January 2004 - ncc-services-wg

Improved Secure Communication for Registration Services (RS) Mailboxes
by Shane Kerr 01 Mar '04

01 Mar '04

All, The RIPE NCC is nearing completion of the database phase of the "Improved Secure Communications for RIPE NCC Members" project. The next phase will focus on e-mail communication between RIPE NCC members and the Registration Services Department. The attached document presents our ideas regarding this, and also raises some questions for the membership. Please have a look, and comment. There will also be a presentation and discussion at the NCC Services Working Group next week at RIPE 47, for those interested in voicing their opinions in person. -- Shane Kerr Software Engineering Department Manager RIPE NCC Filiz Yilmaz Bican Senior Hostmaster RIPE NCC Improved Secure Communication for Registration Services (RS) Mailboxes 0. Overview ----------- This is a discussion document with the aim of obtaining members point's of view on the usage of PKI for RS mailboxes. It may result in a proposal document after such feedback is gathered. There is a need for secure communication between the RIPE NCC and its members due to the following: - discussions should be avoided with unauthorised persons representing the member organisation. - members should be able to ensure that they are communicating with the RIPE NCC. - communication with the RIPE NCC contains confidential information for the members. Accordingly, it was decided that the RIPE NCC would work on the implementation of a secure system. More information can be found at: RIPE NCC Activities, Expenditures, and Charging Scheme 2003 http://www.ripe.net/ripe/docs/ap2003.html Therefore the RIPE NCC is currently working on a "Secure Communications" project that can be found at: Draft: Improved Secure Communication System for RIPE NCC Members http://www.ripe.net/ripe/draft-documents/archive/pki-20030429.html The secure communications project has several phases as areas of communication with the RIPE NCC to implement security. Securing the communication with the RIPE NCC Registration Services (RS) is the third phase of the project. (A full description of the phases can be found at the above URL.) 1. Introduction --------------- Secure communication between a member and the RIPE NCC requires authentication, non-repudiation and data confidentiality. Most of the interaction between a member contact and a RIPE NCC Hostmaster is via e-mail. Currently, the RIPE NCC authenticates a received mail based on the "Full Name" of the member contact. This is either found in the mail headers or in the body of the mail. This is a very weak form of authentication and can sometimes result in repudiation (not accepting the sender as an authorised contact). Currently, authentication and non-repudiation requirements are only supported from the RIPE NCC by signing all outgoing mail sent to a member contact with the RIPE NCC's PGP key. It is not possible to authenticate a member through a digital signature or to send information in encrypted format. The system discussed below will meet the "authentication" and "non-repudiation" requirements for the communication between RS and member contacts (if desired). However, this is not a solution to the requirement "data confidentiality". This requirement and a possible solution to it are discussed in Section 3. 2. Discussion: Integration of X.509 PKI technology for RS Mailboxes ------------------------------------------------------------------- In order to secure the communication for "authentication" and "non-repudiation" between a member contact and a RIPE NCC Hostmaster X.509 Public Key Infrastructure will be used. The member-only mailboxes for this kind of communication are: - <hostmaster(a)ripe.net> (Internet Resource Requests mailbox) - <lir-help(a)ripe.net> (Help mailbox) The level of security can be chosen by the member contact, the options are the following: Mails from Member Contact to RIPE NCC (Incoming mails to RS mailboxes): ----------------------------------------------------------- I1. Nothing (This corresponds to the current system). I2. X.509 PKI Signed mail from the member contact is required. Mails from RIPE NCC to Member Contact (Outgoing mails from RS Mailboxes): ------------------------------------------------------------- O1. PGP Key (mail sent PGP signed with the RIPE NCC's PGP Key which is the current system). O2. X.509 PKI Signed mail from the RIPE NCC is required. The system will work in the following manner: 2.1 Initialisation of the system on the member side --------------------------------------------------- 1. The member (registry) should have an LIR Portal "admin" account. For registries without an "admin" account, the following link can be used to activate one: https://lirportal.ripe.net/lirportal/activation/activation_request.html 2. Within the "admin" account, "Administrative Preferences" (corresponding to I1 or I2 and O1 or O2 described above) should be configured. These "Administrative Preferences" will describe the preferences of the organisation so they can override the "User Preferences" (described in point 4 below) if preferred. 3. Through the "admin" account users should be created for staff members needing to contact the RIPE NCC Hostmasters. 4. Users should configure their "User Preferences" (corresponding to I1 or I2 and O1 or O2 described above) through their LIR Portal accounts. The user will only be given the list of options that match the "Administrative Preferences" set by the "admin". 5. If the user chooses O2 they should install the RIPE NCC's CA Root Certificate[1]. 2.2 Communication Flow ---------------------- 2.2.1 Incoming Mails to RIPE NCC RS Mailboxes --------------------------------------------- 1. The sender's e-mail address on the mail headers (From) will be checked against the "User Preferences" stored in the LIR Portal for the user. 2. If the "User Preferences" require I2 (X.509 PKI Signed mail from the member contact) 2.1 AND the signature is valid, the RIPE NCC RS Robot will accept the mail. 2.2 AND the signature is NOT valid OR the mail is not signed at all, the mail will be bounced back to the sender. Help information will be provided in the bounce message (see Section 2.3 HELP). 3. If the "User Preferences" require I1 (Nothing), the RIPE NCC RS Robot will process the mail (this is identical to the current situation). 4. If there is no user in the LIR Portal corresponding to the sender's e-mail address 4.1 AND the "Admin Preferences" is set to I1 (Nothing), the RIPE NCC RS Robot will process the mail (this is identical to the current situation). 4.2 AND the "Admin Preferences" is set to I2 (X.509 PKI Signed mail from the member contact), the mail will be bounced back to the sender. Help information will be provided in the bounce message (see Section 2.3 HELP). 2.2.2 Outgoing Mails from RIPE NCC RS Mailboxes ----------------------------------------------- 1. The recipient's e-mail address on the mail headers (To) will be checked against the "User Preferences" stored in the LIR Portal for the user. 2. If the "User Preferences" require O2 (X.509 PKI Signed mail from the RIPE NCC) the mail will be signed with the RIPE NCC's certificate (On the user's end, this signature can be validated through the installed CA Root Certificate of the RIPE NCC). 3. If the "User Preferences" requires O1 (PGP Key), the mail will be signed with the RIPE NCC's PGP key (this is identical to the current situation). 4. If there is no user in the LIR Portal corresponding to the recipient's e-mail address 4.1 AND the "Admin Preferences" is set to O1 (PGP Key), the mail will be signed with the RIPE NCC's PGP key (this is identical to the current situation). 4.2 AND the "Admin Preferences" is set to O2 (X.509 PKI Signed mail from the RIPE NCC), the mail will be signed with the RIPE NCC's certificate (On the user's end, this signature can be validated through the installed CA Root Certificate of the RIPE NCC). 5. If there are multiple recipients (multiple addresses in To and/or Cc), the mail will be sent containing multiple MIME parts. Each of these MIME parts will contain specific security according to each recipient's case as described above. In summary, there will be flexible options for those members willing to deploy more security in their communication with the RIPE NCC RS. There will be no implications to members who are not willing to deploy such a security system. There will also be no implications to members who do not have an LIR Portal "admin" account activated. 2.3 HELP -------- In case a mail is bounced back due to the failure in verification of the signature, the mail will contain instructions explaining possible reasons for the problem and pointers on how to solve it. It will also provide an e-mail address to contact about the problem. 3. Future Developments/Phases ----------------------------- The system discussed above is open to changes in accordance to member feedback. One of the possible future developments could be the integration of this system to other RIPE NCC RS mailboxes, e.g. <inaddr(a)ripe.net>, <reg-review(a)ripe.net> etc. As mentioned earlier, the system discussed above is only a solution to the "authentication" and "non-repudiation" requirements. It is not a solution to the "data confidentiality" requirement. Data confidentiality can only be met once the communication is in an encrypted format. This can be achieved with the usage of X.509 PKI technology. Once this is implemented other security options for "Admin Preferences" and/or "User Preferences" can be added as follows: Mails from Member Contact to RIPE NCC (Incoming mails to RS Mailboxes): ----------------------------------------------------------- X.509 PKI encrypted mail from the member contact is required X.509 PKI signed and encrypted mail from the member contact is required. Mails from RIPE NCC to Member Contact (Outgoing mails from RS Mailboxes): ------------------------------------------------------------- X.509 PKI encrypted mail from the RIPE NCC is required The encryption process requires a more detailed set of definitions and rules to be clarified before any technical implementation can take place. For such a set of definitions and rules to be outlined, the RIPE NCC needs input from the members. Some pointer questions regarding encryption are listed below that require feedback from the community: - Do members' security concerns in communication with the RIPE NCC require this type of security? - Should all mails to the RIPE NCC RS mailboxes be encrypted? - Should all mails from the RIPE NCC RS mailboxes be encrypted? - Should there be different levels of security for different mailboxes? - Should there be different levels of security for incoming and outgoing mails to/from the RIPE NCC RS mailboxes? - Should there be different levels of security depending on the content of the messages. (For example to indicate sensitive content, every ticket initiated with an encrypted message should carry on as encrypted.) - If all the keys expired for a registry which "prefers" an encrypted communication and the RIPE NCC needed to contact the registry, how should this communication be initialised by the RIPE NCC? - How should the encryption be done when there are multiple recipients, or where "User Preferences" do not match? - How should the encryption be done when there are different registries involved in communication in specific cases, for example mergers and takeovers? - How/what should be the back-up system if the encrypted format cannot be processed by the member contact or by the RIPE NCC for some reason? Please provide your feedback to the following: - <pki-suggestions(a)ripe.net> or - <ncc-services-wg(a)ripe.net> Feedback can also be given during the RIPE NCC Services Working Group at RIPE 47, 26-30 January 2004, Amsterdam. [1] CA Root Certificate: Certification Authority Certificate. The RIPE NCC will be the Certification Authority (CA) in this system.

9 25

Call for participation: Inter-Domain Routing Workshop, RIPE NCC, Amsterdam (May 1-2, 2004)
by Matthew Williams 29 Jan '04

29 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [Apologies for duplicate mails] Dear All, The Inter-Domain Routing Workshop will take place at the RIPE NCC in Amsterdam during the weekend before RIPE 48 (May 1-2, 2004). This RIPE meeting will also be held in Amsterdam. The goal of the workshop is to bring together a small, focused group of operators, vendors, and researchers to discuss important mid- and long-term operational problems, measurement techniques, router features and network management tools in an open forum. We hope that these discussions will become invigorating and lively affairs. The organisers are: * Intel Research * Universität Karlsruhe Institut für Telematik * Technische Universität München, Computer Science Department * RIPE NCC * Schlund+Partner AG, Karlsruhe See URL for more information: http://www.tm.uka.de/idrws/ Please feel free to contact us at idrws(a)ripe.net. Kind regards, Matthew Williams --- > Matthew Williams (MW243-RIPE) > Customer Liaison Engineer > RIPE NCC - http://www.ripe.net/np/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBQBkZ7cHkFbJe+GdoEQJKbQCgyTm+QIa56CitJWmwUYo+npNBaXkAoMWx X5ARDhRm+LKb9TOzn81pBHgO =Xpyi -----END PGP SIGNATURE-----

1 0

RIPE NCC Services Desk and Liaison Lunch Table at RIPE 47
by Membership Liason Officer 23 Jan '04

23 Jan '04

Dear colleagues, With respect to the RIPE 47 meeting being held in Amsterdam, the RIPE NCC has planned a RIPE NCC Services Desk and a Liaison Lunch Table. The RIPE NCC Services Desk is a contact point for information about services provided by the RIPE NCC. RIPE NCC members and RIPE Meeting participants are encouraged to give input and feedback on these services. For more information about a specific service, please feel free to speak to one of the RIPE NCC representatives at the Services Desk. They will be happy to answer your questions and/or introduce you to the appropriate RIPE NCC staff member. The RIPE NCC Services Desk will be open at the following times: Monday 14:00 - 17:30 Tuesday 9:00 - 12:30 and 14:00 - 17:30 Wednesday 9:00 - 12:30 and 14:00 - 17:30 Thursday 9:00 - 12:30 and 14:00 - 17:30 Friday 9:00 - 12:30 Liaison Lunch Table RIPE 47 Meeting participants are welcome to join the Liaison Lunch Table in the Wintergarden Restaurant, Monday - Friday between 12:30 and 14:00. Please use this opportunity to join us and talk about the services of the RIPE NCC in an informal manner. Who can you meet at the RIPE NCC Services Desk and the Liaison Lunch Table? Nathalie Dougall has recently joined Sabrina Wilmot as a Membership Liaison Officer (MLO). Nathalie and Sabrina are responsible for planning, implementing, and managing regional outreach to members of the RIPE NCC, throughout its service region. They also organise local meetings within the RIPE NCC service region that include current and potential RIPE NCC members, government representatives, and industry partners. The Membership Liaison Officers are responsible for analysing member needs and identifying opportunities to enhance the RIPE NCCs service to its members. Matthew Williams is the Customer Liaison Engineer (CLE) in the RIPE NCC New Projects (NP) group. The New Projects department is dedicated to Internet data collection and performance measurements for the benefit of the community. Matthews responsibilities are to interact with the users of the various projects in the group, the Routing Information Service (RIS) in particular, and to turn their requirements into new products and services. One example is the myASn project, which provides a notification system for BGP in cases of unexpected routing behaviour and is integrated into the RIPE NCC LIR Portal. Other services developed by New Projects include RISwhois, DNS Monitoring (DNSMon) and Test Traffic Measurements (TTM). Carsten Schiefner is part of the Communications Group and is responsible for various aspects of RIPE NCC external relations. This includes interacting with entities that are not members of the RIPE NCC, such as governments, regulators, ISP and Telco associations, as well as European institutions and the ITU. The main goal is to increase the RIPE NCCs outreach and to develop greater awareness of the principles of RIPE, the RIPE NCC and the traditional Internet model of bottom-up, consensus-based industry self-regulation. We look forward to seeing you at RIPE 47 in Amsterdam! Kind regards, Sabrina Wilmot & Nathalie Dougall Membership Liaison Officers RIPE NCC

1 0

Updated agenda - now with the right dates
by Kurt Erik Lindqvist 22 Jan '04

22 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It was pointed out to me that I had the wrong dates..... Tue 27/1 14.00-15.30 ==================== A. Agenda bashing / Kurtis Lindqvist 5 minutes - Scribe - minutes - Agenda B. Update from the RIPE NCC / Axel Pawlik C. RIS and TTM service update / Henk Uijterwaal 10 min. D. Co-Chair for the Working Group / Kurtis Lindqvist 5 minutes Thu 29/1 11.00-12.30 ==================== E. Proposal for announcement mailinglist / Wilfried Woeber 10-15 min. F. X.509 Support in the robot / Shane Kerr 10-15 mins G. Regitrations services update / Leo Vegoda 10-15 mins. H. RIPE NCC Training activities / Rumy Kanis 10-15 mins. I. Routability testing / Kurtis Lindqvist / Daniel Karrenberg 10-15 min J. Open mike session Best regards, - - kurtis - -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQA90+qarNKXTPFCVEQJ4/gCgkWnT7Idc9GAQVXf3lj49BvJ51WYAn3ut 5fai3BmmjrEpXDyuQBczPzYb =SbQG -----END PGP SIGNATURE-----

1 0

DNS Related Policy and Procedure Proposals
by Olaf Kolkman 21 Jan '04

21 Jan '04

Dear Colleagues, Apologies for duplicate mails. Shortly after this mail we will be sending two separate mails to the DNS Working Group mailing list. We will also be posting a draft policy document (see below). These mails also have relevance to the RIPE NCC Services and Database Working Groups. The two messages and revised policy document are part of a project started in October 2003 to streamline and simplify the process of requesting and managing reverse DNS delegation for the holders of the address space allocated or assigned by the RIPE NCC. The original proposal can be found at: http://www.ripe.net/reverse/proposal.html The content of the mails are: - A proposal for the introduction of a new "mnt-domains:" attribute in INETNUM objects to authorise the creation of DOMAIN objects. This proposal also suggests making "mnt-by:" a mandatory DOMAIN object attribute. This authorisation mechanism will enable address space users to delegate the responsibility for maintaining reverse address space to third parties in a flexible manner. - An assessment of the consequences of the introduction of the "mnt-domains:" attribute and of the "mnt-by:" attribute being made mandatory. The reverse delegation policy has been revised, relaxing the terms under which reverse delegation will be serviced and providing the framework to implement the authorisation mechanism described above. The draft "Policy for Reverse Address Delegation of IPv4 and IPv6 Address Space in the RIPE NCC Service Region" can be found at: http://www.ripe.net/ripe/draft-documents/reverse-draft-200401.html We would like to invite your comments on this. Please discuss these proposals on the DNS Working Group mailing list. More information can be found at: http://www.ripe.net/reverse/rdns-project/ -- Olaf Kolkman New Projects Group RIPE NCC

2 1

Fwd: RIPE 46 - Minutes of Ripe NCC Services WG
by Kurt Erik Lindqvist 21 Jan '04

21 Jan '04

Please send corrections / comments. Best regards, - kurtis - Begin forwarded message: > From: Sabrina Wilmot <sabrina(a)ripe.net> > Date: mån sep 29, 2003 13:06:11 Europe/Stockholm > To: Kurt Erik Lindqvist <kurtis(a)kurtis.pp.se> > Subject: RIPE 46 - Minutes of Ripe NCC Services WG > > Hi Kurtis, > > Please find below the minutes of the Ripe NCC Services WG at RIPE 46. > > Regards, > Sabrina > RIPE NCC > > >> RIPE 46, Amsterdam >> >> Working Group: Ripe NCC Services >> Chair: Kurt Erik Lindqvist >> Scribe: Isabel Pinto Coelho Sena >> >> Agenda: >> >> Slot 1, Tuesday 2/9 14.00-15.30 >> >> 1. NCC Services WG Charter (Kurtis) >> 2. RIPE NCC Services Direction (Axel Pawlik) >> Service level and activities 2004 >> 3. RIPE NCC Information Services >> 4. Discussion & input time / Open Mic session >> >> Slot 2, Thursday 4/9 11.00-12.30 >> >> 5. Presentation on X.509 and certificates (Dirk-Willem van >> Gulik). >> Discussions around the x.509 implementation of the RIPE NCC >> and what other RIRs have done. >> 6. DNS Services - Modification Plans >> 7. Proposals from the community >> 8. Discussion & input time / Open Mic session >> X. AOB >> Z. Close >> ________________________________________________________________ >> >> 1. NCC Services WG Charter >> >> WG Charter presented. No objections were made to it's content. >> >> 2. RIPE NCC Services Direction (Axel Pawlik, Managing Director >> RIPE >> NCC) >> Service level and activities 2004 >> >> See Axel's presentation at >> >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-ncc-services.pdf >> >> Kurtis Lindqvist : Who has read/seen the Member Update? >> [~20 people raised their hands] >> Kurtis Lindqvist : Who here are Members? >> [~60 people raised their hands] >> >> 3. RIPE NCC Information Services >> >> See Axel's previous presentation from slide 27 onwards >> >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-ncc-services.pdf >> >> 4. Discussion & input time / Open Mic session >> >> >> Kurtis Lindqvist : Are there any questions for Axel? >> [No one had questions] >> >> Kurtis Lindqvist : I have one myself: You spoke of the data you have >> that can be used to educate journalists, where do you want to push >> them, just as a general awareness? >> >> Axel Pawlik (MD RIPE NCC): We want them to know that we are working >> well, we want the industry to tell them "do not interfere, they work >> well". As an example: name servers >> >> Kurtis Lindqvist: Any other questions? >> [None were raised] >> >> Kurtis Lindqvist : please register for the GM >> >> Axel Pawlik : there was a heated discussion on the mailing lists? >> None now? >> [None responded] >> >> Rob Blokzijl (RIPE Chairman): I'm surprised that there is no one that >> is willing to discuss the issues off the mailing-list, so I will bring >> up 2 issues that were often discussed. First one is: Whether all these >> services that the RIPE NCC offers are needed? I would like also to >> point that there was no discussion on whether they are _useful_ >> however. Then there was the issue of a flat free financial >> contribution versus a supermarket scenario? Meaning that one could >> pick and choose the services one is willing to pay and have use for. >> >> Wilfried Woeber (Vienna University - ACOnet): I've observed through >> the years another organization where the same discussion was going on >> for years, started out as a flat free and then some started to object >> to this model. In the end, they found the most reasonable solution: >> you buy all or nothing. It is difficult to find out which activities >> are optional and which mandatory. Individual amount, increasing the >> administration overhead that goes along with keeping up with this >> supermarket model, this will not come for free... The complexity that >> we might inject into the subject is not going to be easy. It also >> splits the RIPE Community into 2 / 3 / 4 camps. Copyrighting on >> certain Services, making people pay for copies. It will de-stabilise >> the RIPE NCC and the Community. >> >> Kurtis Lindqvist: Well, a number of people are questioning the order >> and priority of the activities. >> >> Rob Blockzijl (RIPE Chair): I hope that one of the results of having >> this WG is to make people remember why certain services were created >> in the past, as the NCC did not just came up on a idle afternoon with: >> "let's create an activity". The NCC has always listened to the >> Community's input. It might not have been clear as to where and when >> the decisions were taken, that's why I'm glad we have this WG. Having >> it, it is possible to revisit the past and re-evaluate current >> services, although it might be more constructive to look at the future >> and we can improve. >> >> Kurtis Lindqvist : How many of you have read the Activity Plan? >> [~10 max raised their hands] >> I'm concerned because some people on the mailing list indicated that >> they can not influence the AP, but most here have not read it. >> >> Kurtis Lindqvist : If there are no other questions I'll see you all on >> Thursday. >> >> FINISH >> >> NO ACTIONS >> >> _______________________________________________________________ >> >> Slot 2, Thursday 4/9 11.00-12.30 >> >> 5. Presentation on X.509 and certificates (by >> Dirk-Willem van Gulik - apache) >> Discussions around the x.509 implementation of the RIPE NCC >> and what other RIRs have done. >> 6. DNS Services - Modification Plans (Olaf Kolkman) >> 7. Proposals from the community >> 8. Discussion & input time / Open Mic session >> X. AOB >> Z. Close >> >> ________________________________________________________________ >> >> 5. Presentation on X.509 and certificates (by >> Dirk-Willem van Gulik - apache) >> Discussions around the x.509 implementation of the RIPE NCC >> and what other RIRs have done. >> >> Kurtis Lindqvist: As there were quite a lot of questions on the >> mailing list about X.509, we will have a presentation about it and >> also invite the other RIRs to explain what they are doing in their >> region. Also, at the last session I forgot to mention that we might >> require a co-chair, as it is mentioned in the charter. >> >> Dirk-Willem van Gulik: This presentation focuses mainly on the issue >> of trust, not as much on the technical aspects of X.509 >> >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-pki-x509.pdf >> >> Kurtis Lindqvist : any questions ? >> [None] >> >> Presentation by Andrei Robachevsky, Chief Technical Officer, Ripe NCC >> >> "PKI development at the RIPE NCC" >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-pki.pdf >> >> Kurtis Lindqvist: any questions? >> >> Taiji Kimura from JPNIC: are there plans for non-repudiation of the >> query, validate queries to the DB? >> >> Andrei Robachevsky : no, this is not about the DB itself, but more >> about correspondence with the NCC. >> >> Wilfried Woeber (DB WG Chair): We have been discussing whether we want >> to introduce a system to tag objects in the DB with the auth method >> that was used for the last update of the object. This is an idea that >> we have been playing with, if the community wants this, then please >> come forward with a plan. >> >> Wilfried Woeber: About integrating a Certification Authority across >> RIRs, I would recommend to first try it in our region, find out if it >> works well. I'm not a fan of having hierarchy in the trust >> model. Individual registries should do it in their region, then we >> find out what we need to cross the borders. I would not like RIRs to >> all go to Verisign for instance. >> >> Janos Zsako (RIPE NCC Executive Board): about message signing, we live >> with the assumptions that the db is in a secure server, so whether >> after the modification/update with PKI the data is still stable is >> questionable. We can store the update method, again assuming that the >> db cannot be corrupted in the mean time. So we need a system that >> verifies that the db has not been corrupted. >> >> Kurtis Lindqvist: in conclusion, issue is if queries and/or DB entries >> must be signed, and whether the content of the DB is secure, but this >> is maybe more a topic for the DB WG. >> >> ARIN - Ginny Listman: >> >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-arin-x509.pdf >> >> APNIC - Anne Lord: we are doing the same as Ripe NCC, issuing >> certificates for our equivalent of the LIR Portal, MyApnic. We have >> issued 500 certificates so far. >> >> LACNIC Raul Echeberria: we would like to implement a certification >> system before 2004. Right now we are still working on the budget that >> would be needed for it. >> >> Kurtis Lindqvist: Thank you all. >> >> 6. DNS Services - Modification Plans (Olaf Kolkman) >> >> http://www.ripe.net/ripe/meetings/ripe-46/presentations/ripe46- >> nccserv-rdns.pdf >> >> Kurtis Lindqvist : I like the idea, any questions ? >> [None] >> >> 7. Proposals from the community >> 8. Discussion & input time / Open Mic session >> >> Kurtis Lindqvist: Now we have the open mike session: floor is open. In >> future sessions I would like to have people's presentations or >> proposals in writing on the mailing list before they are presented at >> RIPE Meetings >> >> Hank Nussbacher (IUCC): I have been asked by many people to speak up >> during this WG as I have sent some emails to the mailing list. My view >> is that a lot of the members had their budget cut and the NNC has not >> had their budget cut in the same fashion. We are apathetic, 2250 euro >> is not that much to warrant that people can spend 250 euro/1 hour of >> their time on the mailing list. There are many good things in the NCC: >> DB group is the world leader. But to evaluate how the NCC is spending >> their money we need a more transparent Activity Plan. For instance for >> the trainings, they are free of charge. I would like to know the >> budget and man-power needed for these free trainings. Instead, it's >> budget is incorporated in the RS budget, there is no way to know how >> much of that is used for the trainings, there is no break-down of the >> costs. The TTM group, IRT - there has been nothing mentioned about it >> at this meeting BTW - there is nothing about it in the AP, therefore >> we do not know the manpower and budget it needs, the only way to know >> for the membership is to have a break-down and it does not exist. 10 >> to 20 people have responded to my mails, which is not really enough to >> know what the majority of the community thinks about these issues. >> >> Kurtis Lindqvist : yes, people do not care, like we saw at the last >> session on Tuesday, that only a handful read the AP. I guess the >> majority is happy, but that is difficult to double-check, people do >> not go on the mailing list only to say that they are happy. Next year >> at the RIPE Meeting in May, the NCC will give more insight on the >> budget & AP and there will be more time for comment before the Annual >> Meeting 3 months later. >> >> Axel Pawlik: The level of detail we give in the financial report, >> question is: how deep should we go into detail? For the trainings yes, >> not so difficult. I will work together with the Board to see what we >> can adapt. And I would like to clarify that the IRT is not really an >> incident response team, it is not a separate team as such. It is an >> activity. >> >> Hank Nussbacher : let's say that the TTM group costs a 300.000 >> euros/year, but we can get the same service from a commercial >> company. Why not do a market survey before introducing a new activity? >> >> Axel Pawlik: About the TTM, there is a lot of info about it in the AP. >> >> Daniel Karrenberg: I worry because of economic problems. Training, if >> the membership wants more transparency, OK, but whether it is really >> necessary? Why train New LIRs, what do I care? As one of the persons >> who started with these trainings, I would like to clarify that they >> are not done only for the benefit of the trainee, but to the whole >> community as well. Creating a well oiled community. The better things >> work, the less interaction at the NCC. Also, the NCC would not be as >> accepted without trainings. For many people, it is only by attending >> the courses that they understand and accept the NCC's role. Just >> looking at it from a financial point of view, if you do that too much, >> you might risk the NCC as a whole organisation. You want and need the >> NCC to be more stable than the rest of the members. The impact of the >> NCC crumbling is a whole lot different. I also would like to remind >> people that one of the ways for us to ensure impartiality and >> neutrality is by hiring international staff, this is expensive. Were >> we to be driven only by financials, we would not hire from Turkey or >> Africa. Yes, lets have a look at the financials, but lets us not be >> driven by it. Because it might be good for today, but not for >> tomorrow. >> >> Kurtis Lindqvist: I agree, but showing the members the budget is not >> saying that you are doing things bad. There are 2 issues: >> 1) transparency on costs and >> 2) evaluation of activities and how they benefit the community. >> >> Hank Nussbacher: Some services are excellent. But whether it benefits >> the community that someone goes to all the ICANN Meetings, it is >> needed, but the members might think it is not. In the same way that >> the Membership would live, accept to still have mail-from auth, but we >> have it better. >> >> Kurt Kayser (N-IX Nurnberg Internet eXchange) : About the trainings, a >> while back I proposed to find partners in countries, we could offer >> the service to train people in German, since we are very familiar with >> all the policies & procedures. But I never heard anything about this >> from the NCC. >> >> Axel Pawlik : We are looking at better ways of doing our >> trainings. People like our trainings but it does not scale, your >> proposal does scale. But how do we do it, how is that training >> standardised, do we need to certify trainers ??? But we are definitely >> looking at it. >> >> Daniel Bovio (RIPE NCC Board): Hank said that the "silent majority" do >> not care to show up at meetings, or communicate on the >> mailing-list. This is a problem, they do not know what the activities >> are. We, the RIPE Community, have always been the main source for >> ideas to the NCC and their activities. The Board needs to go on with >> these activities anyway, try to involve members, find out what they >> want, the survey was good in this respect. This group is the main >> source of the main ideas, there is a vast group that don't care, >> others do and those end up leading were the ship is going. We do not >> get enough feedback. >> >> Kurtis: Thank you all for coming >> >> FINISH >> >> NO ACTIONS >>

1 1

Updated agenda for NCC-Services WG @ RIPE47
by Kurt Erik Lindqvist 20 Jan '04

20 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Tue 27/1 14.00-15.30 ==================== A. Agenda bashing / Kurtis Lindqvist 5 minutes - Scribe - minutes - Agenda B. Update from the RIPE NCC / Axel Pawlik C. RIS and TTM service update / Henk Uijterwaal 10 min. D. Co-Chair for the Working Group / Kurtis Lindqvist 5 minutes Wed 29/1 11.00-12.30 ==================== E. Proposal for announcement mailinglist / Wilfried Woeber 10-15 min. F. X.509 Support in the robot / Shane Kerr 10-15 mins G. Regitrations services update / Leo Vegoda 10-15 mins. H. RIPE NCC Training activities / Rumy Kanis 10-15 mins. I. Routability testing / Kurtis Lindqvist / Daniel Karrenberg 10-15 min J. Open mike session - - kurtis - -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQAzs1KarNKXTPFCVEQKbwACgjAbBqX/mHb3kupb1wtu/OmBituoAnR0e scVR3eZpVenbm/nKazeDoRKK =kqIp -----END PGP SIGNATURE-----

1 0

Agenda for RIPE 47
by Kurt Erik Lindqvist 18 Jan '04

18 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Proposed agenda for RIPE 47 for RIPE NCC Services WG. Note! If you submitted an agenda item and didn't make it, it's because I screwed up and deleted some mails. Please re-submit then! Best regards, - - kurtis - Tue 27/1 14.00-15.30 ==================== A. Agenda bashing / Kurtis Lindqvist 5 minutes - Scribe - minutes - Agenda B. Update from the RIPE NCC / Axel Pawlik C. Co-Chair for the Working Group / Kurtis Lindqvist 5 minutes Wed 29/1 11.00-12.30 ==================== D. Proposal for announcement mailinglist / Wilfried Woeber 10-15 min. E. X.509 Support in the robot / Shane Kerr 10-15 mins F. Regitrations services update / Leo Vegoda 10-15 mins. G. RIPE NCC Training activities / Rumy Kanis 10-15 mins. H. Open mike session -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQApjRaarNKXTPFCVEQL7gwCfSW6kszECw44UCrwV6jnzgrHR7gAAn2yE YDyQiWBbrxyP2g6dbEHkFFZN =3lkb -----END PGP SIGNATURE-----

1 0

Erroneous Domain Cleanup Messages
by Olaf Kolkman 13 Jan '04

13 Jan '04

Dear Colleagues, Apologies for duplicate mails. == Introduction We recently informed the Working Groups about the start of a cleanup of inconsistencies between data in our reverse DNS and data in the Whois Database [1]. Since Wednesday 7 January, 2004 we have been sending out warning messages. Unfortunately a number of messages were sent out in error. == The Problem Due to a bug in the script, messages have been sent to contacts for /24 DOMAIN objects that have a more specific /16 object, stating that there are no matching NS RRs in the zone files and that the DOMAIN object will be deleted. This has been done in error and these DOMAIN objects will remain unaltered. The contacts for these /24 DOMAIN objects will be sent a message shortly confirming that their objects will remain unaltered and that no further action is required on their part. == Background The Whois Database holds informational data for domains in the reverse tree. The database holds information about reverse domains corresponding to /8, /16 and /24 address space. The '/8 domain' zone files at the RIPE NCC only contain NS RRs for the delegation corresponding to the most less specific address block. If there is a /16 DOMAIN object and a number of more specific /24 DOMAIN objects in the database only a delegation will be created corresponding to the /16 DOMAIN object. In other words, if the /16 domain has been delegated one cannot delegate its children any longer. Therefore, the absence of the NS resource records corresponding to the "nserver:" attributes in the /24 DOMAIN objects is not an error. Note: for End Users it is not obvious if an NS RR is in the zone files of the RIPE NCC since ns.ripe.net is a secondary DNS server for the /16 zones. Our apologies for any confusion and extra work this may have caused. For further clarification please do not hesitate to contact <ripe-dbm(a)ripe.net>. --Olaf Kolkman New Projects RIPE NCC [1]: http://www.ripe.net/ripe/mail-archives/dns-wg/2004/msg00000.html Further information about the cleanup project can be found at: http://www.ripe.net/reverse/rdns-project/cleanup.html

1 0

Agenda items....
by Kurt Erik Lindqvist 13 Jan '04

13 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A small reminder of the agenda for the upcoming RIPE47. So, if you have something you would like to present or discuss.... - - kurtis - -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBQAOTpaarNKXTPFCVEQKJbQCghHY/8dElwAPC/vNHwuHIDvzJowsAoIi+ Bkvd8wPqlJsuU+Y87SSNGsCn =an2y -----END PGP SIGNATURE-----

1 0