Subject: GA-DIGEST V1 #150
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST          Friday, September 15 2000          Volume 01 : Number 150

----------------------------------------------------------------------

Date: Thu, 14 Sep 2000 12:34:08 +0200 (MET DST)
From: "Roberto Gaetano" <[email-masked]>
Subject: Re: [ga] Constituency Definitions

Joop, Joe, and all.

>At 18:31 13/09/00 -0700, Joe Kelsey wrote:
>
>>Perhaps we need to form a WG to flesh out the matter officially.
>>
>
>We surely do. This is why the GA in Yokohama asked the NC to authorize 
such
>a WG.  The GA does not have the power to create WG's.
>
>Any news about its progress, Roberto?
>

I recently complained about the lack of enthusiasm ;>) in the Task 
Force. Maybe the limited number of contributions lately was due to the 
Labour Day Weekend in the US - it seems that YJ an myself are the most 
active.
I also reported that the debate is alive and well in GA + NonCom lists, 
and proposed to start the WG ASAP, so that all can participate in a 
common forum.
Anyway, the agreement is that I (and YJ) produce a summary of the 
discussion on the subject in the next days. I will report the interest 
in the GA, the focus on the establishment of an Individual DN 
Constituency, and with your permission I will not mention the fight over
 IDNO :<(.

I assume that we still have consensus in the GA on the formation of the 
WG, so I will push for this.

Regards
Roberto
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 14 Sep 2000 13:28:56 +0200 (MET DST)
From: "Roberto Gaetano" <[email-masked]>
Subject: Re: [ga] Individual domain name holders and the DNSO

Joop,

>
>What makes *DN holders* a constituency is the fact that they are at the

>receiving end of regulation by other interests. That's all. 
>ICANN has recognized this only as far as non-commercial 
*organizations*. 
>A number of Individuals has seen the deficiency of this approach and 
have
>self-organized into the IDNO. 
>The IDNO and its structure is not *the* constituency, but it is the
>potential gateway *for* the constituency, and it is the only one until
>someone creates a better one. (Not an easy task as the last 2 years 
have
>proved).

OK, let's start from here.
IDNO is a component of the constituency, but I am afraid (learning from 
the past and trying to interpret the actions from the Board) that if it 
will continue being the only one, we will not go very far.

The reason why I wanted to get into the picture small (family?) 
businesses, end users, and other types of stakeholders (remember my 
position in Yokohama?), is because I have the impression that we are 
stalling. With an AtLarge Membership on the hundreds of thousands, an 
application from few hundred individuals will not be enough.
But there are among us people that are in contact with large bodies that
 do the interests of end users (consumers), small business, ...
For instance:
- - Jamie Love could get the interest of some consumer organization to the
 project
- - ISOC has a large basis of individuals as members
- - the AtLarge membership in itself, even if not organized (yet), has a 
potential interest in participating in DNSO debates, and thus to push 
for an Individual Constituency

IMHO, while I am looking forward to IDNO to grow, I keep my point that 
we have to look also in other directions if we want to have good chances
 to succeed.

Regards
Roberto

>
>What we have petitioned (and the number of petitioners can be 30, 100 
or
>1000-it doesn't matter) is to be recognized as that gateway.
>
>What you are saying is that the organization of this new constituency,
>constructed by individuals from the bottom up, could somehow emerge
>financially strong against all odds and be in all respects more 
legitimate
>than ICANN itself.  
>Is that likely?
>
>--Joop--
>www.idno.org
>
>
>
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 14 Sep 2000 14:54:07 +0200
From: Harald Alvestrand <[email-masked]>
Subject: Re: [ga] Constituency Definitions

At 15:15 14/09/2000 +1200, Joop Teernstra wrote:
>We surely do. This is why the GA in Yokohama asked the NC to authorize such
>a WG.  The GA does not have the power to create WG's.
>
>Any news about its progress, Roberto?
Yes, we do need this WG.
If for nothing else, the IDNO debates can be ruled "irrelevant to the 
business of the GA" when there is another open forum to which they are 
clearly relevant.

If the NC  is not happy with working groups, or does not see it as 
important just now, perhaps we should establish a GA subforum on the issue 
of constituency structure?
A group by any other name.....

                  Harald

- --
Harald Tveit Alvestrand, [email-masked]
+47 41 44 29 94
Personal email: [email-masked]

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 14 Sep 2000 15:10:32 -0400
From: Sandy Harris <[email-masked]>
Subject: [ga] Secure DNS

This list's bickering over procedures and constituencies is getting rather
boring, so I thought I'd try raising some other questions.

Probably the most important technical development currently taking place in the
DNS area is the creation of DNS security. For more info see:

http://www.toad.com/dnssec/index.html

Summarizing, the current DNS service is unauthenticated and therefore inherently
insecure. If a Black Hat can reroute DNS query packets or subvert a DNS server,
then he or she can distribute bogus DNS data and all other DNS servers will,
with
the current version of the protocols, accept it as Gospel.

This is an extremely serious flaw, allowing your packets to www.bigcompany.com
to be redirected to a rival firm, or bigcompanysucks.com, or Silicone Sally's
Sexy Site, or ...

The only reasonable fix is authentication of DNS records. This is what is being
worked on. If each DNS record carries a public key signature, then the receiving
DNS server can check that signature before trusting the record. This blocks the
Black Hat's attack and provides an opportunity to raise an alarm and attempt to
track down the perpetrator.

This raises some issues for ICANN.

One question is whether crypto export restrictions apply to this software.
In my view, and that of quite a few others, crypto export rules should have
long since been removed entirely, on all software. See:

http://www.freeswan.org/freeswan_trees/freeswan-1.5/doc/exportlaws.html

Even under current US rules, however, the DNS software should be exempt from
such restrictions since it does only authentication, not encryption. The US
gov't, however, have been creating obstacles to distribution. See the first
page referenced above for details.

Methinks ICANN should make a rather pointed public statement about this,
along the lines of the IETF's appropriately numbered RFC 1984:

http://info.internet.isi.edu:80/in-notes/rfc/files/rfc1984.txt

It would be a disaster for the net if gov't restrictions blocked or
seriously delayed deployment of secure DNS. It would also, of course,
be directly contrary to stated gov't concerns about protecting critical
infrastructure, (not that I'm naive enough to think that will necessarily
stop gov'ts from acting stupidly).

If it seems useful, I'll volunteer to write a draft of such a statement. 

Another issue is that security is especially important for the root
servers, the top level servers in ccTLDs, and other widely trusted
servers. ICANN should start now (or have they already and I missed it?)
on actions to ensure that everyone managing such servers put appropriate
procedures in place so that DNS security can be in global use shortly
after the software is ready.

These organisations certainly need to sign records they store and may
need to be able sign their clients' keys. When clients sign records they
have, then the receiving DNS servers will need to be able to validate
the client signatures. The obvious may to do this is via a hierarchy.
Trace up a chain of signatures until you find one you trust. The trust
hierarchy need not be the same as the naming hierarchy, and there need
not be only one root key which an installation trusts, but implementation
and management might be sinplified if these conditions hold.

It appears likely we need an ICANN key and procedures for it to sign
all TLD keys. Are those procedures worked out yet?

Still another issue is how to manage this so that the transition to
secure DNS does not further subvert the net in the direction of
commercial control of essential facilities. There are already serious
concerns about NSI misuse of their position. See for example Auerbach's
discussion of the whois database:

http://www.cavebear.com/cavebear/growl/index.htm

With NSI having recently been bought by Verisign, there appears to be
some risk that they might attempt to arrange things so that users
could have secure DNS services only by buying Verisign certificates.
The protocols do not require this, but their policies and procedures
could attempt to enforce it.

Methinks ICANN should make it quite clear now that this would be
entirely unacceptable, lest a fait accompli appear.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 14 Sep 2000 12:43:27 -0700
From: Kent Crispin <[email-masked]>
Subject: Re: [ga] Secure DNS

On Thu, Sep 14, 2000 at 03:10:32PM -0400, Sandy Harris wrote:
[...]
> One question is whether crypto export restrictions apply to this software.

No, they don't.  A specific exception was granted through the efforts of
John Gilmore.  I don't remember the details, but it was a cause for some
celebration. 

[...]

> If it seems useful, I'll volunteer to write a draft of such a statement. 

Not necessary.

> Another issue is that security is especially important for the root
> servers, the top level servers in ccTLDs, and other widely trusted
> servers. ICANN should start now (or have they already and I missed it?)

The discussions of this work mainly take place in the IETF, not ICANN. 
The dnsops WG is a good place to start.  There have been some 
interesting experiments -- for example, one of the ccTLDs signed the 
entire zone -- it took about a day.
[...]

> It appears likely we need an ICANN key and procedures for it to sign
> all TLD keys. Are those procedures worked out yet?

Once again, most of this stuff is handled in the ops area of the IETF.

> Still another issue is how to manage this so that the transition to
> secure DNS does not further subvert the net in the direction of
> commercial control of essential facilities.

Would you prefer commercial control (ie -- "the market") or 
government?  ICANN doesn't have any independent source of power by 
which it can exert control (neither the government nor the businesses 
involved are going to let an ICANN controlled by cyberanarchists have 
any control whatsoever.)

> With NSI having recently been bought by Verisign, there appears to be
> some risk that they might attempt to arrange things so that users
> could have secure DNS services only by buying Verisign certificates.
>
> The protocols do not require this, but their policies and procedures
> could attempt to enforce it.

You have identified what I consider to be perhaps the most serious long
term concern that faces us.  The consolidation of the CA market (eg, the
purchase of Thawte by Verisign) followed shortly thereafter by the
purchase of NSI, is a very troubling trend. 

> Methinks ICANN should make it quite clear now that this would be
> entirely unacceptable, lest a fait accompli appear.

You have a serious but very common misunderstanding about ICANN's role. 
Pronouncements by ICANN on this subject would be almost totally
ineffectual.  ICANN could just as well make it quite clear that further
conflict in the Middle East would be entirely unacceptable.  The effect
would be about the same. 

That is, yes, the concerns are real, but ICANN has no power to do
anything about it.  This battle will have to be fought elsewhere.

- -- 
Kent Crispin                               "Do good, and you'll be
[email-masked]                           lonesome." -- Mark Twain
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 14 Sep 2000 18:39:40 -0400
From: NFT Services <[email-masked]>
Subject: [ga] new topic - the press

Hello all,

As futile, and or naive as this may sound, I've often
wondered
why much of what goes on with the GA, ICANN, IETF, DNSO,
etc. etc. seems to not be picked up in the press.

If you haven't guessed, communication/journalism is a
much stronger forte of mine then those that occur here on
the GA.
I am a newcomer to these discussion.

My thoughts are, that I would like to research the
organizations
that, in my opinion, will be deciding some important issues
regarding the Internet, dns tlc's etc.

To do this, I need background and information, lot's of it.
I'd like to write a comprehensive article for the press on
what has happened, and where things are heading,
but to do this I need to have a firm grip on this
information,
which may include people's opinions, archives of meetings,
votes, discussions, e-mail's etc.
Anything that you are willing to share.

That is why I am writing here -- I need whatever resources
you
on the GA  (or elsewhere) can direct me to.

To let you know, I have no particular political or personal
spin here,
just a natural curiosity and desire.

I set up a email address [email-masked]
that any information you may have can be directed to.

As with any journalistic article, please remember,
EVERYTHING that is written to the email address
[email-masked], is on the record,
unless you specify otherwise.

(general e-mails I recieved through the GA will not be used
except in a rare case where I have researched the topic
and verifyied by the original sender of the e-mail that it
can be used.)

And be assured, if you specify it's off the record,
that means it can not be used unless I can verify it
by two other (on record) sources.
Deep background, means it can be used but the
source will remain anonymous, however the
organization of the source can be used,
and deep deep background, means the information is
useable, but no mention of the source, and/or it's
organization can be used.

Also note, anything that can not be verified
by more than one source is considered an opinion, not fact.

Any information that you may have would be appreciated.

And if you wondering why I would do this,
the thought came because I see many of you
fighting a battle, that in your own words is uphill because
of the way things are structured, well, my thought is public

awareness can and does create power, or balances power
- - organizations (used loosely here) can be changed from the
outside in if public awareness, concern, and pressure is
applied.

Directly, it was the recent elections
process (with many unable to vote) that put this idea in my
head.

Again the address to send email to with regard to my project
is [email-masked].

Any comments, objections, information, etc.
is welcome and appreciated

Sincerely,
George Kougias

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 15 Sep 2000 04:24:22 +0200
From: Jefsey Morfin <[email-masked]>
Subject: [ga] VeriSign position

Jamie and al.
We had ATT, IBM, MicroSoft, Intel. We now have VeriSign.

I would be interested to know how much of your anti-trust
document about ICANN applies to the new self crowned
master of our world?
Jefsey 

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 15 Sep 2000 09:56:40 +0200
From: Harald Alvestrand <[email-masked]>
Subject: Re: [ga] Secure DNS

At 12:43 14/09/2000 -0700, Kent Crispin wrote:
> > It appears likely we need an ICANN key and procedures for it to sign
> > all TLD keys. Are those procedures worked out yet?
>
>Once again, most of this stuff is handled in the ops area of the IETF.

The IETF gang are trying to make sure the technology works; it would be 
crazy to introduce DNS security on the root servers until we are 100% sure 
that we can do so without disrupting services.

Once the technology is ready, ICANN needs to decide on the procedures for 
generating keys, signing the root zone and so on.
I *hope* these procedures are relatively uncontroversial; the biggest 
practical question is probably who shall hold the pieces of the root key, 
and how it should be secured against compromise and accidental loss.

But I don't think we need to work out these procedures this year; there is 
still some work to be done before the stuff is ready.

                 Harald

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Fri, 15 Sep 2000 07:38:04 -0700 (PDT)
From: Rick H Wesson <[email-masked]>
Subject: Re: [ga] Secure DNS

Harald,

On Fri, 15 Sep 2000, Harald Alvestrand wrote:

> Once the technology is ready, ICANN needs to decide on the procedures for 
> generating keys, signing the root zone and so on.
> I *hope* these procedures are relatively uncontroversial; the biggest 
> practical question is probably who shall hold the pieces of the root key, 
> and how it should be secured against compromise and accidental loss.

ICANN, the registries and registrars are going to have to work out how the
protocols (currently only RRP 1.1.0) will be updated to manage the keys,
if they are to be put into the root, the keys will have to be sent to the
registry somehow. The discussions on how to do this have not even begun.

- -rick

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #150
************************