Subject: Re: Q: Is authenticated denial needed ??

From: [email-masked] (Ted Lindgreen)
Date: Wed, 28 Feb 2001 10:05:24 +0100

[Quoting Olafur Gudmundsson, on Feb 27, 18:24, in "Q: Is authenticated  ..."]

> The working group needs to answer some hard questions, and I
> would like them to be discussed before we start rewriting RFC2535.

Before going into these questions, I am interested to know wether
I have missed that there was consensus to abort the current effort
to implement RFC2535?

As it stands now, ISC/Nominum has spent and is still spending
considerable effort into implementing RFC2535 into BIND, and
NLnet Labs (for CENTR) into building an automated TLD registry.

Currently, there is a working set of tools, which is in use for the
secure test-ccTLD .nl.nl. These tools were developed and (worked more
or less) with Bind8.2.2p5 and are now in "test-production" with 
the current Bind9 release.

If we were mistaken to put effort into implementing RFC2535, it
would have been a rather costly mistake, as some man-years of work
have been wasted then.

So again my question:

  Is there consensus to abort the implementation of RFC2535
  and wait for a rewrite to defined?

Regards,
-- Ted.

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Olafur Gudmundsson <[email-masked]>
Date: Wed, 28 Feb 2001 11:01:44 -0500 (EST)

> I have missed that there was consensus to abort the current effort

No that is not what is happening, the plan is to rewrite RFC2535 to
reflect all the update RFC's that have been issued (or are in the IESG
queue). 

> NLnet Labs (for CENTR) into building an automated TLD registry.

Most of the changes/updates to RFC2535 have come from that effort. 
The overall goal is to make RFC2535 more readable, implementable and
testable.

> the current Bind9 release.

We hope that the experiance from these will help the update effort 
and will feed into the operational guidelines documents replacing RFC2541.

> would have been a rather costly mistake, as some man-years of work

IF that is the conclusion it is better to come to that conclusion now than
3-5 years down the road when 10x-100x more man years have been wasted in 
operating DNSSEC. But I do not think that is going to happen. 
The goal is to make DNSSEC more deployable. 

>   and wait for a rewrite to defined?

The question on the table is about one aspect of DNSSEC the authenticated
denial, it is the most costly part of the specification and the one with
least benefit. The question is it worth the cost, and if so we better
document why. 

There is strong opposition to deploying NXT from many camps. 
The questions that I asked where is there need for authenticated denial 
and if there is need is NO so much better that we should switch. 

One proposal that I have got privatly is to make both NXT and NO
experimental and see which one gets deployed and then move that one into
the standards track. 

	Olafur

---

From: Paul A Vixie <[email-masked]>
Date: Wed, 28 Feb 2001 09:49:31 -0800

> and if there is need is NO so much better that we should switch. 

NO looks different but not necessarily better.  The only people I'd trust to
give an answer are actual engineers and engineering managers who have
implemented NXT (operably but not nec'ily interoperabily) and read the draft
for NO.  If those conditions can't be satisfied, then we're just shooting into
the darkness with this whole discussion.

> experimental and see which one gets deployed and then move that one into

Please, gods, no.  That was tried (by omission) with DSA vs RSA, with the
result that the IESG flipflopped on the matter twice, upsetting a lot of
plans each time.  Is DNSSEC a complete architecture?  If not, then let's
abandon implementation attempts until it is.  To be considered complete,
such an architecture must specify whether authentic NXDOMAIN is a
requirement, and if so, precisely how it is to be implemented
(interoperably -- the Internet is not a collection of sandboxes any more).