Re: DNSSEC on autopilot (was: OFFTOPIC: DNSSEC groupthink versus improving DNS)

[Mark Andrews <[e-mail]>]

> On 2008/08/12 18:08, Andrew Sullivan <[e-mail]> wrote:
> > On Tue, Aug 12, 2008 at 06:02:35PM +0200, Otmar Lendl wrote:
> > 
> > > I'm in brainstorming mode, so: Why can't 5011 be used by TLDs instead of
> > > extending the Registry/Registrar protocol? That change takes time
> > > and puts the Registrar into the critical path for DNSSEC rollout.
> > 
> > In at least some cases, two reasons:
> > 
> > 1.  The EPP extension for DS management has been ready for ages.  So
> > there's very little work to do there anyway.  It's in RFC 4310.  (Of
> > course, some registries aren't using EPP, so it's not relevant to them.)
> 
> It's not the protocol extension specification, which is the problem.
> It's getting the registrars to actually implement it and support it in
> their customer-facing interfaces. Bringing the registrar into the loop
> also might means legal work: T&Cs, liability questions, ...

	They are already in the loop.  They are already exposed.
	This happens the moment they attempt to change any record
	in the parent zone.  There is no difference between
	changing/adding a NS, A or AAAA records and DS records.

	You can do as much damage with any of them.

	Do the wrong thing and the zone is not visible or it is
	handed to a attacker.  DS records do not change that exposure
	in anyway.

	This is also a strength of DNSSEC.  It doesn't change the
	trust model.  The same person that is authorised to change
	the NS, A and AAAA records is also the same person that
	changes the DS records.

> > 2.  Many TLDs aren't actually allowed to talk to the party that has
> > administrative control of the domain.  In the ICANN world, for
> > instance, registries may only speak to the registrar, and not the
> > registrant.  This is admittedly a policy and not a technical reason,
> > but it's a reason anyway.
> 
> Acknowledged, but luckily that doesn't apply to .at.
> 
> /ol
> -- 
> // Otmar Lendl <[e-mail]>, T: [phone] - 33, F: - 933
> // nic.at Internet Verwaltungs- und Betriebsgesellschaft m.b.H
> // http://www.nic.at/  LG Salzburg, FN 172568b, Sitz: Salzburg
> 
> --
> to unsubscribe send a message to [e-mail] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]                 INTERNET: [e-mail]

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>