Subject: [dnsext] Request for adoption of draft-hubert-ulevitch-edns-ping.txt as a working group document

From: bert hubert <[email-masked]>
Date: Mon, 20 Apr 2009 22:31:30 +0200

Dear working group,

As part of the continuing forgery resilience effort, as discussed in
several meetings, David and I would like to submit the EDNS-PING draft
as a working group document.

Draft -01 has just been submitted, until it appears, it can also be
found on http://edns-ping.org/draft

Our feeling is that this draft can further both the current use of
DNS, as well as protect any future DNSSEC-enabled network from
forgeries which might disrupt operations.

As such, the applicability of this draft is broad.

We therefore hope you will support draft-hubert-ulevitch-edns-ping.txt
as a working group document.

Kind regards,

Bert Hubert

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Mon, 20 Apr 2009 16:54:11 -0400

>forgeries which might disrupt operations.

I certainly think this is on-topic for the WG.  Yes, we should take 
this on and have a discussion.

I hope we can clear address last calls and other document adoption 
requests too.
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis
NeuStar                    You can leave a voice message at +1-571-434-5468

Getting everything you want is easy if you don't want much.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 23 Apr 2009 09:23:09 +0200

On Mon, Apr 20, 2009 at 10:31:30PM +0200,
 bert hubert <[email-masked]> wrote 
 a message of 26 lines which said:

> would like to submit the EDNS-PING draft as a working group
> document.

I support the adoption (and I volunteer for the reviewing). 

The way I see the DNS security issues, DNSSEC solves most of the
problems (except hijacking on the registrar or registry side but it is
off-topic for the DNS, see
<http://www.theregister.co.uk/2009/04/22/msn_hijacking/>). But DNSSEC
is painful to deploy, not because of software but because of social
infrastructure (see Matthew Dempsky's response to Andrew
Sullivan). So, we *need* as much forgery resilience as possible, we
need a RFC 5452++.

I am aware that edns-ping protects only the channel, not the data, but
it is "better than nothing" security.

Several forgery resilience are on the table such as 0x20. To me,
cookies and edns-ping are good ideas because, conceptually, they just
increase the width of the Query ID, whose small size is at the root of
many DNS weaknesses.

My personal preference go to cookies. But I understand that there are
non-technical issues which prevent its adoption. So, edns-ping is a
reasonable substitute.

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Apr 2009 21:49:10 +0200

In your previous mail you wrote:

=> I am slightly against the adoption of the document as a WG item:
 - its security benefits are limited to hop-by-hop without on path
  attackers (note we already have standard unrestricted hop-by-hop
  protection with TSIG and SIG(0), and end-to-end with DNSSEC)
 - so it can be only a very partial to the forgery resilience issue
 - it does not provide by itself a way to force a response from a server
  (i.e., the "ping" function)
 - the option size is between 4 and 16 bytes so it does not provide
  a way to verify proper transmission with various sizes
 - so its only real function is the security one...

Regards

[email-masked]