Subject: RE: Proposed NSEC/NSEC3 transition mechanism

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 21 May 2006 01:48:20 -0700

> [mailto:[email-masked]] On Behalf Of Edward Lewis

> Let's just take the .SE and RIPE zones.  What if they are the 
> only ones running NSEC when NSEC3 rolls out?  Do we force 
> them to undo DNSSEC for a transition phase to be like the 
> rest of the world as a penalty for being early adopters?

If it is necessary to do so: yes.

I don't think that it is necessary to develop a general transition strategy that guarantees a successful transition from every possible NSEC configuration to every possible NSEC3 configuration in order to successfully transition those domains.

I do not believe that the transition between NSEC and NSEC3 is any different to any other DNSSEC transition. If the DNSSEC transition mechanism is broken then its broken for all transitions. I do not believe that any further theorising is going to be useful until we collect experience of actually making a transition.

If you are operating core Internet infrastructure then expect to be required to make constant security upgrades. 

We are under attack from organized crime. Their tactics keep changing. We must be prepared to adapt and adjust our strategy in response.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: bert hubert <[email-masked]>
Date: Sun, 21 May 2006 11:37:02 +0200

On Sun, May 21, 2006 at 01:48:20AM -0700, Hallam-Baker, Phillip wrote:

> We are under attack from organized crime. Their tactics keep changing. We
> must be prepared to adapt and adjust our strategy in response.

We must be scaring the pants of these people with our non-zug-endet-hier
algorithms.

Also, to quote Kernighan: 

	Everyone knows that debugging is twice as hard as writing a program
	in the first place. So if you are as clever as you can be when you
	write it, how will you ever debug it?

The applies just as well to programs as to protocols. Most people would
agree DNSSEC is "as clever as we can be". It is at least for my limited
brain.

So who here honestly thinks we won't be needing NSEC4 or DNSSEC-ter?

I'm still hoping for common sense to break out. Most of us here have been
around the block more than once with protocol design, and most of us should
therefore recognise the writing on the wall by now.

Oh well..

-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services