- Comments-root-name-service-implementation-27oct20

RSSAC054: RSSAC Statement on ICANN’s Root Name Service Strategy and Implementation
by Ozan Sahin Dec. 18, 2020

Dec. 18, 2020

On behalf of the Root Server System Advisory Committee (RSSAC) please find RSSAC054: RSSAC Statement on ICANN’s Root Name Service Strategy and Implementation attached. Sincerely, Ozan Sahin ICANN Policy Support for the RSSAC

1 0

Re: [Comments-root-name-service-implementation-27oct20] ARTICLE 19 - December 2020 Comments to the ICANN ARTICLE 19 - November2020 Comments to the ICANN
by Ephraim Percy Kenyanito Dec. 10, 2020

Dec. 10, 2020

Dear Sir/ Madam, We would like to welcome this opportunity to contribute to the public consultations. Please find attached our submissions. In case of any questions, please feel free to reach out to us. --- Best Regards, *Ephraim Percy Kenyanito* Senior Programme Officer* * ** ** *ARTICLE 19 *Defending Freedom of Expression and Information Free Word Centre, 60 Farringdon Rd <https://maps.google.com/?q=60+Farringdon+Rd,%C2%A0London+EC1R+3GA&entry=gma…> London EC1R 3GA <https://maps.google.com/?q=60+Farringdon+Rd,%C2%A0London+EC1R+3GA&entry=gma…> W www.article19.org <http://www.article19.org/> Tw @article19org <http://twitter.com/#!/article19org> Fa facebook.com/article19org <http://www.facebook.com/article19org> PGP Fingerprint:B0FA394AF73DEB7AA1FDC7360CFED26DE6BA8DC1 Book a meeting: https://calendly.com/ekenyanito

1 0

Business Constituency (BC) comment on Recommendations for ICANN’s Root Name Service Strategy and Implementation
by Steve DelBianco Dec. 8, 2020

Dec. 8, 2020

Below and attached is the comment of ICANN’s Business Constituency (BC) regarding Recommendations for ICANN’s Root Name Service Strategy and Implementation. The BC commends ICANN’s Office of the Chief Technology Officer (OCTO) on studies generated so far, and supports the continuation of these research projects, preferably published in all UN languages. The recommendations came at a time when more users and businesses are depending upon the Internet to conduct their activities, significantly increasing the load on the existing Root Server System (RSS) infrastructure. Placing Root Server Instances in diverse locations is a great strategy to handle increasing load and provide more resilience in areas where Internet adoption is growing – mostly via mobile. We recognize that the so-called Internet of Things (IoT) is still in its infancy, and we are yet to envision what the consequences of its deployment will truly look like once 5G networks and compatible devices are installed in a significant way. However, we observe their potential destructive power against the DNS in the hands of rogue actors, and this paints a troubling picture. ICANN Org should have presence in associations and groups related to IoT device manufacture to advance security by design, ensuring the DNS’ continued protection. To keep pace with the evolving threat landscape, we favor overprovisioning and erring on the side of caution, instead of potentially exposing businesses who are members of the BC to disruptions that could result in significant losses and security risks. The BC will publicly support expenditures made in this direction. ICANN Org should support with funds and capability the placement of ICANN Managed Root Server (IMRS) single instances in geographic areas where it is required but not feasible due to financial and/or knowledge restrictions. This will help build capability in these areas leading to innovation and more support for the RSS infrastructure. We support additional research into monitoring and how it would be performed, but request that a stream in the research should focus on the cost associated with the development, deployment and maintenance of these monitoring systems and the relative benefit to the operations of the RSS infrastructure in the long run. The BC agrees with the strategy of encouraging hyperlocal deployment, and recommends that ICANN Org makes full use of its community’s resources in sourcing local partners, such as ISPs, considering that they are working day-to-day with these actors. It would be a desirable gesture for ICANN Org to directly seek this kind of input, fostering stronger cooperation between both sides. The work of the regional managers should also be galvanized as the pandemic starts to wane. We further recommend a higher level of promotion, publicity and collaboration for the deployment of DNSSEC to tackle the integrity exposure of Root zone data. We would also like to see OCTO further pursue studies on the potential of IMRS Cloud, for us to fully grasp how implementation of these solutions could further ensure the Internet is technically stable, secure and reliable. We signal this a priority in terms of upcoming research. We would also like to better understand what are the opportunities to streamline the ICANN root zone encryption system with new technologies. -- This comment was drafted by Mark Datysgeld, Jimson Olufuye, and Vivek Goyal. It was approved in accord with our Charter. Steve DelBianco Vice Chair for Policy Coordination ICANN Business Constituency (BC)

1 0

Verisign Comments on Recommendations for ICANN's Root Name Service Strategy and Implementation
by Kane, Pat Dec. 8, 2020

Dec. 8, 2020

Verisign offers the following comments on the document ICANN's Root Name Service Strategy and Implementation that was recently published by ICANN's Office of the CTO (OCTO).[1] We appreciate ICANN's continued investment in the Domain Name System Security Extensions (DNSSEC) and encourage further efforts to promote DNSSEC validation by resolvers. While DNSSEC will help ensure the integrity of the data delivered, the document puts forth concerns around the confidentiality of DNS queries. "Specifically, in the case where the query/response streams to the root servers are subject to eavesdropping, the deployment of privacy-enhancing mechanisms that may be standardized in the future would mitigate the risk". Unless we are misunderstanding, this refers to DNS encryption, a mechanism that is not yet standardized for resolver-to-authoritative exchange. DNS encryption, at any part of the DNS resolution ecosystem introduces operational risk[2]. The strategy for DNS encryption in this document is unclear and foregoes considerations of the appropriate risk / benefit tradeoff and motivation to deploy DNS encryption at the navigational levels of the DNS hierarchy, including the root and top-level domains. While the document recognizes the privacy benefits of techniques such as qname minimization as being on a "different front", we believe[3] that rather than focusing on whether to deploy encryption for a particular exchange in the DNS resolution ecosystem, it is better to ask how to address the information protection objectives for that exchange - whether by encryption, alternative techniques or some combination thereof. Qname minimized DNS traffic from resolvers is inherently less sensitive, particularly at the root and TLD levels. In addition to qname minimization, we encourage ICANN to also draw attention to other low-impact techniques for reducing the sensitivity of the resolver-to-root exchange, including NXDOMAIN Cut Processing and Aggressive DNSSEC Caching. The resolver-to-root exchange enables DNS resolution for all underlying domain names. This exchange provides global navigation for all names, benefiting all resolvers and therefore all clients, and making availability and robustness paramount. Finally, we would encourage ICANN to better distinguish the strategy and implementation plans discussed in this document that will be enacted by ICANN for its own root server and those for the root server system more generally. While we understand the intention of this document to be focused on the ICANN managed root server (IMRS), various strategies, such as encryption, are ambiguous in their distinction between the IMRS and the entirety of the root server system. We are grateful for ICANN OCTO's ongoing attention to the development of their IMRS, and appreciate the opportunity to comment on the new strategy document. [1] ICANN Office of the Chief Technology Officer. ICANN's Root Name Service Strategy and Implementation. OCTO-016, October 26, 2020. https://www.icann.org/en/system/files/files/octo-016-26oct20-en.pdf [1] K. Henderson, T. April, and J. Livingood. Authoritative DNS-over-TLS Operational Considerations. Internet-Draft draft-hal-adot-operational-considerations, October 2019 (expired). https://datatracker.ietf.org/doc/draft-hal-adot-operational-considerations/ [1] Kaliski, B., A Balanced DNS Information Protection Strategy: Minimize at Root and TLD, Encrypt When Needed Elsewhere. Verisign blog, December 7, 2020. https://blog.verisign.com/security/a-balanced-dns-information-protection-str ategy-minimize-at-root-and-tld-encrypt-when-needed-elsewhere/ Best regards, Pat Kane <file:///C:/Users/pkane/AppData/Roaming/Microsoft/Signatures/dots.gif> Patrick Kane Senior Vice President Verisign Naming Services 12061 Bluemont Way Reston, VA 20190 <http://www.verisigninc.com/> Verisign.com <file:///C:/Users/pkane/AppData/Roaming/Microsoft/Signatures/logo.gif> _____ [1] ICANN Office of the Chief Technology Officer. ICANN's Root Name Service Strategy and Implementation. OCTO-016, October 26, 2020. https://www.icann.org/en/system/files/files/octo-016-26oct20-en.pdf [2] K. Henderson, T. April, and J. Livingood. Authoritative DNS-over-TLS Operational Considerations. Internet-Draft draft-hal-adot-operational-considerations, October 2019 (expired). https://datatracker.ietf.org/doc/draft-hal-adot-operational-considerations/ [3] Kaliski, B., A Balanced DNS Information Protection Strategy: Minimize at Root and TLD, Encrypt When Needed Elsewhere. Verisign blog, December 7, 2020. https://blog.verisign.com/security/a-balanced-dns-information-protection-str ategy-minimize-at-root-and-tld-encrypt-when-needed-elsewhere/

1 0

RySG Comments on ICANN's Root Name Service Implementation
by Elizabeth Bacon Dec. 8, 2020

Dec. 8, 2020

Hello, On behalf of the gTLD Registries Stakeholder Group (RySG), please find attached our comments on the Recommendations for ICANN’s Root Name Server Strategy and Implementation. In the interest of time, we did not conduct a vote on these comments. We did discuss them on our mailing list and during a biweekly conference call, and no member opposed their submission. Please feel free to contact me with any questions or concerns. Best, Elizabeth Bacon RySG Vice Chair, Policy

1 0