Subject: Re: DNSEXT WGLC: To OPT_IN or not to OPT-IN

From: David Blacka <[email-masked]>, (by way of David Blacka <[email-masked]>)
Date: Thu, 13 Mar 2003 13:52:40 -0500

[ post by non-subscriber.  with the massive amount of spam, it is easy to miss
  and therefore delete posts by non-subscribers.  if you wish to regularly
  post from an address that is not subscribed to this mailing list, send a
  message to <listname>[email-masked] and ask to have the alternate
  address added to the list of addresses from which submissions are
  automatically accepted. ]

On Wednesday 12 March 2003 11:01 pm, Ólafur Gudmundsson/DNSEXT co-chair 
wrote:
> This starts a two week working group last call,
> concluding on March 28'th 2003.
> 
> Q: Is there consensus by the WG, to allow Opt-in zones?
> 
> The document to base this discussion on is
>      
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-dnssec-opt-in-05.txt
> 
> Please send explicit statements of support or disagreement.

I support Opt-In.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: 14 Mar 2003 18:32:16 +0000

David Conrad <[email-masked]> writes:

> ...
> What I was complaining about was that the arguments raised by Olaf and 
> Scott to which you were agreeing were adding the proviso that opt-in 
> should only be used for "huge" zones.  This is, I believe, not an 
> appropriate constraint to add.

i agree.

> There aren't a whole lot of "huge" zones (and it has often been argued
> that given their size, they should have sufficient resources to deal with
> this issue without spreading the cost over every secure DNS server
> implementation) and opt-in _only_ has value if you assume only a portion
> of the full zone is signed (thus my 'temporary transition issue'
> statement).  If the protocol modification is not generally useful but
> instead is intended to address non-technical requirements for a limited
> set of users, then I personally do not believe it should be added.

the opt-in protocol enhancement is generally useful, and increases the
control that administrators have over their zone data, at the marginal
cost of some kind of purported but unmeasured implementation difficulty.

arguments against opt-in have taken one of two forms, so far.  (1) "zone
autonomy is bad, and we the people demand our right to force administrators
of foreign/distant zones to sign it all or sign nothing."  or (2) "there's
some kind of nonzero incremental complexity, which could be harmful, so we
shouldn't do it."

arguments in favour of opt-in have taken one of two forms, so far.  (1)
".XYZ needs this."  or (2) "it improves the design."

has anybody got a new argument to offer, on either side?
-- 
Paul Vixie

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 15 Mar 2003 21:47:44 -0800

> However, others have pointed out that Moore's law has caught up and 
> passed this problem.  Signing a huge zone (say 33 million 
> delegations, 
> for example) has been demonstrated to take less than 2 hours 
> on a $10K 
> box (or rather, $10K a year and a half ago) and could be done 
> faster.  

Not if you want to use FIPS certified hardware you can't.

The FIPS 140 boxes VeriSign currently buys cost $35K list (I would expect
we get a discount but I doubt that even we can buy one for $10K).

They do not perform at speeds remotely comparable to workstation or
server class hardware. 

The killer operational issue is the data volume, not the signing time.

		Phill

---

From: "Jörg Bauer/Denic" <[email-masked]>
Date: Thu, 20 Mar 2003 00:37:48 +0100

On Wed, Mar 12, 2003 at 11:01:05PM -0500, Ólafur Gudmundsson/DNSEXT 
> Please send explicit statements of support or disagreement.

I (and also speaking in the name of the .de registry, which is one of the 
"huge" problematic registries)
also prefer OPT-IN.

Joerg

--
--------------------------------------------
Joerg Bauer                     Denic eg 
[email-masked]          Wiesenhuttenplatz 26
fon: +49.69.27235180    60329 Frankfurt
                                Germany
--------------------------------------------