RIPE 29 Amsterdam, 28 - 30 January 1998 Plenary Session RIPE 29 Meeting Plenary Session Minutes - DRAFT Chair: Rob Blokzijl Scribes: Julia Edwards, Paula Caslav 1. Opening: Rob Blokzijl opened the plenary session of the 29th RIPE meeting. 2. Agenda This is the preliminary agenda: 1. Opening 2. Agenda 3. From the RIPE Chair 4. Minutes RIPE 28 5. Action items RIPE 28 6. RIPE NCC Association 7. Report from the RIPE NC 8. Restructuring the IANA 9. IPv6 Addressing Policy 10. Secure DNS/BIND 11. Mapping the Internet 12. DB Security Task Force report 13. Reports from the working groups 14. Next RIPE meetings 15. AOB The agenda was agreed upon. 3. From the RIPE Chair Comments from Rob Blokzijl - About Internet drafts RE: IPV6. Daniel and Rob drafted docs w/o consultation with IPv6 wg due to time constraints. Chairs of wg's should keep abreast of what's current. 4. Minutes RIPE 28 No comments/additions. 5. Action items RIPE 28 Actions - Most of the items belong in the WG's instead of overall. Result - No outstanding items that couldn't be dealt with in the WG's. 6. RIPE NCC Association (RNA) First of January first day of RNA. Report from Daniel Karrenberg regarding the RNA, the executive board, etc.. 7. Report from the RIPE NCC (Daniel Karrenberg) Quality Assurance Report (John Crain) (Discussion/questions about auditing) Question (Kurt Kaiser) Does the audit include address space allocated by the InterNIC before the RIPE NCC existed? NO, but addresses allocated by the RIPE NCC earlier can also be audited. In this cases the policies in place then are taken into account. Swipnet - will you have some auditing action when registries change sizes. (I.E. from larger to medium or medium to smaller) There are plans to put down procedures for old assignments. Only reason this could be done is if space becomes a problem or the LIR's bring up concerns of fairness. (Comment) Problems with with PGP, (not possible to use or distribute in France) However, Carol Orange assures that it'll still be possible to submit updates to the database, just not by using PGP authentication. New service agreements had to be signed for new RIPE NCC Association. The RIPE NCC is still processing them. The majority of them has been returned to us. 8. Restructuring the IANA (Paul Ridley) (See presentation IANA Update) Discussion (Wilfried Woeber - We have core activities, but do we have any insight about industry involvement) Why separate the IP and domain registration? Daniel Karrenberg - Different constituencies. The constituency of RIPE NCC is the ISP, but for domain registration is the TLD registrars. Keep the level of politics under control by staying out of Naming. Paul Ridley - if they are separate they can be more focused. No problem with IP activities taking resources from naming. Funding? funding for IANA from US will stop on Oct 98. IANA still holds funds given by APNIC and RIPE NCC. Regional registries have budgets to pay. Mike Norris expressed concerns that the LIR's could be losing something in the separation of these two bodies. (ir's and ntld's) 9. IPv6 Addressing Policy Daniel Karrenberg: 2 drafts were proposed by the IPNG WG of the IETF. They were due to become an RFC when the RIPE NCCs registration services pointed out that the address format described in one of them was very limited and would be enough for all LIRs. The second draft proposed allocation guidelines for these addresses. It was felt that the IETF is not the right place to set address allocation guidelines. This has traditionally and successfully been done by the registries together with the IANA. It would be more appropriate if the IETF would submit a document with engineering considerations for the proposed address formats and the allocation of them. A new version of the draft describing the address format has now been submitted by the IESG. A number of bits are now reserved for possible extension of the addresses. The draft can be found at ftp://ftp.ripe.net/internet-drafts/draft-ietf-ipngwg-unicast-aggr-03.txt Discussion (Thomas Trede) Is it the duty of IPv6 wg to scan documents regarding allocation policies. At RIPE 20 it was agreed that it not be the wg. Daniel Karrenberg: it is as much part of the WG as the RIPE NCC. Rob: The RIPE NCC and the RIPE WG need to keep contact with each other. Thomas: Should the WG be responsible for keeping track of IETF activities? If the RIPE NCC has questions about IPV6 the WG is the place to pose questions. Community should be grateful to the RIPE NCC and Rob for bringing up objection to drafts since everyone else missed it. 10. Secure DNS/BIND (Carl Malamud) www.isc.org History - Chairman of Internet software consortium. Came in to be chairman and make it a commercial operation. The consortium also produces INN and is working to move Kerberos from beta. They have also worked on Sendmail. Consortium started by Paul Vixie. Funding is by providing software support functions to companies. Secure DNS/BIND Secure DNS - Based upon RSA, to allow for authenticated zone transfers and queries. John Gilmore went to RSA and obtained royalty free perpetual license for DNS authentication purposes. Which allows for export. In the first quarter the first pieces will start showing. By the end of 98 more will be out. Reason for announcement? Strong implication for operation of ISPs and TLDs in use of DNS. It will allow for general purpose key lookup. This will allow for such things as PGP key lookups. Unsecure DNS allows for spamming, spoofing, etc.., this may help stop this. (discussion) Wilfried Woeber - appreciates input, and says thank you for allowing input. Are there figures of percentage of DNS to be secured? 5 to 10% should be able to be secured in the next 12 months. (Question) - Could you perhaps provide comments on problems? If you're not running full version of BIND, then that's the first step. Also, it's better to see some signatures than none at all. If you are signing for your clients, then how much will that mean? So, if the RIPE NCC signs, then this will mean that an object that is submitted will identify. Daniel Karrenberg- What can be expected from RNA is deploying procs for key management. >From history, most of deployment is educating users. Public key encryption, how do you secure your keys? etc... this does not have to be exclusively for DNS, can help in other areas. (discussion) Raza Rizvi - What about ISP customers not using BIND? RSA will extend copyright to other DNS protocol implementations. If you apply to RSA, they will only commit within the next three years for a perpetual license. Does the offer extend to commercial DNS protocol implementations? yes. The most important point, don't wait forever to start looking and implementing security. 11. Mapping the Internet (Carl Malamud) Multi Casting, non profit organization. Talked at RIPE in 92 in PRAGUE about radio. Reset-up multi casting in Amsterdam. This was the right place because of new media artists concentration, and infrastructure. This project is to basically map Internet. How do you map across protocols? how do you construct topological maps? While web is beautiful, visualizing has use for those in the business. So, the question is, what organization has what servers running? With a topology map, you get a picture of this. This is to be a 3 to 5 year project. Structure - coordinating project. RIPE NCC is providing support with an office at Nikhef, and by helping to obtain VISAs. But, they are not providing financial support. This project will return again in a BoF. Other supporters, Sun Labs, and a Japanese consortium, that includes members like Cisco. Right now very low level RIPE support, only admin support. CERT question - Data points that need to be collected. There's going to be a certain amount of traffic doing that collection of information. For every packet taken to search for info, there's another packet created, responding. Yes it has Bandwidth consequences. When I looked for a machine.. I asked for something like 10gigs RAM and 500 gigs into terrabytes disk. Yes, Sun said, it's possible. 12. Database Security Task Force Report (Joachim Schmitz) Meetings * Washington IETF * prior to this RIPE meetings Recent Developments * IETF WGs IDR & RPS Security concerns regarding routing, e.g. hole punching triggered extensive discussion - -> reference needed - -> IRR currently minor security measures - -> increase security - -> populate database - -> educate users - -> change of the IRR - -> more responsibilities with registries Topics * coordination with other RRs * role of the IRR presentations by Gerald Winters, Merit definition for the IRR * database security trust model in development * security suggestions by Curtis Villamizar, ANS * PGP deal: Presentation by Carol Orange, RIPE NCC (discussion) Wilfried Woeber commented that we need a "known" person to acquire a license, but the license will be granted to the organisation, so if the original person leaves or changes position it's no problem. (question) Francis Dupont: Will PGP be added to the authentication mechanisms? Carol Orange: yes, there will then be 4 mechanisms, but no-one will be forced to use PGP or any other strong authentication. (question) Has there been progress in having a referral mechanism in the database? Carol Orange: There has been progress in definition but not in implementation. The RIPE NCC has a lack of programmers, but it's high on the priority list. Wilfried Woeber: We're also thinking of offering checksumming and other security measures, not just authorisation. We're also discussing authentication- who has access to objects, identification, etc.. But we have to have something available now. 13. Reports from the WGs Routing Working Group: Chair- Joachim Schmitz Current Developments * RIPE document on Route Flap Damping -> last call * RPSL -> implementation delayed -> RPSL draft has moved to proposed standard -> several developments around it * Security Issues -> data integrity -> prevention of accidental/malicious misconfiguration -> prevention of improper use of address space Presentations * IRR Authorisation (Carol Orange) Scheme for ISPs which routes to trust Proposal for IRR definition: "The IRR is a place that reflects what is announced on the Internet and what is permitted to be announced" * Using Internet Routing Announcements to identify incorrect IRR data (Gerald Winters) -> PAIR http://www.rsng.net/pair analysis tools -> Examples of (mis)use of the IRR -> Definition of the IRR? Role of the IRR? Actions * 29.R1 Gerald Winters, Carol Orange, Joachim Schimtz Definition of the IRR and an AUP * 29.R2 RIPE NCC, Carol Orange Implementation of notification and aut-num authorisation * 29.R3 RIPE NCC, Carol Orange Implementation of PGP 14. Next RIPE meetings Stockholm, Sweden May 18-20 Edinburgh, UK September 23-25 Amsterdam, Netherlands January (no dates set yet) ---------------------------------------------- DNS Working Group: Chair- Ruediger Volk (discussion) There was further discussion of "jspnrmptgsbssdir" a Microsoft created DNS confusion. The name "jspnrmptgsbssdir" is queried regularly from a Windows NT server or workstation running the Windows NT Remote Access Service. Try creating an entry for jspnrmptgsbssdir in your zone file. ---------------------------------------------- Netnews Working Group: Chair- Felix Kugler Report of the RIPE29 Netnews WG meeting 37 attendees chair: Felix Kugler scribe: Leigh Porter 1. Review of outstanding actions: A26.N3 Upgrade servers to Newsbone standards A27.N2 Newsbone deployment There has been some progress with both actions. However, the WG suggest to drop them from the list as they are ongoing items per definitionem. A27.N1 Tool Support for non-INN servers There have been improvements, though not by WG members. This action will be carried forward. 2. A review of the Netnews-WG As this WG goes into its 3rd year soon, a short review about the activities was given. The WG now focuses aroung three working areas: - feed topology issues - server tuning issues - reliability & QOS The WG's conception is that it is in no position to really coordinate News feeds in Europe. Rather it tries to help coordination efforts by providing information about traffic streams, tools to visualize and monitor traffic, and a discussion forum. The charter has to be updated to reflect this change. A29.N1 Felix Kugler to update charter on WG WWW server The Newsbone document shall be stripped from unnecessary requirements which might have prevented some ISPs from joining. A29.N2 Felix Kugler to update Newsbone document and related WWW pages 3. Presentations and proposals for new projects - Group list maintenance (Gerhard Winkler): Use synchronisation with refernce servers where conventional group maintenance using control messages is not sufficient. A29.N3 WG to provide information about maintainers and reference servers A29.N4 Gerhard Winkler to collect data and edit info page - Article loss measurements (Gerhard Winkler) Proposal to measure article loss with test articles. Will not be pursued, use endusers as indicators instead ! - News admins guide - Building and running a news service (Leigh Porter) Do's and don'ts for qunning backbone News servers. A29.N5 Leigh Porter to write a "News admins guide" - Spam on Usenet (Felix Kugler) Short introduction to Spam in Usenet, differences to email spamming, countermeasures... ---------------------------------------------- Database Working Group: Chair- Wilfried Woeber ---------------------------------------------- Local IR Working Group: Chair- Mike Norris http://www.ripe.net/wg/lir/r29-summary.html ---------------------------------------------- Spam BoF: Chair- John Martin, presentation Roderik Muit (discussion) Antonio-Blasco Bonito noted that in Italy new domains have to sign a nettiquette agreement, this might be something to consider for the Spam working group. ---------------------------------------------- TLD Working Group: chair- Niall O'Reilly (discussion) It was noted that the RIPE NCC will only bootstrap the new RIPE CENTR and the organisation will become independent as soon as possible if feasible. The time frame for RIPE NCC involvement is about 1 year. http://www.ripe.net/wg/tld/summary-29.html ---------------------------------------------- EIX Working Group: chair- Keith Mitchell ---------------------------------------------- MBONE Working Group: chair- Kurt Kayser http://www.ripe.net/wg/mbone/summary-29.html ---------------------------------------------- IPv6 Working Group: chair- Thomas Trede ---------------------------------------------- 15. AOB There was no other business 16. Closing Rob thanked the RIPE NCC for doing a great job in organising this meeting, and thanked everybody for coming.