Subject: Re: draft-ietf-dnsext-dnssec-opt-in-03

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 21 Oct 2002 13:16:29 -0400

A few comments against
> <http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-
> opt-in-03.txt>
not specifically CC'd to the authors since I believe they
all read this list rather regularly...followed by some questions
(for the entire WG) related to this draft.

1.  Section 2, first paragraph.  Authors' choice of words:
  "For these zones, the costs of maintaining the NXT record
   chain may not be relative to the gain of cryptographically
   securing delegations to unsigned zones."

  Everything's relative IMHO.  Perhaps you meant:
  "For these zones, the costs of maintaining the NXT record
   chain may be extremely high, relative to the gain of
   cryptographically securing delegations to unsigned zones."

2.  Section 3, third paragraph.  Authors' choice of words:
  "Using Opt-In, the existence or non-existence of insecure
   delegations is not asserted by the tagged NXT records."

  is confusing--too many negatives IMHO.  Might it be clearer
  with the following sentence instead?
  "In a zone containing Opt-In tagged NXT records, the existence
   or non-existence of insecure delegations is asserted only by
   the records themselves (and their presence within a range
   covered by the tagged NXT records, rather than by the tagged
   NXT records themselves."

  I'm not sure if that's actually any easier to understand,
  but I think that the original text is too difficult to understand
  as it stands.  (It gets a little easier if someone reads the
  next few paragraphs and comes back, but that's not how most
  of us process information.)

Other than those very minor points, this looks to be a correct
and complete statement of opt-in as it stands.  Could someone
from the DNS "directorate", or anyone else who's keeping score,
please speak up and let the WG know whether this addresses the
issues previously raised with the opt-in drafts?  I'm not a
DNS software coder/implementer, and it still looks as though
the handling/caching/searching of opt-in tagged NXT records could
be "interesting".  From the perspective of pushing DNSSEC forward,
though, I recommend that the WG take a good hard look at this
and then make a clear decision very soon.  Is there a timetable
to finalize discussion, such as "face-to-face at Atlanta, followed
by WG last call if appropriate"???  I note that in almost a week
since the I-D was posted, there's been no discussion of it
on public forums...unless I missed one.

I can't raise any specific security objections to opt-in as proposed
(other than vague "this complicates the security model...I think"
objections), and I do believe that without it we'll have a hard time
getting DNSSEC functionally deployed to protect the entire hierarchy.

  --Rip

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Blacka <[email-masked]>
Date: Tue, 22 Oct 2002 11:39:42 -0400

>    cryptographically securing delegations to unsigned zones."

Yes, this sounds good to me.

>   of us process information.)

I agree that the original text is difficult to understand.  I will work on 
better wording for it, if I don't use yours.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research