Re: [Danish] Proposed WG Charter

[Paul Wouters <[e-mail]>]

On Tue, 15 Jun 2021, Ash Wilson wrote:

> It is easier to justify the adoption of DNSSEC as a part of a broader initiative that adds some business value beyond improving the security of an
> existing use case.
>
> Within an organization which has not already adopted DNSSEC, it is easier to justify initial exploration into a design pattern if DNSSEC is not in the
> initial set of requirements. This makes the assumption that exploration happens with oversight of enterprise technical leadership.
> 
> It is easier to justify the adoption of DNSSEC to business leadership if it increases the value of an existing initiative, which is already showing
> success. The risk/return balance then has some demonstrated benefit, which makes a stronger argument against perceived risk.

These arguments all applied to PKIX as well. Getting SSL on your server
was "too hard" and "too cumbersum" and traction was really low to
improve that, despite the strong case for it giving additional security.

Then ACME and LetsEncrypt came and automation solved this problem.

If DNSSEC is too difficult to do inhouse now, let your DNS hoster do it.
Route 53 supports it via a checkbox. Cloudflare supports it via a
checkbox. One click, done. Keep using the same TLS REST API to submit
DNS updates. It just gets signed.

Maybe some opensource tools need improving, eg lets get octodns to
support DNSSEC fully. Let's improve knot/bind's methods for "editing"
a zone so it works with DNSSEC.

> If DNSSEC is in the initial set of requirements for DNS-based IoT device identity, the desire to experiment with DNS-based device identity faces an
> increased likelihood of rejection when compared to an adoption path where DNSSEC is an eventual, rather than an initial, requirement.

I would really prefer the IETF does not engage with putting security
aspects in DNS records that are spoofable, and depend on a pluggable
non-DNS security stack for validation of these insecure records.

> Offering a transitional mode will make DNSSEC easier to justify

The transition mode will never transition further towards DNSSEC. And
as pointed out in this thread, that would be harmfull to DNSSEC
deployment, not helping transition to it.

> but I think that we can both agree that some positive effect on the overall adoption of DNSSEC will result from having a transitional mode.

I don't think so.

Paul