Subject: Re: What are the opt-in issues

From: "Phillip Hallam-Baker" <[email-masked]>
Date: Sat, 8 Jun 2002 19:57:25 -0400

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

Randy is incorrect to claim that new technical issues have emerged.

The Typo attack is simply a sub class of an attack that was identified in
the original security analysis. Any party can apply for an unregistered
domain name in a TLD at any time, the authentication criteria applied by
registrars do not include verification that the applicant of the domain name
has provided a bona fide address on which process can be served.

This would have been clarified earlier if the objection had been posted to
the working group where it belongs rather than an unrepresentative and
unaccountable body meeting in secret.

I suspect that if you are allowed to continue to take advice in secret you
can continue to re-raise old technical issues as new ones for a very long
time.

		Phill

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Derek Atkins <[email-masked]>
Date: 09 Jun 2002 22:18:49 -0400

> has provided a bona fide address on which process can be served.

Phill, you are misrepresting the attack.  Please don't take my words
and misrepresent them just to try to make your point.  Sure, someone
can register the domain under falsified information, but in that
circumstance, if the domain is being used to defraud, the registrar
has the power to un-register the domain.  Under the typo attack
against opt-in, an attacker could poison caches and work around the
registrar's power to un-register a domain.  Can you please point out
where cache poisoning was mentioned in the opt-in discussions?

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: Greg Hudson <[email-masked]>
Date: 09 Jun 2002 22:50:36 -0400

On Sun, 2002-06-09 at 22:18, Derek Atkins wrote:
> has the power to un-register the domain.

Under opt-in, if a registrar wants to "un-register" a domain which has
been added through an insertion attack, it's a simple matter of adding a
NXT record (without the opt-in bit set) for the two real records
surrounding the inserted record.  As I understand it, anyway.

This doesn't sound like a substantial new issue.  Certainly, we all knew
that opt-in allows the insertion of unsigned records in a domain which
uses it.

(ObPolitics: In some sense, I do think some people are overreacting; but
Randy and the directorate should realize that counseling "patience"
isn't very compelling when the problem is an unwarranted delay.)

---

From: "Phillip Hallam-Baker" <[email-masked]>
Date: Sun, 9 Jun 2002 23:42:00 -0400

OK if that turns out to be a serious problem we can modify the domain
recovery procedure so that the typo address is then registered and secured.

I still find the attack to be somewhat less than worrisome. Maintaining a
cache poisoning attack for several days after detection does not seem very
likely. The domain name protest procedure has a minimum time for completion
measured in months.

If the problem is a typo insertion attack then it can be remediated very
quickly by registering the domain as secure. The malicious typo registration
in false name remains easier to mount, harder to remedy and cannot be
addressed using cryptography. I do not exhaustively list every sub class of
an attack that has been considered. If as is the case here a more powerful
attack can be shown to dominate all the attacks covered by a control the
control is broken.

As for misrepresentation, if the problems are stated in public then there
can be no confusion as to who said what and if there is confusion over what
they meant they can address it.

The time to examine protocols is in last call. The talk of advice etc would
not raise concern if it was the case that the issues were being raised by an
independent AD of their own volition and put to an independent expert. When
the AD is the chair of the working group and most of the experts consulted
are a subset of the working group chosen by the chair/AD it becomes
something else.

It is quite clear that if the DS change and the OPTIN change are separated
and OPTIN sufficiently delayed that the case could then be made that the
group should reconsider the OPTIN consensus on the grounds that the
justification had been contingent on the DS flag day. And before Randy 'W'
Bush leaps to deny it I have already heard the suggestion from two
independent sources neither of whom own black helicopters.

		Phill

> -----Original Message-----
> From: Derek Atkins [mailto:[email-masked]]
> Sent: Sunday, June 09, 2002 10:19 PM
> To: Phillip Hallam-Baker
> Cc: [email-masked]
> Subject: Re: What are the opt-in issues
>
>

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Jun 2002 17:35:01 +0200 (CEST)

> When

Phillip,

Last time I checked I was the AD for DNSEXT and I was not one of the co-chairs.
Randy is the AD for DNSOP.

   Erik