Subject: RE: Opt-in wg last call

From: "Peter Ford" <[email-masked]>
Date: Tue, 9 Apr 2002 16:15:48 -0700

In place of "fully secure zone" and "partially secure zone" how about:
"secure full zone" and "secure partial zone". (or perhaps "secure
optional zone")

The phrase "partially secure" just does not sound quite right.

Regards, peterf

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Daniel Massey <[email-masked]>
Date: Wed, 10 Apr 2002 09:33:58 -0400

Hi,

This is not meant as argument against opt-in and I don't think 
this should delay the last call (hence the new subject), but I think 
we should recognize there is a shift in granularity from zones to 
names.  The DNSSEC terminology should reflect this change.

I think Peter's changes below are an improvement, but note that you 
also need to add a globally or locally in front of that.  We would 
have things like a "globally partially secure zone" and a "locally 
fully secure zone".  If the com zone does get signed, do we really
want to see an announcement saying the DNS now has a "locally 
partially secure com zone" (or "locally secure partial com zone" 
or "locally secure optional com zone")

I think confusion added by a term like "locally partially secure 
com zone" exceeds the utility of this term.  We are now signing 
names, not zones. 

Dan

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 10 Apr 2002 10:40:55 -0400

I agree with you, but I still think we should keep these terms (and define
them) in the specs.  That way, the meanings are agreed upon in the text.
Whether or not they are used correctly in announcements, other papers, etc,
is something we can't control anyway.

In other words, I think the definitions should apear in the RFC's so to
avoid confusion, but realize not everyone will use them properly.

Scott
-looking forward to the proud day when I hear ".com is globally partially
secure" ;-)
----- Original Message -----
From: "Daniel Massey" <[email-masked]>
To: "Peter Ford" <[email-masked]>
Cc: "Olafur Gudmundsson" <[email-masked]>; "Olaf M. Kolkman" <[email-masked]>;
<[email-masked]>
Sent: Wednesday, April 10, 2002 9:33 AM
Subject: zone naming terms (was Opt-in wg last call)

---

From: Edward Lewis <[email-masked]>
Date: Wed, 10 Apr 2002 11:26:34 -0400

Labeling a zone as secure, experimental, or insecure was really a mistake
in the past.  The origin of the need to create the labels was to define how
a resolver went about evaluating the security of the data.

Prior to opt-in, every set in the zone had the same security status, hence
it was convienent to call the zone signed or unsigned.  What we should have
been concentrating on then was whether the set was signed or unsigned.

So, probably the best thing to do is to list the terms "secure zone" and
"unsecure zone" as obsolete concepts.  A "secure set" or "unsecure set" is
more appropriate and more accurate, with or without opt-in.  Truthfully,
with opt-in we would have security name-by-name, so we'd have "secure
names."  However, no matter how you slice it, the resolver is working
set-by-set, no matter whether the security is zone-by-zone or name-by-name.

>> > The phrase "partially secure" just does not sound quite right.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                                NAI Labs
Phone: +1 443-259-2352                      Email: [email-masked]

Last day is Wednesday, April 24, 2002...

Opinions expressed are property of my evil twin, not my employer.

---

From: "Scott Rose" <[email-masked]>
Date: Wed, 10 Apr 2002 12:37:55 -0400

Well okay.  But what does "secure set" mean?  Would it mean that there is at
least 1 SIG present for the RRset, and the SIG can be traced back to a
trusted KEY?  Or simply a SIG exists for that RRset?

Not associating terms to zone status in the specs is a good thing I guess.
It will still be done anyway, I'm afraid:  it's easy to say "my zone is
secure" than saying "all of the sets in my zone are secure".

Scott

----- Original Message -----
From: "Edward Lewis" <[email-masked]>

---

From: Edward Lewis <[email-masked]>
Date: Wed, 10 Apr 2002 13:32:13 -0400

>trusted KEY?  Or simply a SIG exists for that RRset?

Whether a set is "secure(d)" or "insecure" depends on the eye of the
resolver.  Hence, if there is some way within the resolver's policy that it
can chain "keys and sigs" from the data in question to a configured secure
point, then the set is secured.  Otherwise the set is not.

(Or, to answer your questions: it's what the resolver thinks, a cautious
yes, and absolutely not.)

A set being secured is not the same as a set that is verified.  A set being
secured means just that there is an expectation of a proper SIG.  (The
reason for this concern is that there are older caches out there that may
separate a set from its signature.)

What is probably confusing is that the determination of "secured" in this
sense is determined by the resolver and not the server.  One resolver may
determine differently than another resolver for the same data, no matter
how careful the server is.  It's all up to the resolver.

>secure" than saying "all of the sets in my zone are secure".

No quibble with that...

---

From: Randy Bush <[email-masked]>
Date: Thu, 11 Apr 2002 03:54:33 +0200

> The phrase "partially secure" just does not sound quite right.

perhaps it does not.  but, as it precisely describes the situation,
perhaps your qualms about the phrasing are misplaced.

randy

---

From: "Andy W. Barclay" <[email-masked]>
Date: Wed, 10 Apr 2002 09:52:15 -0700

[ post by non-subscriber ]

Hi,
I don't like the the term "secure partial zone". It seems to imply
that this zone is incomplete.

I agree that partially secure zone sounds a little funky, but I can't
think of something better without being wordy.

-- 
Regards,
Andy W. Barclay.        [email-masked]
fax  (415) 738 7271
Always a UNIX Evangelist (and sometimes a system and network architect)

Beware the Jabberwock, my son! The jaws that bite,
the claws that catch!

---

From: Randy Bush <[email-masked]>
Date: Fri, 12 Apr 2002 08:03:16 -0700

> that this zone is incomplete.

how about "partially signed zone?"

randy

---

From: Mark Kosters <[email-masked]>
Date: Fri, 12 Apr 2002 11:33:06 -0400

> how about "partially signed zone?"

That is fine.  Another may be:

  opt-in -> "secured-node zone"
  non-opt-in  -> "secure zone"

Mark

-- 

Mark Kosters             [email-masked]       Verisign Applied Research

---

From: Randy Bush <[email-masked]>
Date: Fri, 12 Apr 2002 09:04:39 -0700

>   non-opt-in  -> "secure zone"

how can i tell the difference between the two?

and i like someone's differentiation between 'signed' and 'secured'.
i.e. we can only sign, not assert security.

randy

---

From: Rob Austein <[email-masked]>
Date: Fri, 12 Apr 2002 13:02:54 -0400

I also prefer the "signed" terminology to the "secured" terminology.

---

From: "Andy W. Barclay" <[email-masked]>
Date: Fri, 12 Apr 2002 11:02:10 -0700

I prefer partially signed zone. Lets avoid the word secure.

-- 
Regards,
Andy W. Barclay.        [email-masked]
fax  (781) 823-8276
Always a UNIX Evangelist (and sometimes a system and network architect)

The mistake you make is in trying to figure it out.
    --TENESSEE WILLIAMS

---

From: Mark Kosters <[email-masked]>
Date: Fri, 12 Apr 2002 14:15:52 -0400

> I prefer partially signed zone. Lets avoid the word secure.

You are quite right about signed vs secure.

Using Derek's response of security being an art, perhaps we need to
not use the word partial since it does not sound quite right. How about:

opt-in -> "signed-node zone"
non-opt-in  -> "signed zone"

(realizing once again how unfortunate it was to call "signed-node" "opt-in"
 in the first place)

Mark

--