Subject: [RAM] DNS usage in NERD

From: RJ Atkinson <[email-masked]>
Date: Fri, 15 Jun 2007 09:52:51 -0400

Earlier, Brian Carpenter wrote:
% Also, this way you remove any security issues associated with DNS,
% and any confusion about IPv4 vs IPv6 connectivity to the servers.

The *only* way to remove potential security issues associated
with DNS is to deploy DNS Security.  Period.  We have huge
existing risks with respect to widespread non-authentication
of DNS data.  NERD doesn't appear to change those existing
risks.

The known solution for those risks is to deploy DNS Security,
which deployment apparently requires non-trivial effort
but does appear to be possible.

Yours,

Ran

_______________________________________________
RAM mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ram

---

From: Roland Dobbins <[email-masked]>
Date: Fri, 15 Jun 2007 07:35:03 -0700

On Jun 15, 2007, at 6:52 AM, RJ Atkinson wrote:

> with DNS is to deploy DNS Security.  Period.

There's hardly consensus within the operational community surrounding  
the utility of DNSSEC, if that's what you're referring to, so  
assertions of this nature aren't really supportable.

----------------------------------------------------------------------
Roland Dobbins <[email-masked]> // 408.527.6376 voice

                    Equo ne credite, Teucri.

     		          -- Laocoön

---

From: Eliot Lear <[email-masked]>
Date: Sat, 16 Jun 2007 12:47:23 +0100

Roland, Ran,

> assertions of this nature aren't really supportable.

Obviously you're both right. The way I see it, when we start to see real 
exploits we *probably* have a way to get around them, and operators 
might become more motivated to implement DNSSEC (regardless of whether 
NERD is deployed).  But in this case, I would think the risk is limited 
to that of a denial of service, because the database and updates are 
signed.  Perhaps a few words are in order in the draft?

Eliot

---

From: Roland Dobbins <[email-masked]>
Date: Sat, 16 Jun 2007 04:55:02 -0700

On Jun 16, 2007, at 4:47 AM, Eliot Lear wrote:

> The way I see it, when we start to see real exploits we *probably*  
> have a way to get around them, and operators might become more  
> motivated to implement DNSSEC (regardless of whether NERD is  
> deployed).

I don't want to waste bandwidth here on the reasons that many believe  
that DNSSEC fails to solve a series of posited non-problems, but  
suffice it to say that DNSSEC isn't universally as providing useful  
security functionality, and furthermore, some believe it introduces  
problems of its own.  For purposes of this discussion, let's  
stipulate that additional security mechanisms will probably be added  
to the DNS at some point in the future, at leave it at that.

> But in this case, I would think the risk is limited to that of a  
> denial of service, because the database and updates are signed.   
> Perhaps a few words are in order in the draft?

A more thorough analysis would be useful, but that's my initial take,  
too.

                    Equo ne credite, Teucri.

     		          -- Laocoön

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 18 Jun 2007 10:00:18 +0200

On 2007-06-15 15:52, RJ Atkinson wrote:
> with DNS is to deploy DNS Security.  

Actually, not using DNS at all is another way, which is what I
was suggesting for NERD. But security is the secondary issue;
my primary issue is that it creates a potential for a circular
dependency of routing on DNS and of DNS on routing, and I don't
want Eliot to have to fly round the world rebooting the Internet
on the day that circularity bites. I am definitely not satisfied
by Eliot's rebuttal of this circularity risk.

    Brian

---

From: Eliot Lear <[email-masked]>
Date: Mon, 18 Jun 2007 14:48:58 +0200

Brian E Carpenter wrote:
> was suggesting for NERD.
Well, it's possible to do this but IMHO not desirable.  For one thing, 
you would need some sort of distribution point to pull from, and 
everyone would have to know about it.  It's best for that to be a name 
so that the address can change, but it could just as easily be an 
address.  N.B., as discussed in the draft, this doesn't mean that you 
need to use it every time.  It might be that your neighbor can feed you 
the database or that you can pull it off of some p2p network, but if you 
can't you need some place to get it authoritatively.

> But security is the secondary issue;

You are also perfectly free to resolve the name on your system and use 
the resulting IP address.  However, if the dependencies do not make use 
of LISP or NERD there is by definition no dependency loop.

Eliot

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 18 Jun 2007 14:55:03 +0200

> of LISP or NERD there is by definition no dependency loop.

Indeed, but how can you impose a constraint that DNS zone transfers
etc do not in any way depend on NERD/LISP? That is where I am
puzzled.

    Brian

---

From: Robin Whittle <[email-masked]>
Date: Mon, 18 Jun 2007 23:30:32 +1000

> etc do not in any way depend on NERD/LISP? That is where I am

Wouldn't it be good enough that LISP/Ivip or whatever states in
its architectural RFC that addresses which depend on this
mapping scheme should not be used for certain purposes, including?:

1 - BGP routers, including ITRs and ETRs - obviously.

2 - Root and TLD nameservers.  Probably many second level
    nameservers such as .com.au. too.  Probably including
    any nameserver which does something under in-addr.arpa
    on which anyone else's but the operator's addresses
    depend upon for reverse mapping.

3 - Any nameserver on which the mapping scheme depends.

4 - Whatever central database servers control the mapping
    system, including interfaces for user control of mapping
    of their IP addresses, servers for all push and pull update
    activities and any independent systems which monitor
    where a mobile host is connecting, and automatically
    initiate changes to the mapping database if the mobile
    host's current link fails.

Then all the critical nameservers have ordinary BGP-accessible
addresses, so their zone transfers go via ordinary BGP,
irrespective of what the mapping system does.

 - Robin