Subject: RE: zone naming terms (was Opt-in wg last call)

From: "Loomis, Rip" <[email-masked]>
Date: Wed, 10 Apr 2002 13:22:49 -0400

(Hello Scott and Ed--)

Even the term "secure" set is a misnomer IMHO.

"Security" of such things depends on perspective and
numerous other factors.  If someone signs data
and then the zone private key is compromised, then
to me any data signed with that key is no longer
"secure".  It is, however, still signed.  Similarly,
if _you_ statically configure a key as trusted, but
_I_ don't configure that key as trusted, then you
might term the data within a specific zone as
"secure" while I would state that it is "signed but
not secure" (according to the rules I think you're
using).

I would recommend the following terms:

"Signed RR set" (or "signed set")
"Unsigned RR set" (or "unsigned set")
"Fully signed zone" - signed IAW RFC 2535, or
	2535+DS
"Opt-in signed zone" (or "partially signed zone")
	- signed IAW 2535 + Opt-in (w/ or w/o DS)

These terms are still perhaps annoying and confusing--
but at least they're consistent with each other and
don't depend on one's world view.

--
Rip Loomis                         Senior Systems Security Engineer
SAIC Secure Business Solutions Group         www.saic.com/securebiz
Center for Information Security Technology   www.cist-east.saic.com

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Wed, 10 Apr 2002 15:42:11 -0400

>Even the term "secure" set is a misnomer IMHO.

Yeah, it is.  What is needed is a term that captures:

  "...means that the resolver should expect to get a signature with this
   data set.  Failing to do so means that the data set in hand is to be
   disposed of and every effort made to retrieve a new one."

This says nothing about the validity of the expected SIG, just that the
resolver should not proceed with the next step (verification) until there
is one.  If the set is such that no signature is expected, the resolver is
free to use the data set much as it does "today."

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

Last day is Wednesday, April 24, 2002...

Opinions expressed are property of my evil twin, not my employer.

---

From: Randy Bush <[email-masked]>
Date: Thu, 11 Apr 2002 20:40:55 -0700

> "Unsigned RR set" (or "unsigned set")

RRsets are not what is signed.  whole names, consisting of one or more
RRsets are.

randy

---

From: Edward Lewis <[email-masked]>
Date: Fri, 12 Apr 2002 09:37:16 -0400

>RRsets are not what is signed.  whole names, consisting of one or more

Right - when considering opt-in.  However, the resolver is more concerned
about set-by-set signage.  I can see where why there is a desire for terms
defining the server-side, mostly for explaning the concepts and the
configuration.  I've been thinking of terms to define the resolution
process.  Although the client-server pair is tied together by a protocol,
often times the terms differ because of the system point of view.

---

From: Randy Bush <[email-masked]>
Date: Fri, 12 Apr 2002 08:45:36 -0700

> about set-by-set signage.

we were discussing english descriptions of the security semantics, not
some particular code.

randy