Re: [NA-Discuss] [At-Large] Re-engineering the Internet

Aug. 26, 2008

      Patrick and all,

  Largely I agree with your sentiments below.  But
try to remember ICANN doesn't lead in any real sense,
especially not in a technology sense.  Nor should it
at this time due to it's poor performing leadership.

  We have called time and time again for ICANN and
the IETF to get away form the hiarcial DNS we know
oh to well today and move towards a relational DNS.
Those calls fell, and still fall on deaf hears.  Private
industry will either lead this migration our of advantage
or necessity, and maybe even both.

  The IETF's and the IANA strong if not stubborn support
of IPv6 a largely failed or failing protocol due to security
and privacy considerations as well as application migration
reasons, was doomed nearly from it's earliest beginnings
nearly 10 years ago.  But forward thinking business and
technical folks that know this than, were shouted or
"Hummed" down, and so we have the promotion of IPv6 such
as it is and has been.  Yet still failing to be very
attractive even on the eve of the running out of IPv4
address space.  But yet others are quietly moving forward
with IPv8, and perhaps IPv9 and Dynamic DNS.  Yet as you
rightly indicate the "Cash Cow" of the legacy Internet
becoming more and more a "Scam Cow" remains preferred.

  Yet I amongst others, remain undaunted and reticent
that the Legacy Internet we use today is wilting on the
vine as more and more governments are becoming more and
more involved and willing to impose regulation that seeks
to make the Legacy Internet "Safe", yet also further hampers
it's appeal.  Small wonder really given Phishing, Spam, and
other forms of miscreant behavior becoming nearly insermountable
as ICANN dragged it's feet for years to address these problems
for too long in favor of "Cultural" issues.

-----Original Message-----
...
From: Patrick Vande Walle <patrick@vande-walle.eu>
Sent: Aug 27, 2008 12:27 AM
To: At-Large Worldwide <at-large@atlarge-lists.icann.org>
Subject: Re: [At-Large] Re-engineering the Internet
Khaled,
This is indeed an interesting debate to have. As we know, most of the
technology we use today was developed 25 years ago. Since then, there has
been no change to the fundamentals, but rather patches designed from the
start with backward compatibility.
I think most people will agree that the DNS is broken beyond repair. The
changes we have seen over the years were all enhancements to the previous
standards. DNSSEC and IDNs come to mind. Both were designed to prevent
incompatibilities with older software. Punycode is ugly. We would need an
8-bit clean naming system. DNSSEC keys make zone files unreadable by a
normal human being.
Note also that, over the last 15 years, most of the new developments in
Internet standards were developed by the industry, and not by government
funded academic research. The goal of the industry is make profits. Hence,
technical choices are mostly short or medium term and tend to perpetuate
existing economic models.
The DNS hierarchical model has been generating an interesting cash flow for
the registries and registrars (and ICANN, BTW). See for example the fact
that domain names have largely prevented Verisign from going bankrupt.
(http://www.domainpulse.com/2008/08/08/verisign-reports-68-million-loss-873-m...
)
The net result is that there is no real work done to change the fundamental
design to address new concerns. IDN ugliness and security are issues, but
so is the "one TLD, one registry" model, which prevents real competition in
the TLD space. More distributed models for naming systems, like CoDoNS
(http://www.cs.cornell.edu/people/egs/beehive/codons.php ) remain purely
academic, as there is no willingness from the industry to kill the cash
cow.
I focused here on the DNS, but similar considerations could apply to other
parts of the Internet infrastructure, like traffic routing.
This is where I think ICANN could and should be more active in fostering
and sponsoring new research aimed at designing a new Internet, targeting
the general public good, with no short term economic considerations.
Granted, I do not expect ICANN to do the work of the IETF. However, I think
it is not necessarily a good thing to let the engineers be in charge of
everything, from the general vision to specifications and implementation.
There needs to be a top level vision, a master plan of what we want the
Internet to be in 10 years time. From there, we could articulate work
packages and deliverables.
This discussion is very relevant to the ALAC also. While it is good that
the ALAC provides comments on ICANN processes, it also needs to know where
it wants the Internet to go, especially in the naming and numbering area,
and articulate its positions according to its own vision.
Patrick Vande Walle
On Wed, 27 Aug 2008 07:35:52 +0200, Khaled KOUBAA <khaled.koubaa@gmail.com>
wrote:
...
Re-engineering the Internet
Source : http://iftf.org/node/2275
During a workshop at IFTF this week,  I offered a forecast  that there
is at least a 50% probability of a fundamental re-engineering of the
internet. Here's a bit of detail on this forecast and why I think this
last week has been a critical turning point.
Domain Name Services, DNS, like most of the Gen One Internet is  a
system built on cooperation. DNS servers have a narrow function to
accurately translate domain names like ABC.com  into numerical IP
addresses, using an an up to date directory from other -trusted- DNS
servers.  The problem  in simple terms is the length of the encryption
key used by DNS servers to authenticate  each other is short enough,
that using modern  high performance CPUs,  it's possible to calculate a
key  to enable access to  " poison"  the DNS database on the server
server with fraudulent routing information to misdirect any query for
ABC.com to XXX.com.   Dan Kaminsky, a 'white hat' hacker/security
expert, has been telling Internet engineering leadership about this
exploit for at least four years, and talking publicly, without revealing
details,  ( I heard him talk about this three years ago.)  trying to
provoke action. Finally, this last month Dan forced the issue by
releasing the details into the wild along with short term patch  using a
longer encrypted number requiring a lot more computing power to decrypt.
The Global Internet Engineering Security and Operations communities
scrambled frantically,  and deployed his patch in about three days,
remaining open, vulnerable until then. Here's a video of the patch being
deployed over several days:. Red are vulnerable domains, green are
protected http://www.youtube.com/watch?v=Ff5WBDOwueI
As we know, we are entering an era where super computing power will be
trivially available on local multi-core processors, and on scalable
platforms in the cloud. So it is inevitable that the current DNS patch
will fall to superior decryption computation. So in the meantime limited
software patches will forestall the inevitable crisis, that will occur
when the black hat hackers have adequate computing cycles to break the
encryption. This week most Internet routing experts agreed that we need
a fundamentally more Secure DNS system that will withstand a massive
assault.  We may need a totally new, more powerful generation of
software,  computers, servers, routers and switches are necessary along
with new operations regimens,  and training and education for IT
personnel.
_______________________________________________
At-Large mailing list
At-Large@atlarge-lists.icann.org
http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.icann...
...
At-Large Official Site: http://atlarge.icann.org
_______________________________________________
At-Large mailing list
At-Large@atlarge-lists.icann.org
http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.icann...
At-Large Official Site: http://atlarge.icann.org
Regards,

Spokesman for INEGroup LLA. - (Over 281k members/stakeholders strong!)
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is
very often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B;
liability depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS.
div. of Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail
jwkckid1@ix.netcom.com
My Phone: 214-244-4827

Patrick Vande Walle wrote:
...
Khaled,
This is indeed an interesting debate to have. As we know, most of the
technology we use today was developed 25 years ago. Since then, there has
been no change to the fundamentals, but rather patches designed from the
start with backward compatibility.
I think most people will agree that the DNS is broken beyond repair. The
changes we have seen over the years were all enhancements to the previous
standards. DNSSEC and IDNs come to mind. Both were designed to prevent
incompatibilities with older software. Punycode is ugly. We would need an
8-bit clean naming system. DNSSEC keys make zone files unreadable by a
normal human being.
Note also that, over the last 15 years, most of the new developments in
Internet standards were developed by the industry, and not by government
funded academic research. The goal of the industry is make profits. Hence,
technical choices are mostly short or medium term and tend to perpetuate
existing economic models.
The DNS hierarchical model has been generating an interesting cash flow for
the registries and registrars (and ICANN, BTW). See for example the fact
that domain names have largely prevented Verisign from going bankrupt.
(http://www.domainpulse.com/2008/08/08/verisign-reports-68-million-loss-873-m...
)
The net result is that there is no real work done to change the fundamental
design to address new concerns. IDN ugliness and security are issues, but
so is the "one TLD, one registry" model, which prevents real competition in
the TLD space. More distributed models for naming systems, like CoDoNS
(http://www.cs.cornell.edu/people/egs/beehive/codons.php ) remain purely
academic, as there is no willingness from the industry to kill the cash
cow.
I focused here on the DNS, but similar considerations could apply to other
parts of the Internet infrastructure, like traffic routing.
This is where I think ICANN could and should be more active in fostering
and sponsoring new research aimed at designing a new Internet, targeting
the general public good, with no short term economic considerations.
Granted, I do not expect ICANN to do the work of the IETF. However, I think
it is not necessarily a good thing to let the engineers be in charge of
everything, from the general vision to specifications and implementation.
There needs to be a top level vision, a master plan of what we want the
Internet to be in 10 years time. From there, we could articulate work
packages and deliverables.
This discussion is very relevant to the ALAC also. While it is good that
the ALAC provides comments on ICANN processes, it also needs to know where
it wants the Internet to go, especially in the naming and numbering area,
and articulate its positions according to its own vision.
Patrick Vande Walle
On Wed, 27 Aug 2008 07:35:52 +0200, Khaled KOUBAA <khaled.koubaa@gmail.com>
wrote:
...
Re-engineering the Internet
Source : http://iftf.org/node/2275
During a workshop at IFTF this week,  I offered a forecast  that there
is at least a 50% probability of a fundamental re-engineering of the
internet. Here's a bit of detail on this forecast and why I think this
last week has been a critical turning point.
Domain Name Services, DNS, like most of the Gen One Internet is  a
system built on cooperation. DNS servers have a narrow function to
accurately translate domain names like ABC.com  into numerical IP
addresses, using an an up to date directory from other -trusted- DNS
servers.  The problem  in simple terms is the length of the encryption
key used by DNS servers to authenticate  each other is short enough,
that using modern  high performance CPUs,  it's possible to calculate a
key  to enable access to  " poison"  the DNS database on the server
server with fraudulent routing information to misdirect any query for
ABC.com to XXX.com.   Dan Kaminsky, a 'white hat' hacker/security
expert, has been telling Internet engineering leadership about this
exploit for at least four years, and talking publicly, without revealing
details,  ( I heard him talk about this three years ago.)  trying to
provoke action. Finally, this last month Dan forced the issue by
releasing the details into the wild along with short term patch  using a
longer encrypted number requiring a lot more computing power to decrypt.
The Global Internet Engineering Security and Operations communities
scrambled frantically,  and deployed his patch in about three days,
remaining open, vulnerable until then. Here's a video of the patch being
deployed over several days:. Red are vulnerable domains, green are
protected http://www.youtube.com/watch?v=Ff5WBDOwueI
As we know, we are entering an era where super computing power will be
trivially available on local multi-core processors, and on scalable
platforms in the cloud. So it is inevitable that the current DNS patch
will fall to superior decryption computation. So in the meantime limited
software patches will forestall the inevitable crisis, that will occur
when the black hat hackers have adequate computing cycles to break the
encryption. This week most Internet routing experts agreed that we need
a fundamentally more Secure DNS system that will withstand a massive
assault.  We may need a totally new, more powerful generation of
software,  computers, servers, routers and switches are necessary along
with new operations regimens,  and training and education for IT
personnel.
_______________________________________________
At-Large mailing list
At-Large@atlarge-lists.icann.org
http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.icann...
...
At-Large Official Site: http://atlarge.icann.org
_______________________________________________
At-Large mailing list
At-Large@atlarge-lists.icann.org
http://atlarge-lists.icann.org/mailman/listinfo/at-large_atlarge-lists.icann...
At-Large Official Site: http://atlarge.icann.org

Jeffrey A. Williams

tags

participants (1)