Subject: AW: [Enum] I-D ACTION:draft-ietf-enum-epp-e164-03.txt

From: "Stastny Richard" <[email-masked]>
Date: Fri, 9 Apr 2004 22:10:19 +0200

UGF0cmlrIHdyb3RlOg0KIA0KPlNvLCBUaWVyLTIgaXMgZnJvbSB5b3VyIHBvaW50IG9mIHZpZXcgdGhlIG9yZ2FuaXNhdGlvbiB3aGljaCBjYW4gYXNrDQo+dGhlIHRpZXIgMSBmb3IgdGhlIGRlbGVnYXRpb24sIHJlZ2FyZGxlc3Mgb2YgZnJvbSB3aGVyZSBhbmQgdG8gd2hlcmUNCj50aGUgRE5TIGlzIGRlbGVnYXRlZD8NCg0KPlRoYXQgbWFrZXMgc2Vuc2UgdG8gbWUuDQoNClNvcnJ5IHRvIGludGVycnVwdDogbm90IGV4YWN0bHkNCg0KaW4gdGhlIFRpZXIgZGVmaW5pdGlvbiBvZiBFVFNJIHRoZSBUaWVycw0KYmVsb25nIG1haW5seSB0byB0aGUgbmFtZXNlcnZlci4gUmVxdWVzdGluZyBkZWxlZ2F0aW9ucyBhcmUgdGhlDQpSZWdpc3RyYXJzIGFuZCB0aGV5IGFyZSBvdXRzaWRlIG9mIHRoZSBUaWVyIGRlZmluaXRpb24sIGJ1dA0KYmVjYXVzZSBpbiBkcmF3aW5ncyB0aGV5IGFyZSBhbHdheXMgb24gdGhlIFRpZXIgMiBsYXllciwNCmV2ZXJib2R5IGFzc3VtZXMgKGFuZCByaGlzIGlzIG5vdCBmYXIgb2ZmIGFueXdheSkgdGhhdA0KdGhlIHJlZ2lzdHJhcnMgYXJlIG9uIHRpZXIgMi4gTWF5YmUgeW91IGFzayBKb2FraW0sIGhlDQppcyBleHBlcnQgaW4gZXBsYWluaW5nIHN1Y2ggdGhpbmdzIDstKQ0KDQpSaWNoYXJkDQoNCg0KDQo=_______________________________________________enum mailing [email-masked]://www1.ietf.org/mailman/listinfo/enum

---

From: Jaap Akkerhuis <[email-masked]>
Date: Fri, 09 Apr 2004 23:09:20 +0200

Sorry to interrupt: not exactly
    
Sorry to interrupt as well but ...
    
    in the Tier definition of ETSI the Tiers
    belong mainly to the nameserver. Requesting delegations are the
    Registrars and they are outside of the Tier definition, but
    because in drawings they are always on the Tier 2 layer,
    everbody assumes (and rhis is not far off anyway) that
    the registrars are on tier 2. Maybe you ask Joakim, he
    is expert in eplaining such things ;-)

... maybe it is time to have a formal definition of the Tier #
terminology. I have the faint feeling that there are quite different
views on what is actually meant with the term.

	jaap

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: Patrik Fältström <[email-masked]>
Date: Sat, 10 Apr 2004 07:44:30 +0200

On Apr 9, 2004, at 22:10, Stastny Richard wrote:

>> So, Tier-2 is from your point of view the organisation which can ask
>> the tier 1 for the delegation, regardless of from where and to where
>> the DNS is delegated?
>
>> That makes sense to me.
>

:-)

I have talked with him (and many others) about this Tier thing, which I 
*never* have understood. :-)

It seems to be it is unclear for more people than me...

I.e. it is impossible to talk about organisations at layers if you 
don't have strict relationships between them, so it is possible to talk 
about the layers themselves.

Take the situation where we have a registry/registrar model for the DNS 
management, a separate ENUM approval process, a registrant which want 
his E.164 number published...

In Sweden and this model, you would have

(1) the organisation running the DNS server(s) for the 6.4.e164.arpa. 
With this, I mean the DNS servers the queries go to.

(2) the organisation creating the zone for 6.4.e164.arpa and making it 
available for the ones running the DNS servers. The zone in Sweden only 
include NS records for full E.164 numbers EXCEPT in the relatively rare 
cases enterprises have blocks of numbers and request a delegation for 
the whole block.

(3) the organisations which approve the deleation in 6.4.e164.arpa.

(4) the organisation/registrar which the end user go to when he want 
his number delegated.

(5) the organisation the DNS is delegated to from DNS servers run by (1)

(6) the organisation running the mail service one of the NAPTR point at

(7) the organisation running the SIP service one of the NAPTR point at

(8) the organisation running the gateway between PSTN and SIP which 
might be used by the end user

etc etc

People use the term "tier 2 provider" as if it is one of the above, and 
I have never understood what.

Is what you are saying that some of the above is "on tier 1" and some 
other "on tier 2"? That "Tier 1" is an adjective? In that case, I can 
suggest 1-2 be tier 1, and 5-8 be tier 2. But, what about 3-4?

My conclusion the last 3 years or so when talking with Joakim et.al. is 
that I don't see any need for Tier definitions as one have to define 
the explicit organisations (like above) anyway to get a working system. 
Using the term "Tier-1 provider" which I have heard many times seems to 
make take for granted for example 1 and 2 above is run by the same 
organisation. Same for 3 and 4 etc. That is a limiting factor in some 
cases.

Question: Do we in the IETF need a definition of these terms as people 
use them all the time, or should we just ignore it and continue to have 
people like me which are confused? I propose the latter.

      paf

---

From: Michael Haberler <[email-masked]>
Date: Sat, 10 Apr 2004 12:39:50 +0200

At 07:44 10.04.2004, Patrik Fältström wrote:

The discussion originated in protocol support for ENUM operations and 
drifted into a discussion of layers or organisations involved. However, we 
can discuss things also in terms of your list of organisations (which I 
would relabel as roles for generality, because roles might need to map to 
organisations as needed; see an example below for (3), the "validation 
agency").

>management, a separate ENUM approval process, a registrant which want his 
>E.164 number published...
>
>(1) the organisation running the DNS server(s) for the 6.4.e164.arpa. With 
>this, I mean the DNS servers the queries go to.
>
>cases enterprises have blocks of numbers and request a delegation for the 
>whole block.

This function needs a protocol to interact with (4), and "domain" EPP 
covers it mostly.

It needs to furnish the zone to (1) - that's standard procedure.

>(3) the organisations which approve the deleation in 6.4.e164.arpa.

We found out that this role is needed, but it should be a competitive 
function, not a single organisation, fulfilled by SP's as they see fit 
within  a framework of validation requirements. It can be different even on 
a number range basis. For instance we agreed in Austria that an SMS from a 
handset is good enough to validate number ownership. So in that case that 
role can be subsumed by (4). In the case of ENUM-driven number ranges, 
there is no tracking of ENUM domain to number ownership, so the validation 
is simple - (4) needs to collect social data, allocate the number and 
assert that the data is valid. For existing fixed network numbers a more 
cumbersome external validation might be required (e.g. prove by faxing a 
phone bill); or in the case of an enlightened telco which is the number 
range holder and provides ENUM role (4) functions they can validate by 
looking at their existing subscriber data.

Whatever the method, the fact of validation will be carried by a signed 
token which is passed through the (4)/(2) interface along with the 
delegation request, and stored in the database of (2). We might need to 
extend (4)/(2) EPP to carry such tokens. Our model is that (4) "pushes" the 
validity assertion to (2) along with the delegation request, and might need 
to update it periodically before expiry.

That introduces an additional function of (2), which is the validation of 
tokens by cryptographic means. Only delegations with valid tokens will 
cause a zone entry in *.e164.arpa. The authenticity of a validation entity 
is established by it subscribing to the validation framework  principles 
and assigning it a key to generate valid tokens.

In terms of protocol support, fetching a validation token could be either a 
function internal to (4) or it might require an interaction between (3) and 
(4). We havent set a protocol for that yet but SOAP might suffice.

Splitting up that organisation into roles of different players does not 
exclude the single validation entity approach in some national 
implementation - it's just a special case.

>(4) the organisation/registrar which the end user go to when he want his 
>number delegated.
>

that's where the "remote NAPTR management" protocol between user and (5) 
comes in, along the lines of the T-Systems work. In Scott's proposal this 
function is folded into the (4)/(2) interface which I think is the wrong 
place except if (5) equals (2). It is completely unrelated to delegation 
and validity issues.

>(8) the organisation running the gateway between PSTN and SIP which might 
>be used by the end user

6..7 are anonymous DNS users. For 6..8 I dont see the necessity for 
protocol support between roles beyond DNS lookup.

look, Paf - no tiers ;)

-Michael