[arin-ppml] ARIN discontinuing DNSSEC capability to legacy holders

[David Farmer]

On Thu, Oct 4, 2018 based on the
at 1:15 PM Bill Woodcock <woody at pch.net> wrote:

> > On Oct 4, 2018, at 11:10 AM, John Curran <jcurran at arin.net> wrote:
> > ARIN had been inconsistent in our approach to ... DNSSEC services over
> the years.
>
> There is no room for inconsistency in the application of security.
>
> You’re entirely missing Michael’s point.  DNSSEC is not a _treat_ that you
> dangle in front of universities, it’s an operational requirement for _the
> whole Internet_, of which your paying members are constituents.  You’re
> denying _me_ the ability to use DNSSEC to validate addresses any time you
> prevent anyone from registering a DS record.
>
>                                 -Bill


This is a complicated problem.  DNSsec is about identity and is not merely
a technical protocol. It requires that trust is built and maintained
between the entities in the DNS tree, this trust is structured heretically
so that everyone doesn't have to maintain trust with everyone else. Through
this heretical structure, trust is built through validating and certifying
the parties involved and this trust is then legally enshrined in contracts
between the entities involved. The fact that the other parties in the tree
have contracted with the entity higher in the tree, in this case, ARIN, is
why you can trust them. Without those contracts, there is no way to enforce
consequences for misbehavior and the trust will eventually be broken. The
contracts are the basis for the trust needed by the system and without this
trust, there is no need for the DNSsec protocol.

ARIN has to have contracts with all entities participating in DNSSec and
RPKI through it for the schemes to work, even that may not be enough to for
these schemes to work, but without that there is no way for these schemes
to work.

The financial issues are completely separate from why contracts are
necessary. However, life sure is easier when everyone is paying their fair
share, but in this case, I don't think fair needs to be an equal share.

Thanks.

 --
===============================================
David Farmer               Email:farmer at umn.edu
Networking & Telecommunication Services
Office of Information Technology
University of Minnesota
2218 University Ave SE        Phone: 612-626-0815
Minneapolis, MN 55414-3029   Cell: 612-812-9952
===============================================
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.arin.net/pipermail/arin-ppml/attachments/20181005/3b55d460/attachment.htm>