[dns-wg] Input from the ICANN meeting in Cairo

In Cairo, I was thinking of what we have written so far, and find that  
the conclusions people draw from the text we have so far is not  
consistent with what I think was said at the RIPE meeting in Dubai.

I will suggest text, but wanted to rise these two things asap:

- I did NOT hear at the RIPE meeting in Dubai any specific preference  
for either of IANA or Verisign as the holder of any keys. That said, I  
did hear some voices that felt "IANA is the natural trust anchor today  
for the DNS namespace, and because of that they should also hold the  
KSK". I did not hear any similar voice for Verisign.

- I have heard last week more voices that think one should look  
carefully at the whole chain of trust from the TLD via the root to the  
resolver. And point out the whole chain is important. This include at  
where/when the zone is signed. I hear some people saying it is good if  
the DS record passed from the TLD is signed as soon as possible (by  
the organisation that receive the DS, today IANA).

To let the rubber hit the road: These _technical_ arguments argue for  
a zone signing by the organisation receiving the DS, and therefore the  
ZSK should be held by that organisation. This imply further a move of  
the zone creation from Verisign to IANA.

So, I see the following alternatives being the dominant ones:

1. No change in the current structure. ZSK should be with Verisign as  
Verisign is zone creator. KSK stays also with Verisign so that KSK and  
ZSK are close to each other. Security of DS when moving DS from IANA  
to Verisign is unclear, and trust chain from IANA (that we trust for  
the root of the namespace) and the KSK that Verisign holds is unclear.

2. No change in the current structure. ZSK should be with Verisign as  
Verisign is zone creator. KSK held by IANA. Namespace root and KSK  
held by IANA, so trust chain is simple to see. Security of DS when  
moving DS from IANA to Verisign is unclear.

3. Zone signing is with IANA, so IANA send signed records to Verisign.  
This imply a change in the current structure as more than the record  
changed is sent to Verisign (also NSEC etc). ZSK should be with IANA.  
KSK held by IANA. Namespace root and KSK held by IANA, so trust chain  
is simple to see. Security of DS is clear as it is signed when  
received by IANA.

Then on top of this, we could have alternatives like whether the  
"control over the keys" should be via some multiple-password systems  
like suggested by Verisign, or split-key, or whether the community can  
"simply" trust whoever is going to hold the keys (via open key  
ceremonies etc).

I think my question is, should reply from RIPE list alternatives in a  
way similar to this (I do not claim the above is perfect), so that it  
is easier for "whoever make the decision" can count plusses and  
minuses from their point of view? Something I think should be possible  
already with the current list of bullets, if one just make some of the  
points more clear and down to earth and not so much hand waving.

  Patrik