Subject: Re: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt

From: Jim Reid <[email-masked]>
Date: Wed, 02 Jul 2003 07:15:53 -0700

>>>>> "Richard" == Stastny Richard <[email-masked]> writes:

    Richard> Up to now ENUM WG was not dealing with administrative and
    Richard> management issues in ENUM, this was left to other bodies
    Richard> like ITU-T, ETSI and the national ENUM fora and
    Richard> platforms.

    Richard> If we now start dealing with:

    >> stuff like signing policies, key management, dealing with
    >> signed=20 and unsigned NAPTR RRsets, etc -- probably should be
    >> in the=20 scope of the WG IMO.

    Richard> we are jumping head-on in the middle of these issues.

No, you misunderstand what I said. Legal and policy issues surrounding
DNSSEC such as who holds a Tier-1 key, if any, are a National Matter,
if I may use ITU jargon in this forum. These are out of scope for us. 
However technical issues surrounding DNSSEC deployment for e164.arpa
are within scope. [If not this WG, who else would consider them?]
These issues would presumably include things like a BCP or
recommendations on key lengths, SIG expiry times, key rollover
procedures, etc, etc. I think the WG could/should also look at the
issues which will arise when parts of the e164.arpa tree are and
aren't signed. For instance what does it mean if 4.4.e164.arpa is
signed and 3.2.1.4.4.e164.arpa isn't (or vice versa) and what
implications this has for clients that may or may not be DNSSEC-aware?
Are there ENUM-specific considerations here which won't be addressed
by the DNSEXT WG's effort? It is these sorts of technical things that
I think this WG should look at. They fall between high-level policy
stuff which should be handled by ITU or IAB lawyers (maybe) and the
low-level DNSSEC protocol grot that goes on in DNSEXT.

And isn't there an IAB/IESG reqirement to show how security protocols
like DNSSEC apply to the protocols developed by each IETF WG?

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Patrik Fältström <[email-masked]>
Date: Wed, 2 Jul 2003 18:19:06 +0200

On onsdag, jul 2, 2003, at 16:15 Europe/Stockholm, Jim Reid wrote:

> by the DNSEXT WG's effort?

I must say this, as I have said "NO" to general DNSSEC discussions.

The _technical_ part of these questions most certainly fits within this 
wg.

But, co-chair Richard, I think you and I should discuss with our AD's 
what they think about the swap from technical to more operational 
issues discussed in this wg.

_I_ personally think they should be discussed, now that the theoretical 
part is done.

Mixing them up is bad.

    paf

---

From: Richard Shockey <[email-masked]>
Date: Wed, 02 Jul 2003 12:57:32 -0400

At 06:19 PM 7/2/2003 +0200, Patrik Fältström wrote:

>>aren't signed.

Jim could you describe for me then the operational differences/similarities 
between partial signing of the e164.arpa tree and partial signing  of the 
.com tree?  I'm sure inquiring minds at Verisign want to know.. :-)   I'm 
not sure I see the difference at all, frankly.

>>  For instance what does it mean if 4.4.e164.arpa is

well that is IMHO _the_  question.

>The _technical_ part of these questions most certainly fits within this wg.

Within limits ... I would say. ENUM is the DNS so the distinction has to be 
made between issues that are specific to 2916bis and the general DNS 
itself. As I read Jim Reid's message I have concerns about what those 
issues really are. We should not be debating general DNSEXT WG work here , 
however if we can discover specific problems that they need to address then 
certainly work on that and provide appropriate guidance to our colleagues .

I don't want DNSSEC issues to turn into the kind of religious discussions 
we see over NAT's on the general IETF  list.

>But, co-chair Richard, I think you and I should discuss with our AD's what 
>they think about the swap from technical to more operational issues 
>discussed in this wg.

Absolutely ...

>_I_ personally think they should be discussed, now that the theoretical 

The question is what are the appropriate boundaries...

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or <mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<