Subject: [dane] Protocol Action: 'The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA' to Proposed Standard (draft-ietf-dane-protocol-23.txt)

From: The IESG <[email-masked]>
Date: Fri, 15 Jun 2012 05:12:39 -0700

The IESG has approved the following document:
- 'The DNS-Based Authentication of Named Entities (DANE) Transport Layer
   Security (TLS) Protocol: TLSA'
  (draft-ietf-dane-protocol-23.txt) as Proposed Standard

This document is the product of the DNS-based Authentication of Named
Entities Working Group.

The IESG contact persons are Stephen Farrell and Sean Turner.

A URL of this Internet Draft is:
http://datatracker.ietf.org/doc/draft-ietf-dane-protocol/

Technical Summary

Encrypted communication on the Internet often uses Transport Level
Security (TLS), which depends on third parties to certify the keys
used. This document improves on that situation by enabling the
administrator of a domain name to publish the keys used in the
DNS, secured with DNSSEC.

Working Group Summary

The working group made extensive use of the issue tracker:
listing, opening, discussing and then calling consensus on
each issue. This gave everyone the opportunity to participate
and be heard. There have been approximately 2,000 messages
discussing this (and closely related) documents.

Document Quality

There is a tool (Swede - https://github.com/pieterlexis/swede)
that generates TLSA records, and a proof-of-concept implementation
of DANE for NSS (https://mattmccutchen.net/cryptid/#nss-dane).
A number of vendors have mentioned that they are planning on
implementing the specification.

I do not think that it would be fair (or possible) to single
out any specific reviewers -- we have had a large number of very
active reviewers / participants and they have all been very diligent
(and sometimes vocal :-)) in providing feedback.

Personnel

Warren Kumari is acting as the Document Shepherd.
Stephen Farrell is the Responsible Area Director.

---

From: Warren Kumari <[email-masked]>
Date: Fri, 15 Jun 2012 11:53:53 -0400

Hello all,

The chairs would like to take this opportunity to thank the the entire Working Group for all of their hard work, input, careful review and professionalism. 
Particular thanks to the authors (Paul Hoffman, Jakob Schlyter) for managing to interpret our often poorly articulated instructions and for being willing to so quickly integrate changes and rev the document….

We have made some great progress now (although it has taken much longer than we had hoped, apologies for that), and can now start focusing on:
A: deployment and 
B: the "How to do DANE with $foo" series.

Once again, thank you to everyone for contributing, and trying to remain civil / willing to listen to opposing viewpoints.

W

On Jun 15, 2012, at 8:12 AM, The IESG wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
> 

-- 
A. No
Q. Is it sensible to top-post?

---

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 15 Jun 2012 10:17:46 -0600

On 6/15/12 9:53 AM, Warren Kumari wrote:
> Particular thanks to the authors (Paul
> Hoffman, Jakob Schlyter) for managing to interpret our often poorly
> articulated instructions and for being willing to so quickly
> integrate changes and rev the document….

Hear, hear!

/psa

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 15 Jun 2012 15:54:09 -0700

> B: the "How to do DANE with $foo" series.

+1 to (B). (Of course, +1 to (A) as well, but I'm not in a position got do anything about that.)

There are two types of drafts that might be part of (B):

- Ones that use the TLSA RRtype but specify how a particular protocol uses TLS and DANE. draft-fanf-dane-smtp covers interesting bits about SMTP and DANE such as how to deal with traversing MX records, now to get the right host name, and how to deal with STARTTLS. draft-miller-xmpp-dnssec-prooftype covers interesting bits about XMPP, such as how to traverse SRV records and how to get the right host name.
  
- Ones that don't use the TLSA RRtype but do DANE-style things with non-TLS security protocols. draft-hoffman-dane-smime will parallel TLSA but for CMS. To date, there has be zero interest in the IPsec community for doing something DANE-style for IPsec.

Both of these paths seem interesting, at least to me.

--Paul Hoffman

---

From: Paul Wouters <[email-masked]>
Date: Sat, 16 Jun 2012 15:08:59 -0400 (EDT)

On Fri, 15 Jun 2012, Paul Hoffman wrote:

> To date, there has be zero interest in the IPsec community for doing something DANE-style for IPsec.

I'm not sure what you mean with "DANE-style for IPsec" and "no
interest".

RFC-4025 with RFC-4322 is a "dane style ipsec" and far predates DANE.

Both these documents need an update, and possibly a merge.

RFC-4322 should be updated to only allow RFC-4025(bis) type DNS records.
And section section 5, 9.1 and 9.2 need updating on requiring DNSSEC
and hard/soft failure modes similar to DANE.

I also believe that in RFC-4025, the gateway specification and their
security impact also needs to be re-evaluated based on our experience
with freeswan/openswan. And it probably needs to allow for other public
key types based on draft-kivinen-ipsecme-oob-pubkey-00.

Paul

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 16 Jun 2012 12:36:54 -0700

> RFC-4025 with RFC-4322 is a "dane style ipsec" and far predates DANE.

Correct. And there has been essentially no interest in either of them in the IPsec community.

> Both these documents need an update, and possibly a merge.

That is a discussion for the IPsec community, not here.

--Paul Hoffman

---

From: Paul Wouters <[email-masked]>
Date: Sat, 16 Jun 2012 18:49:39 -0400 (EDT)

> Correct. And there has been essentially no interest in either of them in the IPsec community.

I'm a little confused by your original comment then. You seemed to
suggest there was some need for a dane like RFC effort for IPsec for
this working group to undertake?

Paul

---

From: Leif Johansson <[email-masked]>
Date: Sun, 17 Jun 2012 09:14:45 +0200

>> integrate changes and rev the document….

+1

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 17 Jun 2012 11:32:59 -0700

> this working group to undertake?

I don't see where I seemed to suggest that, but I certainly didn't mean to.

--Paul Hoffman