Subject: RE: OPT-IN at delegation points only (Re: DS and Opt-in - a propo sal)

From: [email-masked] (Ted Lindgreen)
Date: Tue, 15 Jan 2002 17:26:28 +0100

[Quoting "Hallam-Baker, Phillip", on Jan 15, 17:16, in "RE: OPT-IN at delega ..."]

> It is not a convenience issue if you cannot deploy without a
> change. At that point it becomes an operational requirement.

You can try to repeat this indefinitely, but mere repetition
itself probably does not lead to consensus building.

> The security of the system is unaffected by OPTIN.

This is untrue, Opt-In changes the very basis of the system.
Whether this is harmless or not is still being debated.

-- ted

to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.

---

From: Mike Schiraldi <[email-masked]>
Date: Tue, 15 Jan 2002 12:18:43 -0500

> Whether this is harmless or not is still being debated.

Could you elaborate on that? I don't understand what you mean by "changes
the very basis" and i thought that the security risk was one of the few
points that we all agreed on.

To spell it out one more time: The only new security consideration is that a
middleman can insert fake unsecure records under names that don't really
exist. As long as the zone operator is aware of this, he can either decide
that this risk is harmless and go with opt-in or harmful and use 2535.

Who is still debating this?

-- 
Mike Schiraldi
VeriSign Applied Research