Subject: DNSEXT WGLC: DNSSEC Opt-in Process

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 26 Feb 2003 15:36:22 -0800

OK we have now had the technical review phase.

When do we start the next stage of this process, the re-opening of the
necessity of opt-in debate?

I suggest that this should start now and finish the day before the start
of the San Francisco IETF. That is March 16th.

There has been plenty of time for this debate over the past three years
and there has been consensus on numerous occasions. 

For the record...

NOTING that DNSSEC is not commercially viable in the .com and .net zones
unless a mechanism that addresses the cost of signing large numbers of
insecure delegations is adopted.

NOTING that the DNSSEC protocols have been in development for more than
a decade without significant deployment.

OBSERVING that the DNSEXT group has had three years in which to debate
the merits of the OPT-IN proposal and no alternative method of
overcomming the disproportionate deployment costs has been proposed.

OBSERVING that implementations of the OPT-IN proposal have been tested
and found to be viable.

ACTING to try to get this farce to terminate with a porposal for a
deployable protocol

IT IS ASSERTED that OPT-IN should be immediately sent to the IESG for
consideration once the minor editorial corrections suggested during last
call are completed.

		Phill

---

From: Roy Arends <[email-masked]>
Date: Fri, 28 Feb 2003 12:04:08 +0100 (CET)

> consideration once the minor editorial corrections suggested during last

We're convinced we've updated the draft to reflect the minor editorial
corrections suggested during last call, so we've sent
draft-ietf-dnsext-dnssec-opt-in-05.txt off to the Internet-Drafts
administrator. This the URL for what we've sent in:

   http://www.logmess.com/~roy/draft-ietf-dnsext-dnssec-opt-in-05.txt

The following are changes suggested by WG as per version 04:

      Added definitions for "signed name" and "unsigned name".

      Added text to make it clear that insecure delegations may have
      Opt-In NXT records of the same name.  Updated the example to have
      one of these.

      Changed Server-side requirements from MUST NOT to SHOULD NOT and
      added some basic description of what action to take in the face of
      violating the delegation-only restriction.

      Relaxed requirement that servers drop negative wildcard proof from
      MUST to MAY, reiterated the client requirement.

      Added section on Dynamic Update declaring it to be undefined wrt
      Opt-In.

      Essentially rewrote the "Security Considerations" section. It does
      not actually say anything different, but hopefully it says it in a
      clearer fashion.

      Split references into Normative and Informative.

      Fixed the example zone and responses to match Delegation Signer.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>