Subject: RE: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt

From: "Stastny Richard" <[email-masked]>
Date: Tue, 1 Jul 2003 10:26:46 +0200

I completely disagree to

>This would 
> of course show clearly that DNSSEC and any final call on ENUM 
> are irrevocably linked...  Ergo "In scope"...

This would mean that any final call of an RFC is irrevocably linked to
all other potential RFCs having a problem and also to world hunger to be solved.

Richard

> -----Original Message-----
> From: Jeff Williams [mailto:[email-masked]] 
> Sent: Tuesday, July 01, 2003 11:36 AM
> To: Stastny Richard
> Cc: Patrik Fältström; McCandless, Kevin; Richard Shockey; 
> [email-masked]
> Subject: Re: [Enum] Fwd: I-D 
> ACTION:draft-ietf-dnsext-dns-threats-03.txt
> 
> 
> Richard and all,
> 
>   I did not gather from Patrik's comments/argument the 
> conclusion you seem to have Richard.
> 
>   However I agree that the DNSSEC WG needs to get busy
> and work on a solution that is workable for ENUM.  This would 
> of course show clearly that DNSSEC and any final call on ENUM 
> are irrevocably linked...  Ergo "In scope"...
> 
> Stastny Richard wrote:
> 
> > I fully agree with Patrik.
> >
> > IMHO dnssec should come up with a solution workable for all 
> existing 
> > DNS applications and ENUM is one of them.
> >
> > So it is up to dnsext to solve the problem and enum WG may help if 
> > required (requested).
> >
> > Richard
> >
> > > -----Original Message-----
> > > From: Patrik Fältström [mailto:[email-masked]]
> > > Sent: Tuesday, July 01, 2003 8:29 AM
> > > To: McCandless, Kevin
> > > Cc: 'Richard Shockey'; [email-masked]
> > > Subject: Re: [Enum] Fwd: I-D 
> > > ACTION:draft-ietf-dnsext-dns-threats-03.txt
> > >
> > >
> > > On måndag, jun 30, 2003, at 16:23 Europe/Stockholm, McCandless, 
> > > Kevin
> > > wrote:
> > >
> > > > So, is DNSSEC within the scope of our discussions or not.
> > > During the
> > > > last IETF meeting I thought I heard that DNSSEC is out of
> > > scope.  My
> > > > opinion is that DNSSEC is relevant when security issues are
> > > discussed
> > > > for ENUM.
> > >
> > > I think I argued against DNSSEC, and I will still do it.
> > >
> > > Reasons are:
> > >
> > >    - This wg is _not_ where DNSSEC specification is discussed,
> > >      this wg is using the DNS protocol
> > >    - DNSSEC development is behind ENUM, which means we can not
> > >      have a mandatory to implement DNSSEC, as DNSSEC doesn't
> > >      exists (or rather, doesn't work as specified)
> > >
> > > If we talk too much about DNSSEC, I am extremely nervous we dive 
> > > into trying to solve all problems with DNSSEC the DNS wg's are
> > > working with.
> > >
> > > That said, YES, it is _extremely_important_ we get some way of 
> > > verifying DNS records we get back when querying the DNS. Both for 
> > > ENUM and other applications.
> > >
> > > I take for granted _all_ users of DNS will start using DNSSEC as 
> > > soon as it is possible.
> > >
> > > ENUM is not an exception.
> > >
> > >       paf
> > >
> > >
> > > >
> > > > Kevin...
> > > >
> > > >> -----Original Message-----
> > > >> From: Richard Shockey [mailto:[email-masked]]
> > > >> Sent: Monday, June 30, 2003 8:55 AM
> > > >> To: [email-masked]
> > > >> Subject: [Enum] Fwd: I-D
> > > ACTION:draft-ietf-dnsext-dns-threats-03.txt
> > > >>
> > > >>
> > > >>
> > > >> FYI
> > > >>
> > > >>
> > > >> A useful document to keep in mind considering our ongoing
> > > discussions
> > > >> of DNSSEC.
> > > >>
> > > >>> To: IETF-Announce: ;
> > > >>> Cc: [email-masked]
> > > >>> From: [email-masked]
> > > >>> Reply-to: [email-masked]
> > > >>> Subject: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt
> > > >>> Date: Mon, 30 Jun 2003 07:37:45 -0400
> > > >>> Sender: [email-masked]
> > > >>>
> > > >>>
> > > >>> A New Internet-Draft is available from the on-line
> > > Internet-Drafts
> > > >>> directories. This draft is a work item of the DNS
> > > Extensions Working
> > > >> Group of the IETF.
> > > >>>
> > > >>>         Title           : Threat Analysis Of The Domain
> > > Name System
> > > >>>         Author(s)       : D. Atkins, R. Austein
> > > >>>         Filename        : draft-ietf-dnsext-dns-threats-03.txt
> > > >>>         Pages           : 15
> > > >>>         Date            : 2003-6-27
> > > >>>
> > > >>> Although the DNS Security Extensions (DNSSEC) have been under 
> > > >>> development for most of the last decade, the IETF has
> > > never written
> > > >>> down the specific set of threats against which DNSSEC is
> > > designed to
> > > >>> protect.  Among other drawbacks, this cart-before-the-horse 
> > > >>> situation has made it difficult to determine whether DNSSEC 
> > > >>> meets its design goals, since its design goals are not well 
> > > >>> specified. This note attempts to document some of the known 
> > > >>> threats
> > > to the DNS,
> > > >>> and, in doing so, attempts to measure to what extent (if
> > > any) DNSSEC
> > > >>> is a useful tool in defending against these threats.
> > > >>>
> > > >>> A URL for this Internet-Draft is: 
> > > >>> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-thr
> > > > eats-03.txt
> > > >>
> > > >> To remove yourself from the IETF Announcement list, send a
> > > message to
> > > >> ietf-announce-request with the word unsubscribe in the body of 
> > > >> the message.
> > > >>
> > > >> Internet-Drafts are also available by anonymous FTP. 
> Login with 
> > > >> the username "anonymous" and a password of your e-mail 
> address. 
> > > >> After
> > > logging in,
> > > >> type "cd internet-drafts" and then
> > > >>         "get draft-ietf-dnsext-dns-threats-03.txt".
> > > >>
> > > >> A list of Internet-Drafts directories can be found in 
> > > >> http://www.ietf.org/shadow.html or 
> > > >> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> > > >>
> > > >>
> > > >> Internet-Drafts can also be obtained by e-mail.
> > > >>
> > > >> Send a message to:
> > > >>         [email-masked].
> > > >> In the body type:
> > > >>         "FILE
> > > /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt".
> > > >>
> > > >> NOTE:   The mail server at ietf.org can return the document in
> > > >>         MIME-encoded form by using the "mpack" utility.
> > > To use this
> > > >>         feature, insert the command "ENCODING mime" before
> > > the "FILE"
> > > >>         command.  To decode the response(s), you will need
> > > "munpack"
> > > >> or
> > > >>         a MIME-compliant mail reader.  Different
> > > MIME-compliant mail
> > > >> readers
> > > >>         exhibit different behavior, especially when 
> dealing with
> > > >>         "multipart" MIME messages (i.e. documents 
> which have been 
> > > >> split
> > > >>         up into multiple messages), so check your local
> > > documentation
> > > >> on
> > > >>         how to manipulate these messages.
> > > >>
> > > >>
> > > >> Below is the data which will enable a MIME compliant 
> mail reader 
> > > >> implementation to automatically retrieve the ASCII 
> version of the 
> > > >> Internet-Draft.
> > > >> Content-Type: text/plain
> > > >> Content-ID:     <[email-masked]>
> > > >>
> > > >> ENCODING mime
> > > >> FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt
> > > >>
> > > >> 
> <ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dns-thre
ats
> > >> -
> > >> 03.txt>
> > >
> > >
> > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> > > Richard Shockey, Senior Manager, Strategic Technology Initiatives 
> > > NeuStar Inc.
> > > 46000 Center Oak Plaza  -   Sterling, VA  20166
> > > Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 
> > > 815.333.1237 <mailto:richard(at)shockey.us> or 
> > > <mailto:richard.shockey(at)neustar.biz>
> > >   <http://www.neustar.biz> ; <http://www.enum.org> 
> > > <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> > >
> > >
> > > _______________________________________________
> > > enum mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/enum
> > >
> > > _______________________________________________
> > > enum mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/enum
> > >
> >
> >
> > _______________________________________________
> > enum mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/enum
> >
>
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 131k members/stakeholders strong!) "Be precise in the use of words and expect precision from others" -
    Pierre Abelard ===============================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security Information Network Eng. Group. INEG. INC. E-Mail [email-masked] Contact Number: 214-244-4827 or 214-244-3801

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Conroy, Lawrence (SMTP)" <[email-masked]>
Date: Tue, 1 Jul 2003 10:45:24 +0100

>all other potential RFCs having a problem and also to world hunger 

Hi Folks,
   Solving world hunger might be quicker.
The trite answer is that, given that there are trials are registrations
already, ENUM certainly does work without DNSSEC implementation, so it
isn't dependent on a fully implemented DNSSEC infrastructure.

The reasonable answer (looking at our charter) is that, when there's
a view of the implications of DNSSEC ->roll-out<- on the ENUM system,
it is a perfectly valid thing to discuss these implications on the
way that ENUM is used.

Note that these discussions would cover the technical impacts.

It need NOT cover the Administration/Social issues like who signs
what and who is allowed to sign what, under whose authority, who is
responsible for all this, and what is the legal framework, all of
which IMHO we can safely leave to the experts :).

Seems to me we have a wild agreement going on in this thread.

all the best,
   Lawrence
-- 
-----------------------------------------------------------------------
Roke Manor Research    : This information is provided "as is" and is not
<mailto:[email-masked]>: intended to create any contractual or legal
<tel:+441794833666>    : relationship.

---

From: Jeff Williams <[email-masked]>
Date: Tue, 01 Jul 2003 21:02:34 -0700

Richard and all,

  I understood that you disagreed already Richard.  However I think
your arguments, most especially the brief one below making a
outrageous comparison to world hunger is very much divisive
rather than constructive.  DNSSEC is definitely "IN Scope"
and linked to ENUM as has already been made apparent...

Regards,
--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 131k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard
===============================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801

---

From: Jim Reid <[email-masked]>
Date: Tue, 01 Jul 2003 09:40:35 -0700

>>>>> "Lawrence" == Conroy, Lawrence (SMTP) <[email-masked]> writes:

    Lawrence> The reasonable answer (looking at our charter) is that,
    Lawrence> when there's a view of the implications of DNSSEC
    Lawrence> ->roll-out<- on the ENUM system, it is a perfectly valid
    Lawrence> thing to discuss these implications on the way that ENUM
    Lawrence> is used.

Indeed. That's precisely what I had in mind for this WG. Who else
could and would tackle the DNSSEC issues that would be relevant to how
ENUM is (likely to be) used?

    Lawrence> It need NOT cover the Administration/Social issues like
    Lawrence> who signs what and who is allowed to sign what, under
    Lawrence> whose authority, who is responsible for all this, and
    Lawrence> what is the legal framework, all of which IMHO we can
    Lawrence> safely leave to the experts :).

Yup. This should be out of scope for us too.

    Lawrence> Seems to me we have a wild agreement going on in this
    Lawrence> thread.

Well the two of us are in wild agreement at any rate... :-)