Subject: [apps-discuss] Fwd: [dane] DANE IETF LC state of play

From: Stephen Farrell <[email-masked]>
Date: Tue, 01 May 2012 10:14:07 +0100

FYI. There's been a bunch of mail on this list about
this so here's my summary of the state of play just
sent to the DANE list.

Please feel free to correct me if I've gotten something
wrong.

Cheers,
S.

-------- Original Message --------
Subject: [dane] DANE IETF LC state of play
Date: Tue, 01 May 2012 10:12:43 +0100
From: Stephen Farrell <[email-masked]>
To: dane <[email-masked]>

Hi all,

Well that's been a busy IETF LC. I think that shows that this is an
important spec and the editors and chairs have done a great job
so far on handling IETF LC comments, but I think there is a bit more
work to do to be sure we're done and we may as well get that done
now before the IESG are let loose on it:-)

I went through the DANE WG archive of all the IETF LC comments and
found the following ones where its not crystal clear from the archive
that they're sorted.

Notes: a) they might be just fine, e.g. if just one person comments
and nobody else thought it important, then doing nothing is probably
right. these just weren't clear from the archive so I wanna check;
b) I only had time to scan the WG archive, if there are mails that
were only to [email-masked] or apps-discsuss that resolved these
then I missed them, so just tell me about that, so I'll forward
this to the other lists to check as well.

So here's the list:

1) Jeff Hodges
http://www.ietf.org/mail-archive/web/dane/current/msg04695.html
http://www.ietf.org/mail-archive/web/dane/current/msg04713.html

I mailed Jeff to see if -20 is ok. Silence can be taken to mean
yes I think but since he had a bunch of things its hard to be
sure.

2) PSA
http://www.ietf.org/mail-archive/web/dane/current/msg04702.html
http://www.ietf.org/mail-archive/web/dane/current/msg04790.html

There are a few more small things still open in the last mail
from earlier today.

3) Dave Cridland
http://www.ietf.org/mail-archive/web/dane/current/msg04624.html

I think there are still some occurrences of "certificate type"
in section 8, (e.g. 3rd para, p18) so those weren't all fixed.
I think that's the only remaining thing from Dave's review.

4) John Gilmore,
http://www.ietf.org/mail-archive/web/dane/current/msg04635.html

A.1 only has CA examples, what about non CA uses? I didn't see
any reaction to that and it seems like a fair comment.

5) John Gilmore
http://www.ietf.org/mail-archive/web/dane/current/msg04637.html

John thinks there's a bias in sections 8/8.1, but I didn't see
any reaction to that (other than mine, which just said "please
do the right thing, whatever that is")

6) Mark Andrews
http://www.ietf.org/mail-archive/web/dane/current/msg04657.html

Again, not sure if there was follow-up.

7) PHB
http://www.ietf.org/mail-archive/web/dane/current/msg04709.html

Don't mandate client security policy (hardfail). I didn't see
an obvious conclusion reached to make a change or not make a
change.

8) Various on SRV
http://www.ietf.org/mail-archive/web/dane/current/msg04793.html

I think this might need a tweak to the SRV language in 1.3 (and
just suggested one).

Cheers,
Stephen.

_______________________________________________
dane mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dane

---

From: SM <[email-masked]>
Date: Tue, 01 May 2012 10:03:06 -0700

Hi Stephen,
>right. these just weren't clear from the archive so I wanna check;

The above could be read as if nobody "+1" a comment, the course of 
action should probably be "do nothing".

The RFC has not been published and yet there are different 
interpretations of how DANE works from an application 
perspective.  There has been more traffic on apps-discuss@ than 
during the IETF Last Call.  I hope that these discussions have been 
taken into account.

I consider the comments at 
http://www.ietf.org/mail-archive/web/apps-discuss/current/msg05439.html 
as unaddressed.

BTW, I am ok with the follow-up on this being on ietf@ only.

Regards,
-sm

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 1 May 2012 10:27:44 -0700

On May 1, 2012, at 10:03 AM, SM wrote:

> The RFC has not been published and yet there are different interpretations of how DANE works from an application perspective.

Those interpretations were by people who didn't believe the text that MX and SRV were purposely not addressed.

>  There has been more traffic on apps-discuss@ than during the IETF Last Call.  I hope that these discussions have been taken into account.

I believe I did: I repeated the "we're not addressing this" text so it appears twice.

> I consider the comments at http://www.ietf.org/mail-archive/web/apps-discuss/current/msg05439.html as unaddressed.

They are not addressed because they have nothing to do with the protocol in the document. Please let me know if you still disagree, and send proposed text to the DANE WG.

--Paul Hoffman

---

From: SM <[email-masked]>
Date: Tue, 01 May 2012 11:23:04 -0700

Hi Paul,
At 10:27 01-05-2012, Paul Hoffman wrote:
>Those interpretations were by people who didn't believe the text 
>that MX and SRV were purposely not addressed.

Ok.

>I believe I did: I repeated the "we're not addressing this" text so 

Sorry, I must have missed that.

>They are not addressed because they have nothing to do with the 
>protocol in the document. Please let me know if you still disagree, 
>and send proposed text to the DANE WG.

I'll post the text here as part of IETF Last Call comments if it is 
ok with you/the WG.  I am not including the arguments to avoid 
rehashing what was said before.  Please ask if the arguments are needed.

In section 1.3:

Proposed text:

  "Note that this document does not cover how to associate certificates
   with domain names for application protocols that depend on MX, SRV, NAPTR,
   and similar DNS resource records; it is expected that later updates to
   this document might cover methods for making those associations."

I suggest removing the following text in Section 3:

   'To request a TLSA resource record for an SMTP server running the
    STARTTLS protocol on port 25 at "mail.example.com",
    "_25._tcp.mail.example.com" is used.'

in Section 8:

    A DNS administrator who goes rogue and changes both the A, AAAA, CNAME
    and/or TLSA records for a domain name can cause the user to go to an
    unauthorized server that will appear authorized, unless the client
    performs PKIX certification path validation and rejects the
    certificate.

    If the authentication mechanism for adding or changing TLSA data in a
    zone is weaker than the authentication mechanism for changing the A
    AAAA, and/or CNAME records, a man-in-the-middle who can redirect traffic
    to their site may be able to impersonate the attacked host in TLS if
    they can use the weaker authentication mechanism.

Regards,
-sm