Subject: RE: OPT-IN at delegation points only (Re: DS and Opt-in - a propo sal)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 16 Jan 2002 07:55:52 -0800

ould you elaborate on that?
> 
> OK, Opt-In changes the definition of the NXT RR from:
> 
>   authenticated denial of existance of any name
> into
>   authenticated denial of existance of a secured name

But neither of those is a primary security threat. The
actual security threat is a downgrade attack in which
the attacker represents a secured name as unsecured.

The authenticated denial of existence of a secured name
is a control on that threat.

The authenticated denial of existance of a name is not
a necessary control against any threat that is in scope
for large domains.

> Sounds basic to me

You seem to have confused a control with a threat which
is a pretty basic error.

> > Who is still debating this?
> 
> A number of people believe that the granularity influences how
> users and ISP's perceive the security, and that in turn will
> influence the speed of the roll out.

So making it impossible for the operator of 85% of the DNS
domain names to deploy DNSSEC will speed up the roll out?

	Phill

---

From: Randy Bush <[email-masked]>
Date: Wed, 16 Jan 2002 15:05:02 -0800

> domain names to deploy DNSSEC will speed up the roll out?

please stop trying to throw corporate weight.  it will only justify
pissing contests.

randy

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.