From nobody Thu Apr 1 06:45:08 2021 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C13C3A1239 for ; Thu, 1 Apr 2021 06:45:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B1OnljHmnmOy for ; Thu, 1 Apr 2021 06:45:02 -0700 (PDT) Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E09C53A1232 for ; Thu, 1 Apr 2021 06:45:01 -0700 (PDT) Received: by straasha.imrryr.org (Postfix, from userid 1001) id 684BADA639; Thu, 1 Apr 2021 09:45:00 -0400 (EDT) Date: Thu, 1 Apr 2021 09:45:00 -0400 From: Viktor Dukhovni To: dane@ietf.org Message-ID: Reply-To: dane@ietf.org References: <3AC8C6BC-6B75-4CBB-8076-1711DDB4616F@sys4.de> <607F46B6-2B13-4B2E-9AB8-D637F95F173D@dukhovni.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <607F46B6-2B13-4B2E-9AB8-D637F95F173D@dukhovni.org> Archived-At: Subject: [dane] IMPORTANT: Please ensure your NSEC3 iteration count is sufficiently low X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2021 13:45:07 -0000 RFC 5155 defined NSEC3 iterations to scale up with the RSA/DSA key size up to perhaps as high as 2500 iterations for 4096-bit keys. In retrospect such a generous iteration cap is counter-productive. It is neither particularly effective at keeping your zone content "secret", nor sufficiently cheap to avoid negative impact on authoritative and iterative resolver performance. In that light, Wes Hardaker and I have authored an Internet-Draft that strongly recommends setting the NSEC3 additional iteration count to 0 (at least one initial SHA1 hash is always performed). https://tools.ietf.org/html/draft-hardaker-dnsop-nsec3-guidance-02 Today, the Knot resolver became the first one to cap NSEC3 iterations for now at 150, but this will likely be reduced further (perhaps ultimately as low as ~25): https://gitlab.nic.cz/knot/knot-resolver/-/tags/v5.3.1 and is expected to be done by more resolvers. Since iteration counts above the resolver cap make denial-of-existence for the entire zone insecure, it is important that all domains with a high NSEC3 iteration count proactively lower it ideally to 0, but otherwise ~10 or less. While DNSSEC still precludes forged positive answers, any signed NXDomain or NODATA NSEC3 response can be replayed for any query, regardless of the qname. This impacts any protocol in which negative responses have security consequences. Potential exposures include: - Forged absence of RFC7672 DANE SMTP TLSA records - Forged absence of CAA records - Forged absence of HTTPS records enabling various downgrades - ... A number of TLDs have already lowred their iteration counts, and it is expected that most of the rest will follow soon. TLD before after --- ------ ----- la 150 1 xn--q7ce6a 150 1 blue 100 10 green 100 10 lat 100 10 mx 100 10 pink 100 10 red 100 10 schaeffler 100 10 by 100 3 creditunion 100 3 ally 100 1 autos 100 1 boats 100 1 homes 100 1 motorcycles 100 1 yachts 100 1 If your DNS zone is configured to use NSEC3, please: - Reduce the iteration count to 10 or less. - Disable opt-out, you're very unlikely to need it. - Either rotate the salt each time you sign, or skip it entirely. But a short fixed salt is harmless if leaving it alone easier than changing it. Of course, if your zone is small enough (just the zone apex and a handful of already public or easy to guess names) or in any case has nothing to hide, even better is to use just plain NSEC. You get smaller negative replies (less exposure to DoS) and more effective negative caching at resolvers. So in many cases, it is even simpler to abandon NSEC3 entirely. Please also consider the pros/cons of that option. -- Viktor. From nobody Wed Apr 14 05:18:15 2021 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B2883A0BC7 for ; Wed, 14 Apr 2021 05:18:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2COkY1QdHo85 for ; Wed, 14 Apr 2021 05:18:09 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1D3C03A0BC2 for ; Wed, 14 Apr 2021 05:18:09 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 1C4EAF4076E; Wed, 14 Apr 2021 05:17:55 -0700 (PDT) To: paul.hoffman@icann.org, jakob@kirei.se, rdd@cert.org, kaduk@mit.edu, ogud@ogud.com, warren@kumari.net X-PHP-Originating-Script: 1005:errata_mail_lib.php From: RFC Errata System Cc: me@kasparetter.com, dane@ietf.org, rfc-editor@rfc-editor.org Content-Type: text/plain; charset=UTF-8 Message-Id: <20210414121755.1C4EAF4076E@rfc-editor.org> Date: Wed, 14 Apr 2021 05:17:55 -0700 (PDT) Archived-At: Subject: [dane] [Editorial Errata Reported] RFC8162 (6544) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Apr 2021 12:18:14 -0000 The following errata report has been submitted for RFC8162, "Using Secure DNS to Associate Certificates with Domain Names for S/MIME". -------------------------------------- You may review the report below and at: https://www.rfc-editor.org/errata/eid6544 -------------------------------------- Type: Editorial Reported by: Kaspar Etter Section: 1 Original Text ------------- Others to want mitigate the difficulty of finding certificates from outside the enterprise. Corrected Text -------------- Others want to mitigate the difficulty of finding certificates from outside the enterprise. Notes ----- Wrong order of words. Instructions: ------------- This erratum is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party can log in to change the status and edit the report, if necessary. -------------------------------------- RFC8162 (draft-ietf-dane-smime-16) -------------------------------------- Title : Using Secure DNS to Associate Certificates with Domain Names for S/MIME Publication Date : May 2017 Author(s) : P. Hoffman, J. Schlyter Category : EXPERIMENTAL Source : DNS-based Authentication of Named Entities Area : Security Stream : IETF Verifying Party : IESG From nobody Wed Apr 14 11:25:01 2021 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A483A1A91 for ; Wed, 14 Apr 2021 11:24:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sHsx26_idzGe for ; Wed, 14 Apr 2021 11:24:54 -0700 (PDT) Received: from ppa2.lax.icann.org (ppa2.lax.icann.org [192.0.33.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E34083A1A8C for ; Wed, 14 Apr 2021 11:24:54 -0700 (PDT) Received: from MBX112-W2-CO-1.pexch112.icann.org (out.mail.icann.org [64.78.33.5]) by ppa2.lax.icann.org (8.16.0.43/8.16.0.43) with ESMTPS id 13EIOjSP007106 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 14 Apr 2021 18:24:45 GMT Received: from MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) by MBX112-W2-CO-2.pexch112.icann.org (10.226.41.130) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.721.2; Wed, 14 Apr 2021 11:24:44 -0700 Received: from MBX112-W2-CO-1.pexch112.icann.org ([10.226.41.128]) by MBX112-W2-CO-1.pexch112.icann.org ([10.226.41.128]) with mapi id 15.02.0858.010; Wed, 14 Apr 2021 11:24:44 -0700 From: Paul Hoffman To: RFC Editor CC: Jakob Schlyter , Roman Danyliw , "Benjamin Kaduk" , Olafur Gudmundsson , Warren Kumari , "me@kasparetter.com" , "dane@ietf.org" Thread-Topic: [Ext] [Editorial Errata Reported] RFC8162 (6544) Thread-Index: AQHXMShJrfAkG/KmjUCxCWfdaT5qN6q0yeoA Date: Wed, 14 Apr 2021 18:24:44 +0000 Message-ID: <09EBD42B-7E24-4E80-8EB4-AC4ED1B3F4C4@icann.org> References: <20210414121755.1C4EAF4076E@rfc-editor.org> In-Reply-To: <20210414121755.1C4EAF4076E@rfc-editor.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [192.0.32.234] x-source-routing-agent: Processed Content-Type: multipart/signed; boundary="Apple-Mail=_41C41A83-EB91-4CBD-8C0B-7D1CE0FE87BC"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.391, 18.0.761 definitions=2021-04-14_10:2021-04-14, 2021-04-14 signatures=0 Archived-At: Subject: Re: [dane] [Ext] [Editorial Errata Reported] RFC8162 (6544) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Apr 2021 18:25:00 -0000 --Apple-Mail=_41C41A83-EB91-4CBD-8C0B-7D1CE0FE87BC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii This is correct, and can be marked as simply editorial. --Paul Hoffman > On Apr 14, 2021, at 5:17 AM, RFC Errata System = wrote: >=20 > The following errata report has been submitted for RFC8162, > "Using Secure DNS to Associate Certificates with Domain Names for = S/MIME". >=20 > -------------------------------------- > You may review the report below and at: > = https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid6544__;!!= PtGJab4!r1otOc1PXUoFRkWg2JBSnI8i4wWCmIFklD9io6yBqfYaC5fYw-e71lLmM7rPbeoj0-= 6JJMHj4g$=20 >=20 > -------------------------------------- > Type: Editorial > Reported by: Kaspar Etter >=20 > Section: 1 >=20 > Original Text > ------------- > Others to want mitigate the difficulty of finding certificates from = outside the enterprise. >=20 > Corrected Text > -------------- > Others want to mitigate the difficulty of finding certificates from = outside the enterprise. >=20 > Notes > ----- > Wrong order of words. >=20 > Instructions: > ------------- > This erratum is currently posted as "Reported". If necessary, please > use "Reply All" to discuss whether it should be verified or > rejected. When a decision is reached, the verifying party =20 > can log in to change the status and edit the report, if necessary.=20 >=20 > -------------------------------------- > RFC8162 (draft-ietf-dane-smime-16) > -------------------------------------- > Title : Using Secure DNS to Associate Certificates with = Domain Names for S/MIME > Publication Date : May 2017 > Author(s) : P. Hoffman, J. Schlyter > Category : EXPERIMENTAL > Source : DNS-based Authentication of Named Entities > Area : Security > Stream : IETF > Verifying Party : IESG --Apple-Mail=_41C41A83-EB91-4CBD-8C0B-7D1CE0FE87BC Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCBrYw ggayMIIFmqADAgECAhMwAAAV3RBqFEZex8dMAAMAABXdMA0GCSqGSIb3DQEBCwUAMF8xEzARBgoJ kiaJk/IsZAEZFgNvcmcxFTATBgoJkiaJk/IsZAEZFgVpY2FubjESMBAGCgmSJomT8ixkARkWAmRz MR0wGwYDVQQDExRhZDEtbGF4LmRzLmljYW5uLm9yZzAeFw0yMDA5MTkxODA3MTlaFw0yMjA5MTkx ODA3MTlaMIGUMRMwEQYKCZImiZPyLGQBGRYDb3JnMRUwEwYKCZImiZPyLGQBGRYFaWNhbm4xEjAQ BgoJkiaJk/IsZAEZFgJkczEUMBIGA1UECxMLSUNBTk4tVXNlcnMxFTATBgNVBAMTDFBhdWwgSG9m Zm1hbjElMCMGCSqGSIb3DQEJARYWcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMyCemeYYZjhFjqol6d0KFelzUOUxRgoLxxuCY67ssb2elDgD8Vu 0O5fqMb5GwKWGZknC9uG3l3Of8pnfMlHpeFpLz9abvV/esea+JDxt+RgZLZRvJtZ/lVV86BZnjAO kKtLboRpfXTAobOllRTMcDaRksynf2FiF8VPB9vIsAxNT6/p8P3X84zAkBUX9BI1p9Pf/+ksRkau c40q/N7AuAVYAQlOwnN2QG+64T6ofP6kr3DanHuYg2C/5G3RXX58azNgSYnopJ0AiFY9e4M7iVxm Ll5wgmBGtVoLdjFe9HnCk5EdqKk5CE1ll7akYuvMNUqK1ingA5IjAvRZc9hD818CAwEAAaOCAy8w ggMrMB0GA1UdDgQWBBSh5qyXEQo8kO1LLYUKzpRiMxIHMzAfBgNVHSMEGDAWgBTpKerCBbuXyks/ cnl6+luCS7lqhDCB2QYDVR0fBIHRMIHOMIHLoIHIoIHFhoHCbGRhcDovLy9DTj1hZDEtbGF4LmRz LmljYW5uLm9yZygxKSxDTj1hZDEtbGF4LENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNl cyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWRzLERDPWljYW5uLERDPW9yZz9jZXJ0 aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9p bnQwgcoGCCsGAQUFBwEBBIG9MIG6MIG3BggrBgEFBQcwAoaBqmxkYXA6Ly8vQ049YWQxLWxheC5k cy5pY2Fubi5vcmcsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2Vz LENOPUNvbmZpZ3VyYXRpb24sREM9ZHMsREM9aWNhbm4sREM9b3JnP2NBQ2VydGlmaWNhdGU/YmFz ZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0aW9uQXV0aG9yaXR5MA4GA1UdDwEB/wQEAwIFoDA9Bgkr BgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiBurJNhMjIaoOtkz+HlPRag/mIbk6H68s/hoOYWgIBZAIB BzApBgNVHSUEIjAgBgorBgEEAYI3CgMEBggrBgEFBQcDBAYIKwYBBQUHAwIwNQYJKwYBBAGCNxUK BCgwJjAMBgorBgEEAYI3CgMEMAoGCCsGAQUFBwMEMAoGCCsGAQUFBwMCMEkGA1UdEQRCMECgJgYK KwYBBAGCNxQCA6AYDBZwYXVsLmhvZmZtYW5AaWNhbm4ub3JngRZwYXVsLmhvZmZtYW5AaWNhbm4u b3JnMEQGCSqGSIb3DQEJDwQ3MDUwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAHBgUr DgMCBzAKBggqhkiG9w0DBzANBgkqhkiG9w0BAQsFAAOCAQEATidKimzbAoiiUW1wn7PWGyvBra29 qfQFUkoiN910zUtEigII3eYlf6lgokLPem1VGMAbRDJaDZNDy/1piuJFxtH2qLqqM1KL0jhLD62I 1JlpoUSSVCs0I0c+WoMafG1+TxDHvKOJ+88uR5EE61qoeHBe5pCIeQYzPyEbcJRIqavNj6DKg5Nm AwkwZwCSPGwb7WlKwxnf3X+Zx2emG+AB6k+q+jZA3obglwR5NFov1CeOuW5qQNzB9FIzbZGDjNsJ SwY0ygGnYItvhxb+if9I4NnuZGy41dwwDql40ZGmJg1yUV8niDpUxFUdAdXdeCoVoTPAK7ZDUS8y bo/Iyo/aEzGCAyAwggMcAgEBMHYwXzETMBEGCgmSJomT8ixkARkWA29yZzEVMBMGCgmSJomT8ixk ARkWBWljYW5uMRIwEAYKCZImiZPyLGQBGRYCZHMxHTAbBgNVBAMTFGFkMS1sYXguZHMuaWNhbm4u b3JnAhMwAAAV3RBqFEZex8dMAAMAABXdMA0GCWCGSAFlAwQCAQUAoIIBezAYBgkqhkiG9w0BCQMx CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMTA0MTQxODI0NDRaMC8GCSqGSIb3DQEJBDEi BCC9oT001WB2XqJvysinWOL+kTa+xsLhbTGUcaDkktJhUDCBhQYJKwYBBAGCNxAEMXgwdjBfMRMw EQYKCZImiZPyLGQBGRYDb3JnMRUwEwYKCZImiZPyLGQBGRYFaWNhbm4xEjAQBgoJkiaJk/IsZAEZ FgJkczEdMBsGA1UEAxMUYWQxLWxheC5kcy5pY2Fubi5vcmcCEzAAABXdEGoURl7Hx0wAAwAAFd0w gYcGCyqGSIb3DQEJEAILMXigdjBfMRMwEQYKCZImiZPyLGQBGRYDb3JnMRUwEwYKCZImiZPyLGQB GRYFaWNhbm4xEjAQBgoJkiaJk/IsZAEZFgJkczEdMBsGA1UEAxMUYWQxLWxheC5kcy5pY2Fubi5v cmcCEzAAABXdEGoURl7Hx0wAAwAAFd0wDQYJKoZIhvcNAQELBQAEggEAR50JTcDaiHe7xAzBrRyv +Oton8eDlzE/gPky2pKs2hFmLlmV5zz9TddTbdymgpF4sesB2LIH5059a3W9FWBu6xea6fDbdyBa vF+52i2D3myr2hUqfCeh1XJgi9bD4l1bwaEON+LWNACAutYsqF1o2oawNQZeqFeP97FJmL2Cvp9m tsoTaKuUL9B5ABrQBuIGEmvm1P4o4quOTT7h5h7S8KLTMQP7VVDwefLm4PoDgE0Frd2f4Wltq4+r +/SUgNAiUT1eHrb4uE++L5ikU6WAARxDevyore1jF8uym+7BJExffpUmXi2PzoSvD4kt70OSSPEP Y0BnumWgKKQ02/y+NQAAAAAAAA== --Apple-Mail=_41C41A83-EB91-4CBD-8C0B-7D1CE0FE87BC-- From nobody Wed Apr 14 16:36:44 2021 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16FE83A24A3 for ; Wed, 14 Apr 2021 16:36:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3yXLsDeDvrgE for ; Wed, 14 Apr 2021 16:36:36 -0700 (PDT) Received: from smtp110.iad3a.emailsrvr.com (smtp110.iad3a.emailsrvr.com [173.203.187.110]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCAC13A24A2 for ; Wed, 14 Apr 2021 16:36:36 -0700 (PDT) X-Auth-ID: ogud@ogud.com Received: by smtp14.relay.iad3a.emailsrvr.com (Authenticated sender: ogud-AT-ogud.com) with ESMTPSA id 3AFB922220; Wed, 14 Apr 2021 19:36:35 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\)) From: Olafur Gudmundsson In-Reply-To: <09EBD42B-7E24-4E80-8EB4-AC4ED1B3F4C4@icann.org> Date: Wed, 14 Apr 2021 19:36:34 -0400 Cc: "rfc-editor@rfc-editor.org" , Jakob Schlyter , Roman Danyliw , Benjamin Kaduk , Warren Kumari , "me@kasparetter.com" , "dane@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <52484319-3AC8-431F-B4DE-CF9256DC2B76@ogud.com> References: <20210414121755.1C4EAF4076E@rfc-editor.org> <09EBD42B-7E24-4E80-8EB4-AC4ED1B3F4C4@icann.org> To: Paul Hoffman X-Mailer: Apple Mail (2.3654.60.0.2.21) X-Classification-ID: 329ea487-281e-41c3-87f2-b953f62497b3-1-1 Archived-At: Subject: Re: [dane] [Ext] [Editorial Errata Reported] RFC8162 (6544) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Apr 2021 23:36:42 -0000 I agree with Paul=20 > On Apr 14, 2021, at 2:24 PM, Paul Hoffman = wrote: >=20 > This is correct, and can be marked as simply editorial. >=20 > --Paul Hoffman >=20 >> On Apr 14, 2021, at 5:17 AM, RFC Errata System = wrote: >>=20 >> The following errata report has been submitted for RFC8162, >> "Using Secure DNS to Associate Certificates with Domain Names for = S/MIME". >>=20 >> -------------------------------------- >> You may review the report below and at: >> = https://urldefense.com/v3/__https://www.rfc-editor.org/errata/eid6544__;!!= PtGJab4!r1otOc1PXUoFRkWg2JBSnI8i4wWCmIFklD9io6yBqfYaC5fYw-e71lLmM7rPbeoj0-= 6JJMHj4g$=20 >>=20 >> -------------------------------------- >> Type: Editorial >> Reported by: Kaspar Etter >>=20 >> Section: 1 >>=20 >> Original Text >> ------------- >> Others to want mitigate the difficulty of finding certificates from = outside the enterprise. >>=20 >> Corrected Text >> -------------- >> Others want to mitigate the difficulty of finding certificates from = outside the enterprise. >>=20 >> Notes >> ----- >> Wrong order of words. >>=20 >> Instructions: >> ------------- >> This erratum is currently posted as "Reported". If necessary, please >> use "Reply All" to discuss whether it should be verified or >> rejected. When a decision is reached, the verifying party =20 >> can log in to change the status and edit the report, if necessary.=20 >>=20 >> -------------------------------------- >> RFC8162 (draft-ietf-dane-smime-16) >> -------------------------------------- >> Title : Using Secure DNS to Associate Certificates with = Domain Names for S/MIME >> Publication Date : May 2017 >> Author(s) : P. Hoffman, J. Schlyter >> Category : EXPERIMENTAL >> Source : DNS-based Authentication of Named Entities >> Area : Security >> Stream : IETF >> Verifying Party : IESG >=20