Subject: Re: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt

From: Patrik Fältström <[email-masked]>
Date: Tue, 1 Jul 2003 08:28:40 +0200

On måndag, jun 30, 2003, at 16:23 Europe/Stockholm, McCandless, Kevin  
wrote:

> So, is DNSSEC within the scope of our discussions or not.  During the  
> last IETF meeting I thought I heard that DNSSEC is out of scope.  My  
> opinion is that DNSSEC is relevant when security issues are discussed  
> for ENUM.

I think I argued against DNSSEC, and I will still do it.

Reasons are:

   - This wg is _not_ where DNSSEC specification is discussed,
     this wg is using the DNS protocol
   - DNSSEC development is behind ENUM, which means we can not
     have a mandatory to implement DNSSEC, as DNSSEC doesn't
     exists (or rather, doesn't work as specified)

If we talk too much about DNSSEC, I am extremely nervous we dive into  
trying to solve all problems with DNSSEC the DNS wg's are working with.

That said, YES, it is _extremely_important_ we get some way of  
verifying DNS records we get back when querying the DNS. Both for ENUM  
and other applications.

I take for granted _all_ users of DNS will start using DNSSEC as soon  
as it is possible.

ENUM is not an exception.

      paf

>
> Kevin...
>
>> -----Original Message-----
>> From: Richard Shockey [mailto:[email-masked]]
>> Sent: Monday, June 30, 2003 8:55 AM
>> To: [email-masked]
>> Subject: [Enum] Fwd: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt
>>
>>
>>
>> FYI
>>
>>
>> A useful document to keep in mind considering our ongoing
>> discussions of
>> DNSSEC.
>>
>>> To: IETF-Announce: ;
>>> Cc: [email-masked]
>>> From: [email-masked]
>>> Reply-to: [email-masked]
>>> Subject: I-D ACTION:draft-ietf-dnsext-dns-threats-03.txt
>>> Date: Mon, 30 Jun 2003 07:37:45 -0400
>>> Sender: [email-masked]
>>>
>>>
>>> A New Internet-Draft is available from the on-line Internet-Drafts
>>> directories.
>>> This draft is a work item of the DNS Extensions Working
>> Group of the IETF.
>>>
>>>         Title           : Threat Analysis Of The Domain Name System
>>>         Author(s)       : D. Atkins, R. Austein
>>>         Filename        : draft-ietf-dnsext-dns-threats-03.txt
>>>         Pages           : 15
>>>         Date            : 2003-6-27
>>>
>>> Although the DNS Security Extensions (DNSSEC) have been under
>>> development for most of the last decade, the IETF has never written
>>> down the specific set of threats against which DNSSEC is designed to
>>> protect.  Among other drawbacks, this cart-before-the-horse situation
>>> has made it difficult to determine whether DNSSEC meets its design
>>> goals, since its design goals are not well specified.  This note
>>> attempts to document some of the known threats to the DNS, and, in
>>> doing so, attempts to measure to what extent (if any) DNSSEC is a
>>> useful tool in defending against these threats.
>>>
>>> A URL for this Internet-Draft is:
>>> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dns-thr
> eats-03.txt
>>
>> To remove yourself from the IETF Announcement list, send a message to
>> ietf-announce-request with the word unsubscribe in the body of the  
>> message.
>>
>> Internet-Drafts are also available by anonymous FTP. Login with the  
>> username
>> "anonymous" and a password of your e-mail address. After logging in,
>> type "cd internet-drafts" and then
>>         "get draft-ietf-dnsext-dns-threats-03.txt".
>>
>> A list of Internet-Drafts directories can be found in
>> http://www.ietf.org/shadow.html
>> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>>
>>
>> Internet-Drafts can also be obtained by e-mail.
>>
>> Send a message to:
>>         [email-masked].
>> In the body type:
>>         "FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt".
>>
>> NOTE:   The mail server at ietf.org can return the document in
>>         MIME-encoded form by using the "mpack" utility.  To use this
>>         feature, insert the command "ENCODING mime" before the "FILE"
>>         command.  To decode the response(s), you will need "munpack"  
>> or
>>         a MIME-compliant mail reader.  Different MIME-compliant mail  
>> readers
>>         exhibit different behavior, especially when dealing with
>>         "multipart" MIME messages (i.e. documents which have been  
>> split
>>         up into multiple messages), so check your local documentation  
>> on
>>         how to manipulate these messages.
>>
>>
>> Below is the data which will enable a MIME compliant mail reader
>> implementation to automatically retrieve the ASCII version of the
>> Internet-Draft.
>> Content-Type: text/plain
>> Content-ID:     <[email-masked]>
>>
>> ENCODING mime
>> FILE /internet-drafts/draft-ietf-dnsext-dns-threats-03.txt
>>
>> <ftp://ftp.ietf.org/internet-drafts/draft-ietf-dnsext-dns-threats- 
>> 03.txt>
>
>
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> Richard Shockey, Senior Manager, Strategic Technology Initiatives
> NeuStar Inc.
> 46000 Center Oak Plaza  -   Sterling, VA  20166
> Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
> <mailto:richard(at)shockey.us> or  
> <mailto:richard.shockey(at)neustar.biz>
>   <http://www.neustar.biz> ; <http://www.enum.org>
> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
>
>
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
>
> _______________________________________________
> enum mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/enum
>

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Jeff Williams <[email-masked]>
Date: Tue, 01 Jul 2003 02:12:33 -0700

Patrik and all,

  Unless I am missing something here Patrik your argument seems
to be circular below.????

> >   <http://www.neustar.biz> ; <http://www.enum.org>

Regards,

--
Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 131k members/stakeholders strong!)
"Be precise in the use of words and expect precision from others" -
    Pierre Abelard
===============================================================
CEO/DIR. Internet Network Eng. SR. Eng. Network data security
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 214-244-3801