Subject: RE: Summary: DNSEXT WGLC: To OPT-IN or not to OPT_IN

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 29 Apr 2003 05:51:38 -0700

> Without opt-in, there's a clear difference between the current .com
> security disaster (all records from .com can be forged) and 
> the desired
> situation (no records from .com can be forged).

As has been stated during the discussion on the OPTIN proposal the
security considerations of an unsecured delegation and a secured
delegation to an unsecured zone are exactly the same except in
one regard - an unsecure delegation is subject to a record 
insertion attack, a risk that is not relevant to the .com zone.

> With opt-in, the .com people will start proudly advertising ``DNSSEC
> support'' (exactly as the BIND implementors have been doing for years)
> when they still aren't protecting all their incoming and 
> outgoing data.

> This seems to be the basic reason that they support opt-in---they want
> to claim security without doing the necessary work.

No, without doing unecessary work.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "D. J. Bernstein" <[email-masked]>
Date: 30 Apr 2003 06:44:03 -0000

Hallam-Baker, Phillip writes:
> the security considerations of an unsecured delegation and a secured
> delegation to an unsecured zone are exactly the same

The same argument cuts both ways. To fix the existing security disaster,
we have to secure all the zones _and_ we have to secure the delegations.
If the .com people were prepared for this, they wouldn't need opt-in.

Opt-in allows the .com people to claim full DNSSEC support when the
reality is that they can't handle a DNSSEC universe. It takes a failed
security system and tries to pretend that it's a working system.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago