Subject: RE: draft-arends-dnsnr-00

From: "Loomis, Rip" <[email-masked]>
Date: Thu, 22 Jul 2004 11:01:17 -0400

Roy--
But as Ben said previously,
>>>> I would argue against the use of the term "non-repudiation"
>>>> in any case

and although the examples he gives are unlikely and perhaps
do correspond to shooting of appendages, they also (to me)
show that a DNSNR does not provide non-repudiation for some
possible (although unlikely) cases.  Stating that someone
is not complying with the DNSNR proposal does not mean that
DNSNR provides a clear method, in the case of conflicting
indicators, to prove in a way which cannot be repudiated
that a record either was or was not signed.

Wasn't that the point of this discussion?

  --Rip

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Roy Arends
> Sent: Thursday, July 22, 2004 10:50 AM
> To: Ben Laurie
> Cc: [email-masked]
> Subject: Re: draft-arends-dnsnr-00
> 
> 
> On Thu, 22 Jul 2004, Ben Laurie wrote:
> 
> > Roy Arends wrote:
> >
> > > If you would have signed a record set, the DNSNR prevents 
> you denying
> > > having signed that record set.
> >
> > I don't see how - I could sign a DNSNR that denied the very 
> record set I
> > had actually signed.
> 
> There are many ways of shooting yourself in the foot. The 
> point is that
> someone can't shoot you in the foot.
> 
> > > If you would not have signed a record set, the DNSNR 
> prevents you claiming
> > > that you did.
> >
> > Again, I can sign the DNSNR without having signed the record set.
> 
> Again, there are many ways of shooting yourself in the foot. 
> If you would
> do so (I don't recommend it, this is an analogy and purely 
> hypothetical),
> you are not complying with the DNSNR proposal.
> 
> Roy
> 
> --
> to unsubscribe send a message to 
> [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
> 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Thu, 22 Jul 2004 17:18:34 +0200 (CEST)

On Thu, 22 Jul 2004, Loomis, Rip wrote:

> possible (although unlikely) cases.

The service offered with this method is a proof that a record exists, and
in the context of DNSSEC: is signed. The 'action of signing' can not be
repudiated.

> Stating that someone is not complying with the DNSNR proposal does not
> mean that DNSNR provides a clear method, in the case of conflicting
> indicators, to prove in a way which cannot be repudiated that a record
> either was or was not signed.

That is true. Please help in clarifying the text so it complies with the
service offered: authenticated denial.

Or, at least suggest a different name.

Roy