applications and ENUM is one of them.

So it is up to dnsext to solve the problem and enum WG may help if 
required (requested).

Richard

> -----Original Message-----
> From: Patrik Fältström [mailto:[email-masked]] 
> Sent: Tuesday, July 01, 2003 8:29 AM
> To: McCandless, Kevin
> Cc: 'Richard Shockey'; [email-masked]
> Subject: Re: [Enum] Fwd: I-D 
> ACTION:draft-ietf-dnsext-dns-threats-03.txt
> 
> 
> On måndag, jun 30, 2003, at 16:23 Europe/Stockholm, 
> McCandless, Kevin  
> wrote:
> 
> > So, is DNSSEC within the scope of our discussions or not.  
> During the
> > last IETF meeting I thought I heard that DNSSEC is out of 
> scope.  My  
> > opinion is that DNSSEC is relevant when security issues are 
> discussed  
> > for ENUM.
> 
> I think I argued against DNSSEC, and I will still do it.
> 
> Reasons are:
> 
>    - This wg is _not_ where DNSSEC specification is discussed,
>      this wg is using the DNS protocol
>    - DNSSEC development is behind ENUM, which means we can not
>      have a mandatory to implement DNSSEC, as DNSSEC doesn't
>      exists (or rather, doesn't work as specified)
> 
> If we talk too much about DNSSEC, I am extremely nervous we 
> dive into  
> trying to solve all problems with DNSSEC the DNS wg's are 
> working with.
> 
> That said, YES, it is _extremely_important_ we get some way of  
> verifying DNS records we get back when querying the DNS. Both 
> for ENUM  
> and other applications.
> 
> I take for granted _all_ users of DNS will start using DNSSEC 
> as soon  
> as it is possible.
> 
> ENUM is not an exception.
> 
>       paf
> 
> 
> >
> > Kevin...
> >
> >> -----Original Message-----
> >> From: Richard Shockey [mailto:[email-masked]]
> >> Sent: Monday, June 30, 2003 8:55 AM
> >> To: [email-masked]
> >> Subject: [Enum] Fwd: I-D 
> ACTION:draft-ietf-dnsext-dns-threats-03.txt
> >>
> >>
> >>
> >> FYI
> >>
> >>
> >> A useful document to keep in mind considering our ongoing 
> discussions 
> >> of DNSSEC.
> >>
> >>> To: IETF-Announce: ;
> >>> Cc: [email-masked]
> >>> From: [email-masked]
> >>> Reply-to: [email-masked]
> >>> Subject: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt
> >>> Date: Mon, 30 Jun 2003 07:37:45 -0400
> >>> Sender: [email-masked]
> >>>
> >>>
> >>> A New Internet-Draft is available from the on-line 
> Internet-Drafts 
> >>> directories. This draft is a work item of the DNS 
> Extensions Working
> >> Group of the IETF.
> >>>
> >>>         Title           : Threat Analysis Of The Domain 
> Name System
> >>>         Author(s)       : D. Atkins, R. Austein
> >>>         Filename        : draft-ietf-dnsext-dns-threats-03.txt
> >>>         Pages           : 15
> >>>         Date            : 2003-6-27
> >>>
> >>> Although the DNS Security Extensions (DNSSEC) have been under 
> >>> development for most of the last decade, the IETF has 
> never written 
> >>> down the specific set of threats against which DNSSEC is 
> designed to 
> >>> protect.  Among other drawbacks, this cart-before-the-horse 
> >>> situation has made it difficult to determine whether DNSSEC meets 
> >>> its design goals, since its design goals are not well specified.  
> >>> This note attempts to document some of the known threats 
> to the DNS, 
> >>> and, in doing so, attempts to measure to what extent (if 
> any) DNSSEC 
> >>> is a useful tool in defending against these threats.
> >>>
> >>> A URL for this Internet-Draft is: 
> >>> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-thr
> > eats-03.txt
> >>
> >> To remove yourself from the IETF Announcement list, send a 
> message to 
> >> ietf-announce-request with the word unsubscribe in the body of the
> >> message.
> >>
> >> Internet-Drafts are also available by anonymous FTP. Login with the
> >> username
> >> "anonymous" and a password of your e-mail address. After 
> logging in,
> >> type "cd internet-drafts" and then
> >>         "get draft-ietf-dnsext-dns-threats-03.txt".
> >>
> >> A list of Internet-Drafts directories can be found in 
> >> http://www.ietf.org/shadow.html or 
> >> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> >>
> >>
> >> Internet-Drafts can also be obtained by e-mail.
> >>
> >> Send a message to:
> >>         [email-masked].
> >> In the body type:
> >>         "FILE 
> /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt".
> >>
> >> NOTE:   The mail server at ietf.org can return the document in
> >>         MIME-encoded form by using the "mpack" utility.  
> To use this
> >>         feature, insert the command "ENCODING mime" before 
> the "FILE"
> >>         command.  To decode the response(s), you will need 
> "munpack"
> >> or
> >>         a MIME-compliant mail reader.  Different 
> MIME-compliant mail  
> >> readers
> >>         exhibit different behavior, especially when dealing with
> >>         "multipart" MIME messages (i.e. documents which have been  
> >> split
> >>         up into multiple messages), so check your local 
> documentation  
> >> on
> >>         how to manipulate these messages.
> >>
> >>
> >> Below is the data which will enable a MIME compliant mail reader 
> >> implementation to automatically retrieve the ASCII version of the 
> >> Internet-Draft.
> >> Content-Type: text/plain
> >> Content-ID:     <[email-masked]>
> >>
> >> ENCODING mime
> >> FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt
> >>
> >> <ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dns-threats-
> >> 03.txt>
> >
> >
> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> > Richard Shockey, Senior Manager, Strategic Technology Initiatives 
> > NeuStar Inc.
> > 46000 Center Oak Plaza  -   Sterling, VA  20166
> > Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237 
> > <mailto:richard(at)shockey.us> or
> > <mailto:richard.shockey(at)neustar.biz>
> >   <http://www.neustar.biz> ; <http://www.enum.org>
> > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> >
> >
> > _______________________________________________
> > enum mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/enum
> >
> > _______________________________________________
> > enum mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/enum
> >
> 
> 
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
> 

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jeff Williams <[email-masked]>
Date: Tue, 01 Jul 2003 02:35:55 -0700

Richard and all,

  I did not gather from Patrik's comments/argument the conclusion
you seem to have Richard.

  However I agree that the DNSSEC WG needs to get busy
and work on a solution that is workable for ENUM.  This would
of course show clearly that DNSSEC and any final call on ENUM
are irrevocably linked...  Ergo "In scope"...

> > >   <http://www.neustar.biz> ; <http://www.enum.org>

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 131k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard
===============================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801