Subject: What are the opt-in issues

From: David Conrad <[email-masked]>
Date: Fri, 07 Jun 2002 16:25:12 -0700

Randy,

On 4/16, you wrote:
> after much discussion and struggle, it seems the closest we can get
> to consensus is a compromise with which few if any can not live,
> opt-in restricted to delegation points.

On 6/6, you wrote:
> major pushback from the dns directorate

In an attempt to bring the opt-in discussions back out into the light, what
exactly was the pushback?

I am not a particular fan of opt-in, however we have implemented delegation
only opt-in in 3 separate name servers (including both authoritative and
caching servers), it was painful but it works, and the functionality it
provides addresses some scaling considerations at least one organization
involved in large scale DNS operations believe are significant.

Given the working group seemed to accept the arguments Mark Kosters put
forth regarding the implications of fully signing .COM (and other TLD
registries seem to want to follow Verisign into the same scaling swamp as
quickly as they can), it would seem to me that the value of opt-in has been
documented.  

As I have been reminded in the past, the question should be "is there a
protocol issue here" not "do I like it".  What are the opt-in protocol
issues?

Tnx,
-drc

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 00:31:48 -0400

Thre are a number

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 00:41:47 -0400

First, note that the DNS Directorate does not have any real power,
AFAICT (I've only recently been invited to join).  We don't really
make decisions -- instead we bring a bunch of knowledge from various
fields and provide advice to the A/Ds.  I think the best analogy is to
the IESG: the IESG cannot create anything, but they can certainly
destroy something.  Similarly, I do not believe that the DNS
Directorate can dictate policy or direction, but can urge the A/Ds to
stop a potentially dangerous direction.

Specifically on opt-in, there are a number of attacks that full DNSSec
protects against but opt-in re-opens.  In particular there are a few
types of cache poisoning attacks that fall into this category.

One of the real issues is that opt-in severly changes the security
properties of DNSsec in a way that is not completely understood and
without a clear and comprehensive security analysis.  Being a security
person myself I am uncomfortable mucking with security properties
without a clear analysis of the ramifications.  Said cache-poisoning
attacks are one such ramification.  Are there others?  We don't know.
And there-in lies the potential gotchas.

-derek

PS: These "cache poisoning" attacks have also been called "typo
attacks", and I personally discussed these attacks with people in
Minneapolis.  I do not feel like describing them now -- perhaps next
week after I get some rest.

---

From: Paul Vixie <[email-masked]>
Date: Fri, 07 Jun 2002 22:13:26 -0700

A note before I begin.  Derek has earned my deep respect over years, and
no part of what I've got to say here should be thought of as directed at
him, even though I'm going to couch my words here as a reply to his.  I
am quietly outraged at the closed nature of the standards body I thought
I was part of.  My words should be taken personally only by those who
have set up and still maintain a secret second government here.  Derek
is a relative newcomer to DNSDIR (by his own words) and I'm not holding
him responsible for its existence nor for the AD's reliance upon it.

> ...  Similarly, I do not believe that the DNS Directorate can dictate
> policy or direction, but can urge the A/Ds to stop a potentially
> dangerous direction.

So, anyone who thought the WG was anything but a debating society were
confused.  A non-open process will be used to decide what is advanced,
and the visible and open process is just "the show."

> types of cache poisoning attacks that fall into this category.

We heard those concerns in the open process -- in the WG, that is -- and
the moderately clear consensus of those involved was "go ahead with it."

However, since the minority opposition included Randy Bush, a non-open
process -- let's call these "the grownups" -- was convened to study the
situation more seriously and make sure that the open process -- let's
call ourselves "the kids" -- weren't going off in some crazy direction.

What a relief.  Now I don't have to pull up stakes in the bar and port
myself and my laptop into a meeting room next time there's a DNSEXT
time slot.  You other kids can go have your fun and games, I'll just sip
my beer and wait for the grownups to meet later in secret and decide
what direction the DNS protocol will take.  Simplicity itself.

> And there-in lies the potential gotchas.

Well, noone with either DNS experience or security experience has been
entirely comfortable with any version of the DNSSEC specification, ever.
Many of us now treat that condition as a given.  I guess not everybody!

I guess we were deadass wrong back in 1996 when we deliberately proceeded
toward what we thought was a short path toward implementation and 
deployment.  We had at least five more years to debate these matters,
and based on this latest DNS Directorate revelation, it appears that we
have at least one more year of debate remaining.  Goodbye, 2002, we hardly
knew ye.

I call upon Randy Bush to resign as DNSEXT WG co-chair.

---

From: Marshall Rose <[email-masked]>
Date: Fri, 7 Jun 2002 23:09:50 -0700

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

hi. sorry to comment on something that i know absolutely nothing about, i.e., "the opt-in issues".

i will take the blame for having started the concept of an "area directorate" about 10 years ago when i was running the network management area. there are a lot of different goals for a directorate, ranging from "having more eyes on the ground" to "helping mid-level folks become senior level folks". i had pretty good success with the folks on my directorate, and a few even went on to greater things...

what is important to understand is that no directorate has any power whatsoever. a directorate can give advice to some ADs, but ultimately it is the ADs who have to make, and then defend, those decisions. alternatively, the ADs can simply ignore the advice.

citizen D is flat out wrong when he likens a directorate to the iesg. a directorate can not kill anything. they can suggest to some ADs that something be killed, but it is up to the ADs to pull the actual trigger. alternatively, the ADs can graciously thank the directorate for their advice and move on to the next topic.

citizen P is flat out wrong when he says there is a conflict of interest here because an AD is also chair of this working group, and therefore the working group can't mount an effective appeal.

citizen X is flat out wrong when he views a directorate as any kind of a formal body, similar to a working group, a design team, or an AD. a directorate is nothing more than an informal group of folks who advise an AD. and, let's say it again... the AD is free to take their advice, or ignore it, or do both or neither.

the appeals process is clear: wg chair, relevant AD, entire IESG, entire IAB.

if folks aren't happy about the way this "opt-in" thing isn't being handled by the WG chair, go to the relevant AD. if folks aren't happy about what the relevant AD says,, go to the entire IESG. if folks aren't happy about what the IESG says, then go the IAB. if folks aren't happy about what the IAB says, then perhaps you should get back on the court-ordered medication.

again, i appolgize for taking everyone's time.

/mtr

---

From: David Conrad <[email-masked]>
Date: Sat, 08 Jun 2002 14:01:19 -0700

Derek,

On 6/7/02 9:41 PM, "Derek Atkins" <[email-masked]> wrote:
> AFAICT (I've only recently been invited to join).

Randy Bush has used "pushback from the DNS directorate" as justification for
postponing a decision on opt-in.  This would appear to imply some power
delegated to a closed group that keeps no public record.  However, I do not
believe this is the appropriate venue for such discussions.  The poised list
is a better venue.  Unfortunately, it appears the poised list is not
currently accepting new subscriptions.

> types of cache poisoning attacks that fall into this category.

It would seem to me that _publicly_ documenting these attacks would go a
long way towards reducing this controversy.

Rgds,
-drc

---

From: Randy Bush <[email-masked]>
Date: Sat, 08 Jun 2002 15:32:35 -0700

> Randy Bush has used "pushback from the DNS directorate" as
> justification for postponing a decision on opt-in.

close.  as explanation, not justification.  and it was the ads
who the directorate advises who received the pushback, exactly
how a directorate is supposed to function.

so we have done our best to get more expert technical input [0]
by asking roy to talk with us a few times.  and now roy and rob
are working on writing up the technical issues.

> The poised list is a better venue.  Unfortunately, it appears
> the poised list is not currently accepting new subscriptions.

heck, yesterday my post there bounced.  but i have heard rumor
that the list is in a maint/move cycle this weekend.

> It would seem to me that _publicly_ documenting these attacks
> would go a long way towards reducing this controversy.

i think rob and roy are working on writing up the technical
issues.

but a worrysome one is that folk are still discovering corner
cases and having to explore technical issues while we are in
what many hoped would be a spec freeze and ship cycle [1].  when
will the tech issues stop arising?

randy

---

[0] - if we want political input, this forum seems to specialize
      in it sufficiently to cause a large flurry of unsubscribes
      in the last day or so.

[1] - i know this is not the forum for technical issues :-), but
      here's a timy one that came up last week.  how does opt-in
      affect ad-is-secure?  it seems to further weaken what
      receiving ad==true tells a stub resolver.

---

From: Brian Wellington <[email-masked]>
Date: Sat, 8 Jun 2002 18:21:28 -0700 (PDT)

>       receiving ad==true tells a stub resolver.

Why?  Insecure data from an opt-in zone will cause the AD bit to not be 
set in the response.  The AD bit will be set if the response contains only 
secure data from the opt-in zone.

Brian

---

From: Derek Atkins <[email-masked]>
Date: 08 Jun 2002 23:10:28 -0400

David Conrad <[email-masked]> writes:

> delegated to a closed group that keeps no public record.  

I don't think it is any more power than, theoretically, Jeff Schiller
and Steve Bellovin asking a small set of people for their private
opinion on "FooProtocol" and then blocking progress due to those
private discussions.  The directorate exists at the pleasure of the AD
and exists to advise the ADs.  The ADs can do whatever they wish using
the information and advice of the directorate.

Keep in mind that working group chairs and ADs have a lot of leeway
here, and private discussions have as much place as discussions on
public lists and WG meetings.  An AD can base their decisions on
whatever information they have, however they get it.  The appeal
process exists to make sure that such decisions are made reasonably.

Complaining about private meetings at the IETF is just plain
ludicrous.  How much work gets accomplished during lunches and dinners
during the IETF?  Should all that be "outlawed" because it's not an
open process?  Or are you only complaining because this is blocking a
protocol that you are interested in?  You can't have it both ways.

> long way towards reducing this controversy.

Well, these attacks were only brought to my attention in Minneapolis.
I believe that Roy and Rob are writing up a document and personally I
am waiting to see what it says.  I believe that Rob knows about this
attack, and I'm fairly sure that Roy does as well.

-derek

---

From: David Conrad <[email-masked]>
Date: Sat, 08 Jun 2002 20:49:52 -0700

Derek,

> protocol that you are interested in?  You can't have it both ways.

A) I've already stated I'm not a particular fan of opt-in.
B) I am not suggesting outlawing private meetings -- that would indeed be
ludicrous.  What I am suggesting is that an action to kill a particular
protocol should be justified based on objectively verifiable criteria, not
because a small group of people decide in secret that the protocol should
die.  If opt-in should die, the reason should NOT be because of "major
pushback from the DNS directorate".

> am waiting to see what it says.

I suspect Rob or Roy sending email to namedroppers pointing out the issue
and asking what others think might have been a _much_ more effective way of
hashing out the problem (if it is such).  No slight intended towards Rob or
Roy, but they are not the only ones who have a bit of a clue about opt-in,
DNSSEC, and the way the DNS works.  Contrary to Randy's opinion,
namedroppers doesn't have to only be about politics.

Rgds,
-drc

---

From: Randy Bush <[email-masked]>
Date: Sat, 08 Jun 2002 21:01:04 -0700

> namedroppers doesn't have to only be about politics.

and your message and most of this thread are such shining examples
thereof.

i don't think anyone but the paranoid have said that opt-in has
been killed, let alone that it was killed by "a group of people
meeting alone in secret."

you might reread my original response to matt 
  <http://ops.ietf.org/lists/namedroppers/namedroppers.2002/msg00723.html>
and my consistent responses thereafter before hyperventilating and
indulging in black helicopter fantasies.

randy

---

From: David Conrad <[email-masked]>
Date: Sun, 09 Jun 2002 12:52:39 -0700

Randy,

On 6/8/02 9:01 PM, "Randy Bush" <[email-masked]> wrote:
>> Contrary to Randy's opinion,

At least we can always count on you to bring either the match or the extra
gasoline.

> meeting alone in secret."

Then it would appear comments I received from three independent sources to
the effect that opt-in was already dead were mistaken.  How reassuring.

> and my consistent responses thereafter

"We're from the DNS Directorate, we're here to help".  As I mentioned
previously, raising the issues the directorate has with opt-in on the public
mailing list could be helpful in exploring whether the issues are sufficient
to kill opt-in.  Why not be open?

> before hyperventilating and

Speaking of shining examples, thanks for being so concerned about my health,
both mental and physical.  Let me reassure you that I have neither been
hyperventilating nor have my fantasies involved black helicopters.  I do
have this fantasy about open and transparent standards processes, but that
would, of course, be for another mailing list...

Rgds,
-drc

---

From: Paul Vixie <[email-masked]>
Date: Sun, 09 Jun 2002 13:18:18 -0700

the process as i understood it was that if the WG reached consensus the
chair's job was to fwd the relevant drafts to the AD's.  this appears to
have happened.

if the AD's don't feel comfortable with the document, they are supposed
to throw it back to the WG with their concerns and questions noted, in a
timely fashion.  this appears not to have happened.

now we're in an unhappy place.  a subset of the WG (called a directorate)
is meeting and discussing this in closed sessions for the purpose of
advising the AD about these documents.

the delay thus caused, and the lack of transparency, are intolerable.

---

From: Dave Crocker <[email-masked]>
Date: Sun, 09 Jun 2002 14:21:18 -0700

Folks,

My reading of this protracted thread is that there are two, very different 
issues.  One is technical and one is process.

Technical:

         A range of difficult alternatives has been developed and debated 
at length and ad nauseam.  My 50,000 foot scan of the list suggests opt-in 
won.  If the actual rough consensus is different or unclear, then 
fine.  That becomes a clear (and oddly straightforward) point to resolve.

         When there is a rough consensus, the last-minute roadblock that is 
always valid is "It won't work" as long as the roadblock is based on 
legitimate details.  More often, this objection is raised using old 
material that is well-understood.  Hence it is just a way to cause delay.

         It does not sound as if there are fresh insights to opt-in.  If 
indeed there ARE fresh insights, I haven't noticed their being posted.

         To the casual reader, therefore, the technical situation appears 
to be that lengthy, diligent, technically competent debate has produced 
alternatives that each suffer from some difficult and even unsatisfying 
trade-offs.  However, these alternatives are coupled with a strong desire 
to get resolution, leading to a rough consensus for opt-in.

                 Would the working group chair please correct any details
                 of this summary that are incorrect?

Process:

         Difficult topics often benefit from having consultation by a small 
group of experts.  The role of directorates in the IETF is lengthy, as 
Marshall has noted.  The idea that prviate discussion groups may not be 
formed is silly enough that it surely is not what anyone is 
suggesting.  The idea that a working group chair or an AD is to be 
prohibited from getting advice from such a group is equally silly.

         And of course the idea that such a group is given decision-making 
authority is also quite silly, given the IETF culture.  No working group 
chair or AD would claim to have done such a thing.  Were they to try, it 
would be an obvious basis for an immediate process appeal.

         What seems more likely -- and what fits IETF history better -- is 
that the relevant managers -- working group chair and/or AD -- have 
either  communicated the role of that advice incorrectly or have used such 
advice incorrectly.  The former is trivial to fix.  The latter is pretty 
serious.

         One might claim that the relevant managers have already posted 
clarifications on this matter.  To the extent that folks making objections 
are not satisfied with the response, I'll can't tell why, from the messages 
posted about this.

So:

                 I strongly suggest folks separate these lines of
                 discussion.

                 I equally strongly suggest that folks clarify exactly
                 what problem(s) they claim are present and pursue fixing
                 them in the usual ways done in the IETF.

         At the moment, the discussions are sufficiently laced with heat to 
prevent much other than more heat.  Near as I can tell, all of the folks 
causing and reacting to the heat are trying to do the right thing.  That 
they might not be succeeding does not reduce the seriousness of their intent.

d/

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Jun 2002 17:20:43 +0200 (CEST)

> chair's job was to fwd the relevant drafts to the AD's.  this appears to

I'll respond to this thread in more detail once I've caught up with it.
But this particular point warrants a short response.

I have not seen the opt-in documents be forwarded to me as an AD.
They are not on http://www.ietf.org/IESG/status.html

I also think that the current draft is about unrestricted opt-in
and the rough consensus discussion in Minneapolis was about opt-in
restricted to delegation points. Thus I don't think there is or ever was
a draft that *could* have been forwarded to the AD.

I would expect, assuming for a second that we continue down the path of
opt-in restricted to delegations, that the document would actually specify 
how servers check this (and whether the resolver verification is any 
different due to the restriction).

   Erik