November 2008 - ripe-list - mailman.ripe.net

Call for Support: RIPE response to the US NTIA's NoI
by Mohsen Souissi 18 Nov '08

18 Nov '08

Peter, Jim & all, Speaking individually as a member of the RIPE community, I fully support version 1.9 of the document submitted on this mailing-list, in the same way I supported v 1.8 submitted on the dns-wg mailing list. Thanks for Jim, Peter and all the team members who worked hard and with great patience to find a wording convenient to/acceptable by most -if not all- people. Mohsen.

1 0

Call for Support: RIPE response to the US NTIA's NoI
by Niall Richard Murphy 18 Nov '08

18 Nov '08

I support this text. NRM

1 0

Re: Call for Support: RIPE response to the US NTIA's NoI
by Ralf Weber 18 Nov '08

18 Nov '08

Moin! I would like to than all the people who contributed to the document. The version 1.9 posted to this mailing list on the 14th of November by Peter Koch is an appropriate response to the NTIA questionnaire and has our support. So long -Ralf --- Ralf Weber Platform Infrastructure Manager Colt Telecom GmbH Herriotstrasse 4 60528 Frankfurt Germany DDI: +49 (0)69 56606 2780 Internal OneDial: 8 491 2780 Fax: +49 (0)69 56606 6280 Email: rw(a)colt.net http://www.colt.net/ Data | Voice | Managed Services Schütze Deine Umwelt | Erst denken, dann drucken ***************************************** COLT Telecom GmbH, Herriotstraße 4, 60528 Frankfurt/Main, Deutschland * Tel +49 (0)69 56606 0 * Fax +49 (0)69 56606 2222 * Geschäftsführer: Albertus Marinus Oosterom (Vors.), Rita Thies * Amtsgericht Frankfurt/Main HRB 46123 * USt.-IdNr. DE 197 498 400

1 0

Re: Call for Support: RIPE response to the US NTIA's NoI
by Richard Lamb 18 Nov '08

18 Nov '08

Peter- I fully support the v1.9 text. Your hard work is appreciated. -Rick On 14 Nov 2008, at 16:59, Peter Koch wrote: Dear RIPE Community, as mentioned in my email sent on Monday, the DNS working group has come up with a response to the US NTIA's Notice of Inquiry (NoI) regarding the introduction of DNSSEC for the DNS root zone (for details see <http://www.ntia.doc.gov/DNS/DNSSEC.html>). The text below reflects the consensus of the DNS working group. As a follow up to our earlier efforts (see below), the DNS WG suggests that the response to the NTIA come from the broader RIPE community. So, this is the DNS WG's request for your support and endorsement of the proposal. Please read the text and voice your support or opposition. As mentioned earlier, we will have to meet an external deadline. Therefore, we are not looking for editorial suggestions. Regrettably, it is impractical to further refine or reword the text, since that would require more editing cycles and new consensus calls, which time won't permit. The WG chairs' collective and the RIPE Chair have agreed that it needs a binary decision on the proposal as presented here. It is possible that the text doesn't represent the optimum for everyone. Still, please consider whether you can support it as a community statement. In any case, the NoI is open for anybody, so you might want to send your individual response and/or contribute to other group efforts, as well. Clarifying questions are welcome, probably best asked on the DNS WG mailing list or to the DNS WG co-chairs <http://www.ripe.net/ripe/wg/dns/index.html>. Given the 24 Nov deadline and to allow some time for the evalutaion of the list traffic, you are kindly asked to send your explicit statements to this list no later than Friday, 21 Nov 2008 12:00 UTC. Thanks in advance for your consideration! -Peter Koch [DNS WG co-chair] ----------------------------------------------------------------------------- # # $Id: ntia-draft,v 1.9 2008/11/13 20:20:41 jim Exp $ # The RIPE community thanks the NTIA for its consultation on proposals to sign the root and is pleased to offer the following response to that consultation. We urge the adoption of a solution that leads to the prompt introduction of a signed root zone. Our community considers the introduction of a signed root zone to be an essential enabling step towards widespread deployment of Secure DNS, DNSSEC. This view is supported by the letter from the RIPE community to ICANN as an outcome of discussions at the May 2007 RIPE meeting in Tallinn: http://www.ripe.net/ripe/wg/dns/icann-root-signing.pdf. It is to be expected that a community as diverse as RIPE cannot have a unified set of detailed answers to the NTIA questionnaire. However several members of the RIPE community will be individually responding to that questionnaire. We present the following statement as the consensus view of our community about the principles that should form the basis of the introduction of a signed DNS root. 1. Secure DNS, DNSSEC, is about data authenticity and integrity and not about control. 2. The introduction of DNSSEC to the root zone must be made in such a way that it is accepted as a global initiative. 3. Addition of DNSSEC to the root zone must be done in a way that does not compromise the security and stability of the Domain Name System. 4. When balancing the various concerns about signing the root zone, the approach must provide an appropriate level of trust and confidence by offering an optimally secure solution. 5. Deployment of a signed root should be done in a timely but not hasty manner. 6. Updates from TLD operators relating to DNSSEC should be aligned with the operational mechanisms for co-ordinating changes to the root zone. 7. If any procedural changes are introduced by the deployment of DNSSEC they should provide sufficient flexibility to allow for the roles and processes as well as the entities holding those roles to be changed after suitable consultations have taken place. 8. Policies and processes for signing the root zone must be transparent and trustworthy, making it straightforward for TLDs to supply keys and credentials so the delegations for those TLDs can benefit from a common DNSSEC trust anchor, the signed root. 9. There is no technical justification to create a new organisation to oversee the process of signing of the root. 10. No data should be moved between organisations without appropriate authenticity and integrity checking, particularly the flow of keying material between a TLD operator and the entity that signs the root. 11. The public part of the key signing key must be distributed as widely as possible. 12. The organisation that generates the root zone file must sign the file and therefore hold the private part of the zone signing key. 13. Changes to the entities and roles in the signing process must not necessarily require a change of keys. -----------------------------------------------------------------------------

1 0

Call for Support: RIPE response to the US NTIA's NoI
by Ondřej Surý 17 Nov '08

17 Nov '08

I fully support the response text. Ondrej Sury ----------------------------------------------------------------------------- # # $Id: ntia-draft,v 1.9 2008/11/13 20:20:41 jim Exp $ # The RIPE community thanks the NTIA for its consultation on proposals to sign the root and is pleased to offer the following response to that consultation. We urge the adoption of a solution that leads to the prompt introduction of a signed root zone. Our community considers the introduction of a signed root zone to be an essential enabling step towards widespread deployment of Secure DNS, DNSSEC. This view is supported by the letter from the RIPE community to ICANN as an outcome of discussions at the May 2007 RIPE meeting in Tallinn: http://www.ripe.net/ripe/wg/dns/icann-root-signing.pdf. It is to be expected that a community as diverse as RIPE cannot have a unified set of detailed answers to the NTIA questionnaire. However several members of the RIPE community will be individually responding to that questionnaire. We present the following statement as the consensus view of our community about the principles that should form the basis of the introduction of a signed DNS root. 1. Secure DNS, DNSSEC, is about data authenticity and integrity and not about control. 2. The introduction of DNSSEC to the root zone must be made in such a way that it is accepted as a global initiative. 3. Addition of DNSSEC to the root zone must be done in a way that does not compromise the security and stability of the Domain Name System. 4. When balancing the various concerns about signing the root zone, the approach must provide an appropriate level of trust and confidence by offering an optimally secure solution. 5. Deployment of a signed root should be done in a timely but not hasty manner. 6. Updates from TLD operators relating to DNSSEC should be aligned with the operational mechanisms for co-ordinating changes to the root zone. 7. If any procedural changes are introduced by the deployment of DNSSEC they should provide sufficient flexibility to allow for the roles and processes as well as the entities holding those roles to be changed after suitable consultations have taken place. 8. Policies and processes for signing the root zone must be transparent and trustworthy, making it straightforward for TLDs to supply keys and credentials so the delegations for those TLDs can benefit from a common DNSSEC trust anchor, the signed root. 9. There is no technical justification to create a new organisation to oversee the process of signing of the root. 10. No data should be moved between organisations without appropriate authenticity and integrity checking, particularly the flow of keying material between a TLD operator and the entity that signs the root. 11. The public part of the key signing key must be distributed as widely as possible. 12. The organisation that generates the root zone file must sign the file and therefore hold the private part of the zone signing key. 13. Changes to the entities and roles in the signing process must not necessarily require a change of keys. ----------------------------------------------------------------------------- -- Ondrej Sury technicky reditel/Chief Technical Officer ----------------------------------------- CZ.NIC, z.s.p.o. -- .cz domain registry Americka 23,120 00 Praha 2,Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ sip:ondrej.sury@nic.cz tel:+420.222745110 mob:+420.739013699 fax:+420.222745112 -----------------------------------------

1 0

Call for Support: RIPE response to the US NTIA's NoI
by Remco van Mook 17 Nov '08

17 Nov '08

Dear all, I strongly support the response that has been drafted on behalf of the RIPE community to the US NTIA's NoI. In my opinion it captures all aspects of both consensus and concern in this community and the guiding principles stated in it should, when heeded, help us get DNSSEC introduced into the DNS root zone in a meaningful way. My compliments to the people responsible for drafting this text. Kind regards, Remco van Mook General Manager Equinix Netherlands This email is from Equinix Europe Limited or one of its associated/subsidiary companies. This email, and any files transmitted with it, contains information which is confidential, may be legally privileged and is solely for the use of the intended recipient. If you have received this email in error, please notify the sender and delete this email immediately. Equinix Europe Limited. Registered Office: Quadrant House, Floor 6, 17 Thomas More Street, Thomas More Square, London E1W 1YW. Registered in England and Wales No. 6293383.

1 0

Heads Up: RIPE Response to the US NTIA drafted in the DNS WG
by Peter Koch 10 Nov '08

10 Nov '08

Dear RIPE Community, this is to inform you that - as reported during the RIPE57 plenary in Dubai - the DNS WG is working on a response to the US NTIA's NoI for deployment of DNSSEC in the DNS root zone: <http://www.ntia.doc.gov/DNS/DNSSEC.html> The latest draft version of the proposed statement can be found on the DNS WG mailing list at <http://www.ripe.net/ripe/maillists/archives/dns-wg/2008/msg00218.html> The plan is to ask the RIPE community on this list for statements of support once the DNS WG has reached consensus later this week. If you would like to contribute, please read the discussion in the DNS WG's archive and respond on the DNS WG mailing list. In order to meet the NTIA's deadline - provided consensus will have been reached in the DNS WG and a consensus call will have been issued to this list - it is unlikely we will be able to apply further refinements to the text. Instead, there will be a binary decision depending on community response to the consensus call. -Peter Koch [DNS WG co-chair]

1 0