Subject: wildcards, dnssec, and opt-in

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Sep 2002 08:28:42 -0400

As far as whether wild cards stay or go, I think it is up to the 
users of DNS to determine, not the protocol designers.  Whether they 
are a pain or not, if the use of wild cards is deemed necessary, it 
is up to the engineers to answer the requirement.

Pre-BIND 8, when a small group of us were struggling to write the 
first DNSSEC code we came upon a feature that made validating answers 
problematic.  Round robining of answers was a stumbling block - 
because it meant having to reorder the RR's for validation.  There 
was an internal proposal then to make users of DNSSEC turn off round 
robining so that the DNSSEC code wouldn't have to copy and sort 
before validating.  Eventually, it was determined that round robining 
is a requirement and DNSSEC will just have to deal with it.  I think 
the same applies to wild cards.

If opt-in is to be adopted, it too will have to deal with wild cards. 
If there's a choice between wild cards and opt-in, I'd have to lean 
in favor of wild cards as I see that wild cards as a requirement. 
Yes, some feel that opt-in is a requirement for deployment in large 
zones.  Although I'm pressing for DNSSEC to succeed, if in doing so 
it causes harm to the legacy of DNS, perhaps DNSSEC is better off not 
being deployed.

(If that's the case, we better start on DNS2010.)

Keep in mind that the issues being bickered about here are unusual 
cases.  Most zones are one label deep.  Most uses of wild cards are 
simplistic.  Most zones don't even use wild cards.  Will any zone 
that is a candidate for opt-in want to have a wild card?  But 
complicated uses do exist.  What we need to keep in mind is that the 
solution we generate needs to work best for the majority of cases and 
work in some fashion for all cases.

I personally fail to see the difficulty caused by wild cards, 
especially for DNSSEC.  They are tedious perhaps, but the algorithms 
to process them are deterministic, decidable, and will terminate. 
With opt-in, I think there's a choice to be made, whether an unsigned 
(opted-out) domain name is matched before a signed wild card.  If we 
choose one of the options, and no other "corner cases" are found, we 
should be again in the situation of a decidable algorithm that 
perhaps takes time - but will terminate.

(Worried about amplification as a springboard for a DOS?  I don't 
have an answer to that without looking at the algorithm and the 
potential for triggering it.)

Remember that we can imagine really weird uses of wild cards, CNAMEs, 
DNSSEC, etc., but for the most part these engineer-dreamed scenarios 
do not occur in the wild.  Cover the odd-ball cases, but let's just 
optimize on the cases that are actually used in nature.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Greg Hudson <[email-masked]>
Date: 17 Sep 2002 11:47:45 -0400

> is up to the engineers to answer the requirement.

When security is on the line, it is reasonable for engineers to draw the
line at a feature which provides nothing of substance.

I would rather have 30% deployment of a DNSSEC which is simple enough to
actually be secure than 100% deployment of a DNSSEC which is too
complicated to evaluate.  (Not that I think wildcards would account for
a 70% swing.)

---

From: Edward Lewis <[email-masked]>
Date: Tue, 17 Sep 2002 14:42:47 -0400

Looking at "wild cards vs. dnssec" it seems to me that the issue is 
that wild cards makes achieving the service of authenticated denial a 
bit harder than the non wild card case.  Wild cards do not complicate 
the security of explicitly-there data.

What I would like to know is how widely practiced is the use of 
multi-label depth wild cards?  If these are not that widely deployed, 
then using a clunky, non-scaleable solution to the issue is 
acceptable.  I'd like to see completeness of the security coverage, 
and if this means that multi-label depth wild cards suffer - so much 
more the incentive to limit their use.

I don't believe that we will come down to having to make a hard 
choice between wild cards and dnssec.  I fail to see how wild cards, 
even with the complexity of multi-label depth situations, create a 
situation that is undecidable.  I think that there may be ugly 
situations for the odd ball cases, but I think that odd ball cases 
are rare enough that they deserve to bite the bullet in this case.

As far as opt-in vs. wild cards, I don't know yet.  Is anyone 
prototyping a server that implements opt-in so that we can take shots 
at it?  I think that would do us a lot more good than continually 
haggling over words in mail and the specs.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer