Subject: RE: DS and Opt-in - a proposal

From: [email-masked] (Ted Lindgreen)
Date: Fri, 11 Jan 2002 11:51:58 +0100

[Quoting "Hallam-Baker, Phillip", on Jan 11,  3:03, in "RE: DS and Opt-in -  ..."]

> I have yet to see a technical argument of any kind against Opt-in.

Dear Phillip,

I thought this was pretty clear, but apparently not,
so I'll try to summarise.

The technical arguments against Opt-in boil down to:

   It changes the protocol in such a manner that it becomes
   less, or even not at all, useful for the goal:

     "To make the DNS infrastructure less vulnerible"

The technical arguments in favor of Opt-In boil down to:

   It extends the protocol such that superlarge zones
   can start implementing DNSSEC, while fully retaining
   its usefulness for the goal:

     "To implementing PKI facilities into DNS"

My question, seeing these two different goals, was:

   What was the goal again?

And I added with that question 2 remarks:

1. I thought one of the goals still was
    "To make the DNS infrastructure less vulnerible"
2. If I'm mistaken on 1, then we better rethink DNSSEC
   at all, because:
   2a. DNSSEC makes a lousy PKI, there is not even a
       key revocation mechanisme.
   2b. There are perhaps more appropriate infrastructures,
       for this, like LDAP, but also other.
   2c. But if we misuse DNS anyway, Opt-In seems an overly
       complicated way, just allowing for no NXT records
       would be much simpler and with almost the same effect.

I've seen a number of replies on my question, which make me
believe that there are more people that think that
    "To make the DNS infrastructure less vulnerible"
still is an important goal.

Another question that was raised and referred to by you:
- Olaf asked why full RFC2535 would be a problem for large or
  even superlarge zones. He referred to documented work (by
  NLnet Labs) that showed that:
  - signing zones with many tens of millions delegations is not
    a big techical challenge with the current of-the-shelf
    available hardware.
  - Dealing with ten times larger zonefiles appears not to be
    a big techical challenge with the current of-the-shelf
    available hardware.
  - Securing a delegation-only zone (like ,com) causes
    significantly less growth than a factor of ten.

What I read as answer were handwaving arguments, like the size of
Verisigns computerroom. I also read a request from Jaap for hard
numbers. In your current mail I again see you answering that
with only a handwaving argument.

So, in conclusion, just two of the technical arguments:

1. There is no consensus, that reducing the usefulness of
   DNSSEC to just a PKI, is the right thing to do.
2. There is serious doubt, that Opt-In is really necessary
   for even the largest TLDs to join the RFC2535 party.

Regards,
-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Greg Hudson <[email-masked]>
Date: 11 Jan 2002 10:10:27 -0500

>      "To make the DNS infrastructure less vulnerible"

I can't help but believe that people are confused about the
ramifications of opt-in.

As I understand the situation, with straight rfc2535, if Verisign wants
to charge extra to sign people's KEY records, they can.  Verisign would
be forced to sign everyone's NS records (or no one's), but without a KEY
record that doesn't provide very much additional protection.

So, lack of opt-in does not particularly damage the goal of protecting
the DNS infrastructure at the .com level.  There is some danger that
people in leaf zones will find it more convenient to use opt-in than
sign their own zones, but I am not convinced this is a significant
danger.

Even if your argument made sense, your wording would be going
overboard.  Since opt-in is a domain holder's choice, it cannot make
DNSSEC "less useful" for the stated goal, though it could conceivably
make it "less likely to achieve" the goal.

The rest of my message is tangential; Ted made some other statements I
disagree with, but they don't relate to my argument above.  As much as I
think DNSSEC holds potential as a PKI, I do definitely believe that "to
protect the DNS infrastructure" is its primary goal.

>        key revocation mechanisme.

Quite the contrary.  Because DNSSEC is an online system, you can make
signatures expire quickly, and people can easily fetch new signatures
when expiry happens.  That's a big improvement over the web browser PKI
we live with today, where certificates have to last a long time (on the
order of months), and the revocation features are ignored.

>        for this, like LDAP, but also other.

LDAP is a protocol.  It is not, at the current time, a global
infrastructure.  It may be more appropriate as a protocol, but it simply
isn't there to do the job in the important capacity.

(To be fair, DNSSEC isn't there as a global infrastructure either, but
it's somewhat more likely to get there than LDAP is.)

>        would be much simpler and with almost the same effect.

No, that would be completely inadequate.  DNSSEC with opt-in allows
authenticated denial of signed records in an opt-in zone.  If we simply
allowed .com to have no NXT records, then anyone could spoof a response
to a .com query saying that amazon.com has no KEY record, even if it
does have one.

---

From: Roy Arends <[email-masked]>
Date: Fri, 11 Jan 2002 15:44:56 +0100 (CET)

Ted,

I think your reply reveals a general misunderstanding.

What can be done with opt-in, i.e. have specific unsecured names (not
single RRsets mind you) in a zone, can also be done with 2535: I simply
delegate the unsecured name away.

I.E. A zone is merely a practical term for part of a domain that has been
delegated to you minus that what you have delegated away. So, in general
we're talking about names.

With 2535, a choice can be made for each individual name if it is signed
or not. With opt-in this is done in a more efficient way.

Again, the ONLY thing (yes the only, and I have yet to see somebody
disputing that) is that opt-in gives up:

    authenticated [denial of] UNSIGNED nodes.

i.e. if it is not signed, it is not secure............

If anyone feels uncomfortable with that, sign the zone 2535-style.

This is _not_ the same as "just give up authenticated denial at all". Not
even close.

Roy

---

From: Brian Wellington <[email-masked]>
Date: Fri, 11 Jan 2002 15:36:11 -0800 (PST)

> record that doesn't provide very much additional protection.

NS records are never signed in the parent.  With or without opt-in,
Verisign can implement different pricing structures.  The main difference
is that without opt-in, the size of .com is inversely proportional to the
percentage signed, which doesn't work too well for them if only a small
percentage is signed.

(Staying out of the flame war, just staing facts...)

Brian