[dns-operations] Implementation of negative trust anchors?

[Suzanne Woolf]

On Aug 22, 2013, at 6:25 PM, Paul Vixie <paul at redbarn.org> wrote:

> 
> 
> Paul Hoffman wrote:
>> 
>> On Aug 22, 2013, at 2:47 PM, David Conrad <drc at virtualized.org> wrote:
>> 
>>> A resolver operator deploying an NTA is making an assertion that data behind a name is safe despite protocol indications that is may not be.
>> 
>> Where is that stated? I ask, because it would seem that a better description would be that they are asserting that the data behind a name is unprotected by DNSSSEC.
> 
> agreed, and that's why, over and above the absurd engineering economics behind it, i don't like NTA. if my signatures don't work because i've been attacked (for example, one of my name servers has been compromised), the last thing i'd want is comcast telling their customers that the data they're getting from my compromised name server is ok to consume because it's unsigned.

I don't like it either, but it limits the damage done by a DNSSEC failure to status quo ante rather than something worse. After all, "ok to consume because (even though) it's unsigned" is where we were all the time pre-DNSSEC, and where we are today where it's undeployed….and for some operators, better than having a validation failure cause a resolution failure. 

Probably more importantly, it limits the cost-shifting associated with errors in DNSSEC deployment.

I have a lot of sympathy for operators who look at DNSSEC without NTA and say "Wait, you mean if someone else signs their zones and I turn on validation, *my* failure mode if *they* screw up is more costly than my failure mode if they screw up and I haven't turned on validation in the first place? Um, no."

If you're OK with validation failures leading to resolution failures, don't deploy NTA. If you (or your People in Charge of Making Things Work and Money Flow) aren't, I see why you might think it's a good option to have.

> madness test: would we have bothered with DNSSEC at all, back in the day, if NTA had been known as a definite requirement?

I realize this is something of a rhetorical question, but I'll bite: if it were framed as a way of promoting incremental, fault-tolerant deployment and mitigating the cost shifting of "I screw up and your phone rings," some of us might well have been happy to include it. 

I recall a lot of talk during the DNSSEC specification and implementation process about the primacy of local policy. It's not a major reach for me to regard NTA as a perfectly reasonable knob for setting local policy.


Suzanne
Director, Strategic Partnerships
ISC/DNSCo

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20130822/cda6f85a/attachment.html>