Subject: Re: Opt-in wg last call

From: Roy Arends <[email-masked]>
Date: Thu, 28 Mar 2002 20:56:56 +0100 (CET)

On Mon, 25 Mar 2002, Olafur Gudmundsson and Randy Bush wrote:

> This message starts a two week last call on Opt-In limited to NS
> delagtions.  From discussion on the mailing list, we believe that
> this compromise position is somewhat more accepted than either of
> the 'no opt-in' and 'unlimited opt-in' alternatives.
>
> If you feel that you can not live with this compromise, then and
> only then, please explain why to the list.
>
> Thanks,
>
> Randy & Olafur

A few weeks ago there was a discussion on Opt-In or Non Opt-In.  A
compromise (Opt-In for NS only) was posted which seems acceptable to some
without even one (1) technical argument.  That compromise was based on a
moral argument.

Here is a list of some technical arguments _for_ full Opt-in:

With full Opt-In the road is open to allow:

 o   Unsigned Wildcards.
     (Down the road we have the ability to restrict signed wildcards)
 o   Unsigned synthesized RRsets.
     (DNAME>CNAME, A6>AAAA)
 o   Aggregated signing of Secure Dynamic Updates.
 o   Allow Unsigned Classless IN-ADDR.ARPA delegations
     (Allow unsigned cnames)

Or in other words, allow smooth transition from DNS to DNSSEC.

Restricting Opt-In to NS is useless, since we then get emulated full
Opt-In (error prone, more complicated, more traffic) by delegating the
unsigned Record Sets to an unsigned zone.  Folk will simply route around
the restriction.

As said on this list before is that "DNSSEC should have been designed as
Opt-In".  I agree, one should be able to make a choice on which name to
sign.  After all, the "zone administrative border" is only in the server
part, a resolver asks for Record Sets, not for Zones.  DNSSEC should have
been designed with "authenticated denial of security".

To illustrate that, an application, or secure resolver decides even before
issuing a single query, if it expects a signed answer.  The verifiable
response it gets with Opt-In is either "This record is signed" or "This
record is not signed".  From a security perspective, "not signed" is
effectively the same as "not existent".  From a logical perspective,
authenticated denial of existence is a subset of authenticated denial of
security (if it does not exist, it is not signed).

With full Opt-In out there as part of the protocol, we do not away with
"authenticated denial of existence".  The administrator has the choice
between 2535/DS or 2535/DS/Opt-In.

With regards to the "change to the security model" argument: As long as
you understand and address the threat model, this change is acceptable.

A request to the wg chairs:

Before we abandon full opt-in, I'd like to be more clear on the working
group's sense of the two.  To do that, before we last call opt-in, can we
have an explicit call for consensus on full Opt-in vs. restricted Opt-in ?

Roy Arends
Nominum

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>