<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
FYI<br>
<div class="moz-forward-container"><br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject:
</th>
<td>Re: Montevideo statement</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Tue, 8 Oct 2013 09:19:35 -0400</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Phillip Hallam-Baker <a class="moz-txt-link-rfc2396E" href="mailto:hallam@gmail.com"><hallam@gmail.com></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td>manning bill <a class="moz-txt-link-rfc2396E" href="mailto:bmanning@isi.edu"><bmanning@isi.edu></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">CC: </th>
<td>IETF Discussion Mailing List <a class="moz-txt-link-rfc2396E" href="mailto:ietf@ietf.org"><ietf@ietf.org></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Tue, Oct 8, 2013 at 8:53 AM,
manning bill <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:bmanning@isi.edu" target="_blank">bmanning@isi.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">><br>
><br>
> I think the US executive branch would be better rid
of the control before the vandals work out how to use it
for mischief. But better would be to ensure that no such
leverage exists. There is no reason for the apex of the
DNS to be a single root, it could be signed by a quorum
of signers (in addition to the key splitting which I am
fully familiar with). And every government should be
assigned a sovereign reserve of IPv6 addresses to
prevent a scarcity being used as leverage.<br>
><br>
> --<br>
> Website: <a moz-do-not-send="true"
href="http://hallambaker.com/" target="_blank">http://hallambaker.com/</a><br>
<br>
</div>
Quorum signing with split keys was already built
and tested in a root server operator testbed (the OTDR
testbed) from 1998-2005. It was considered more fragile
than the current system.<br>
</blockquote>
<div>
<br>
</div>
<div>Considered more fragile by whom?</div>
<div><br>
</div>
<div>By the members of the $250m/yr NSA mole program?</div>
<div><br>
</div>
<div><br>
</div>
<div>Very few people in DNS land recognize the class of
attack as being realistic. Even when they have prime
ministers and members of the GRU visiting them to tell
them how important the issue is to their country.</div>
<div><br>
</div>
<div>We already have one example of lobbyists attempting
this type of attack (see Martin's post). So it is far from
unrealistic. </div>
<div><br>
</div>
<div><br>
</div>
<div>At present ICANN's power over the DNS is entirely
discretionary. Attempting to drop Palestine out of the
routing tables would simply be the end of the ICANN root
zone. ICANN could continue to manage .com but their
influence over the rest of the system would end
completely.</div>
<div><br>
</div>
<div>But DNSSEC changes the balance of power. With the root
signed and embedded infrastructure verifying DNSSEC trust
chains, the cost of a switchover rises remarkably. And
when I tried to mention the fact I tended to get nasty
threats.</div>
</div>
<div><br>
</div>
<div>The third question of power is 'how do we get rid of
you'. The answer in the case of DNSSEC is that you can't. </div>
<div><br>
</div>
<div><br>
</div>
<div>Fortunately the issue is quite easily fixed, just as the
problem of using IPv6 or BGP allocations for leverage is
fixable. Governments don't need to wait on ICANN or the IETF
to develop a quorum signing model for the DNS apex, they
could and should institute one themselves and tell their
infrastructure providers to chain to the quorum roots rather
than the monolithic apex root.</div>
<div><br>
</div>
<div><br>
</div>
-- <br>
Website: <a moz-do-not-send="true"
href="http://hallambaker.com/">http://hallambaker.com/</a><br>
</div>
</div>
<br>
</div>
<br>
<br>
<pre class="moz-signature" cols="72">--
Fernando Gont
e-mail: <a class="moz-txt-link-abbreviated" href="mailto:fernando@gont.com.ar">fernando@gont.com.ar</a> || <a class="moz-txt-link-abbreviated" href="mailto:fgont@si6networks.com">fgont@si6networks.com</a>
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1
</pre>
</body>
</html>