Hi Robert, A few responses in line...
On 9 Oct 2024, at 11:26 AM, Robert Story <rstory@ant.isi.edu> wrote:
David's reference to golden addresses was and idea he had in 2008, and has not been proposed in the Changing RSO addresses document. What has been proposed is that RSO service address should be 'special'. The idea being to prevent a Former Service Address (as defined in the document) that has been returned to a RIR from being reallocated to someone other than an RSO.
Why (5-why"s root cause analysis) is that address special?
While not (yet) written up in the document, I think the guidance for a Former Service Address should be something along the lines of this ordered list:
- continue providing DNS root service on the address
what does it matter if the DNS answer validates?
- maintain ownership/control of the address (whether it's 'dark' or reused for some other service)
See above. If it goes dark, then great! if it's reused and people still use the address in a resolution frame then 'see above' (shouldn't we expect DNSSEC validation?)
- transfer the prefix to another RSO - and as a last resort, return the address to the RIR
The above two are administrative.. Sorry to be the cynical nay-sayer, but what I have seen is that bureaucracies don't often end up giving you the answer you need or want.
There is also a proposal to recommend that RSOs requesting a new prefix for root service should request an allocation from the critical infrastructure pool, should the RIR have such a pool. The idea being that critical infrastructure addresses, when returned, are less likely to end up in nefarious hands.
"nefarious" calls out some risk profile. Has the workgroup defined that risk profile? What is the text? If that is then a problem statement wouldn't it be better dealt with at a protocol or operational layer rather than praying 5 RIR policies are homogeneous, or policies won't change under your feet?? If it's punted to the policy layer, then i would suggest the WG is on thin ice, and it won't pass the "pub test".
There is also a proposal to recommend that 'someone' should bring policy proposals to each of the RIRs to have returned prefixes that have been used for root service placed in a special pool and only re-assigned to another RSO for root service. Kind of like a subset of a critical infrastructure pool.
I disagree with this proposal .. The v4/v6 prefix (and ASNs) should only be considered important as long as it holds the "token" as an RSO (in hints and root zone). That is the goal, IMHO. It doesn't matter where the service address comes from, e.g. Historical allocation, RIR/NIR allocation or assignment , acquisition by MNA, or leasing the space. There should be nothing special about the address for where the root zone service is presented, except that the address is in the hints file and in the root zone and the DNS answers are DNSSEC validated.
This is currently a fairly contentious issue on the calls, which I why I'm trying to drum up discussion on the list.
Understood.. and happy to see that discussion happen! Cheers, Terry (ps. offline for a day or two flying a helicopter - responses delayed)