Subject: Trust Anchor Key management issue, stalled or slow progress?

From: Thierry Moreau <[email-masked]>
Date: Fri, 20 Jan 2006 11:07:17 -0500

Dear DNSEXT wg participants:

Following the IETF-64 meeting in Vancouver, three persons
volunteered to become the editors of a requirements document
(i.e. a revision -00  Internet draft) about the DNSSEC trust
anchor key management issue. Their deadline would be February 27
(14:00 UCT) for the document to be considered at IETF-65 in
Dallas. However, the early availability of this draft is highly
desirable for an active discussion of the issues at stake in the
namedroppers mailing list.

For the record, TAK (Trust Anchor Key) configuration in a
resolver software is the very first operational requirement
before DNSSEC provide any service, i.e. the change in DNS data
retrieved by applications from "indeterminate" (the default until
a TAK is configured along the DNS name path to the root) to
either "secure," "insecure" or "bogus."

In addition, TAK management is closely related to security
procedures followed by the zone managers for zones having a TAK,
either the root or an island of trust. Indeed, the trust in a TAK
public key rests on the belief that zone managers abide by the
(perhaps implicit) procedural provisions that ensure the
continued control of the TAK private key counterpart by
legitimate zone managers. Nonetheless, the procedures are
performed behind closed doors, and their documentation is not an
explicit interoperability requirement.

In terms of time frame for making progress towards DNSSEC
deployment, TAK and NSEC3 (addressing a DNSSECbis glitch with DNS
name existence privacy) seem to be the two show stoppers these
days. I would like to share my view on the possible outcome of
lack of progress on the TAK front.

Interim solutions are adequate for TAK management in DNSSEC
prototypes and pilot projects, merely because the target DNS
resolver audience is small and made of systems which can be
configured with the skills of early adopters. Typically, an
interim solution would not provide the level of TAK rollover
automation that is going to expected from a definitive solution.
As the DNSSEC deployment grows from pilot projects to limited
field trials and then to small scale production and then growing,
it may be very hard to retrofit a definitive solution. The
experience of the PKI integration with browsers suggests the
emergence of long-lasting TAKs and pup-up windows asking end-
users to adopt a DNSKEY RR as a TAK in the local DNSSEC-aware
resolver configuration. These interim solutions might grow as
de-facto procedures, facilitating DNSSEC penetration growth, but
harming the DNSSEC potential for providing a more trustworthy
global DNS service.

According to the above view, those participants who are
interested in DNSSEC deployment as a genuine improvement in
Internet security should consider active participation.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Olaf M. Kolkman" <[email-masked]>
Date: Fri, 20 Jan 2006 16:57:48 +0100

Thierry,

Thanks for the kind reminder of what we have set out to do.

Rest assured that I am applying gentle pressure off-list. Not enough  
to provide you with an ETA on the requirements draft. So for now I'd  
say that the developments for the requirements are between stalled  
and slow progress.

For the NSEC3 work I spoke to Geoff this morning and I am expecting a  
list of open issues any time soon.

> Internet security should consider active participation.

There are times I wished I had less subtle means for driving  
motivation. Any of the well known motivation means such as pay- 
checks, sex, threats of violence, outlook on eternal fame are not  
available or seem to fail.

--Olaf

-----------------------------------------------------------
Olaf M. Kolkman
NLnet Labs
http://www.nlnetlabs.nl/

---

From: Paul Vixie <[email-masked]>
Date: Fri, 20 Jan 2006 17:38:57 +0000

# There are times I wished I had less subtle means for driving motivation. Any
# of the well known motivation means such as pay- checks, sex, threats of
# violence, outlook on eternal fame are not available or seem to fail.

ok, let's try alchohol.  if there's a requirements draft submitted before
the next ietf deadline, then the actual authors of same can count on me for
all the drinks/beer they can swallow at the ietf hotel bar for the whole week.