Subject: Re: I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt

From: Miek Gieben <[email-masked]>
Date: Wed, 04 Jul 2001 05:15:43 -0700

[On 03 Jul, 2001, Scott Rose wrote in " I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt "]
> 
>  If the group decides to use a bit to determine the opt-in status (I haven't
> decided if I like the idea or not - right now I'm leaning towards "not" but
> don't have a better solution yet) - let's pick an unused number to avoid any
which zones are going to use opt-in? .com and .net? Can't we just say
that we will never do DNSSEC on .com/.net and friends. If you want to
be secure get your secure domainname under .secure?

grtz Miek
NLnet Labs

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Edward Lewis <[email-masked]>
Date: Wed, 04 Jul 2001 10:12:28 -0700

>be secure get your secure domainname under .secure?

.com not use DNSSEC?  Perish the thought!

I think we can hammer opt-in into the default dnssec mode of operation
(protocol and procedure) so that .com and other big zones are NOT special
cases.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

You fly too often when ... the airport taxi is on speed-dial.

Opinions expressed are property of my evil twin, not my employer.

---

From: Roy Arends <[email-masked]>
Date: Wed, 04 Jul 2001 10:08:16 -0700

> be secure get your secure domainname under .secure?

1) There is the RFC-1035 style zone (unsigned)
2) There is the RFC-2535 style zone (fully signed)
3) There is the opt-in style zone (partially signed)

1) is used now.
2) is DNSSEC.
3) is what this discussion is about. Combining 1+2.

The opt-in draft describes the opt-in style as a combined view of 1+2.
Other arguments merely are about combining the two styles in one zone.
Not through server configuration (ie having to combine 2 zones/views).

It is absolutely of NO IMPORTANCE if .com/.net and friends go for 3. It
would still be DNSSEC for their signed delegations.

The effort that Verisign is making (opt-in draft) shows that they want
DNSSEC. Which is a big step forward.

In general, using optin relieves large TLD's for signing each and every
individual Resource Record and creating (null/real)keys + sig + nxt + sig
over unsigned delegations.

Going through the ICANN process and obtaining the .secure TLD seems very
heavy. And next to that, the .secure TLD registry probably wants opt-in
too.

Roy Arends
Nominum

---

From: Miek Gieben <[email-masked]>
Date: Wed, 04 Jul 2001 10:13:07 -0700

[On 04 Jul, 2001, Edward Lewis wrote in " Re: I-D ACTION:draft-ietf-dnsext-dnssec-opt-in-00.txt "]
> (protocol and procedure) so that .com and other big zones are NOT special
That's one step further. I'm not against opt-in, but it would be nice
to have just one standard, either opt-in or plain dnssec. 

grtz Miek