Subject: Re: [dnssec-deployment] [dnsext] Sidestepping the root

From: Ben Laurie <[email-masked]>
Date: Sun, 01 Mar 2009 13:32:40 +0000

Paul Vixie wrote:
> On 21.02.2009, at 18:11, Ben Laurie wrote:
>> So here's an idea: why don't the TLDs who have deployed or are willing to
>> deploy DNSSEC get together and each run a DLV zone for all the others?
> 
> candidly, it's because of the trust problem.  ISC operates a DLV registry
> and it has a few TLDs in it (more now that we've imported IANA's ITAR) but
> the TLD operators are terribly concerned about kingmaking and not even ISC
> is trustworthy enough to make that concern go away.  truthfully: *noone* is.

Who would be king in the system I describe?

> i understood this better after the man from .RU shook his fist at the room
> down in atlanta, apparently the idea of russia depending on the united
> states (which is how the world sees ICANN) to authenticate their own names
> to their own users flies in the face of national sovereignty.

In the system I describe, .ru would authenticate their own names to
their own users.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Sun, 01 Mar 2009 16:59:28 +0000

> >> So here's an idea: why don't the TLDs who have deployed or are willing
> >> to deploy DNSSEC get together and each run a DLV zone for all the
> >> others?

> Paul Vixie wrote:
> > candidly, it's because of the trust problem.  ISC operates a DLV
> > registry and it has a few TLDs in it (more now that we've imported
> > IANA's ITAR) but the TLD operators are terribly concerned about
> > kingmaking and not even ISC is trustworthy enough to make that concern
> > go away.  truthfully: *noone* is.
> 

the system you describe is kingless.

> > i understood this better after the man from .RU shook his fist at the
> > room down in atlanta, apparently the idea of russia depending on the
> > united states (which is how the world sees ICANN) to authenticate their
> > own names to their own users flies in the face of national sovereignty.
> 

it has some interesting properties.  perhaps you can find a CCTLD who is
willing to deploy it, thus setting an example for other CCTLD's.  (the
first step would appear to be some kind of technote describing your
proposal.)

two notes.  first, roy arends also made a kingless proposal a few years
back but chose for whatever reason not to push forward with it.  you might
ask him "hey roy, what ever happened to your kingless DLV idea?"

second, your proposal as briefly summarized in this thread begs a question
which is "if we're going to authenticate other CCTLD keys through the local
CCTLD, then why aren't we also choosing other CCTLD nameservers through the
local CCTLD?"  that is, why shouldn't national sovereignty extend beyond
just DNSSEC to include DNS itself?  this boils down to "why wouldn't each
CCTLD just run their own root zone and each country mandate its use by law
in its own territory?"  i don't like these arguments and i'll be hitting my
"delete" key a lot when it starts, but that's where i think your proposal
will lead.  (and this is probably the reason i didn't propose it originally
when we were putting together the somewhat-kingful ISC DLV system.)

i note with no shortage of irritation that after almost 14 years we still do
not have dnssec deployed, or deployable, and that the new arguments are all
about kinglessness.  i think this means: "we suck."

---

From: Ben Laurie <[email-masked]>
Date: Sun, 01 Mar 2009 17:16:21 +0000

> when we were putting together the somewhat-kingful ISC DLV system.)

I don't see this as a sovereignty issue so much as a trust issue: as a
citizen of .uk it is easier for me to trust Nominet than, say, whoever
runs .cn. Nor do I think it should be restricted to ccTLDs, nor even
TLDs, necessarily.

But in any case, you are right: if TLDs are authoritative for keys, they
might as well be authoritative for nameservers. And what would be wrong
with that?

> about kinglessness.  i think this means: "we suck."

In what sense is it not deployable? Working fine for me...

Cheers,

Ben.

---

From: Paul Vixie <[email-masked]>
Date: Sun, 01 Mar 2009 17:30:18 +0000

> might as well be authoritative for nameservers. And what would be wrong

it's inevitable that some countries will do this.  it'll lead to chaos in
the namespace just like any other multiple-rootzone plan.  what would be
wrong?  as bruce campbell said in _army_of_darkness_: "good? bad? i'm the
one with the gun."

> In what sense is it not deployable? Working fine for me...

it's not universally deployable.  "what wizards can do" is not a good test.

---

From: Ben Laurie <[email-masked]>
Date: Sun, 01 Mar 2009 17:33:56 +0000

> it's not universally deployable.  "what wizards can do" is not a good test.

All you have to do is pick up my makefile and config and type "make" :-)