From nobody Tue Jun 6 01:18:47 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23E7E129AD5; Tue, 6 Jun 2017 01:18:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IrqrF_VkdQEh; Tue, 6 Jun 2017 01:18:44 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DE50129AD3; Tue, 6 Jun 2017 01:18:41 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 4CBA928054D; Tue, 6 Jun 2017 10:18:39 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 4584028059A; Tue, 6 Jun 2017 10:18:39 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 3EC2928054D; Tue, 6 Jun 2017 10:18:39 +0200 (CEST) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 3B7D16000082; Tue, 6 Jun 2017 10:18:39 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 2C15C3FD23; Tue, 6 Jun 2017 10:18:39 +0200 (CEST) Date: Tue, 6 Jun 2017 10:18:39 +0200 From: Stephane Bortzmeyer To: Suresh Krishnan Cc: The IESG , tjw.ietf@gmail.com, draft-ietf-dprive-dtls-and-tls-profiles@ietf.org, dns-privacy@ietf.org, dprive-chairs@ietf.org Message-ID: <20170606081839.kqp4q5c235vu4of5@nic.fr> References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> X-Operating-System: Debian GNU/Linux 9.0 X-Kernel: Linux 4.9.0-3-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2017.6.6.80916 Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jun 2017 08:18:46 -0000 On Tue, May 09, 2017 at 08:43:15PM -0700, Suresh Krishnan wrote a message of 37 lines which said: > I do have a concern regarding section 7.3 as it is not clear what > really is being requested on the DHCP front here. While using an IP > address or an FQDN are generally both possible choices while > providing configuration options using DHCP, the use of FQDNs for > acquiring trusted DNS servers seems problematic. We have spent a > great deal of effort writing up some of the potential issues in > Section 8 of RFC7227. It seems there was no reply to this DISCUSS? If so, let me give my opinion: I disagree with the DISCUSS. Section 7.3 is just here to lay down some paths toward a future and possible DHCP extension. It does not attempt to standardize one. It does not request anything from the current DHCP servers. Mentioning section 8 of RFC 7227 could help, but this section does not discuss the DNS-specific issues (such as the fact we need both IP address and name of the DNS resolver, which RFC 7227 frame it as an exclusive choice). Possible solution if it is absolutely necessary to clear the DISCUSS: moving section 7.3 to an appendix to make clear it is not part of the DNS-over-TLS profiles definition. From nobody Tue Jun 6 11:55:46 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 75BC2129498; Tue, 6 Jun 2017 11:55:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1qOCQ3n49AOO; Tue, 6 Jun 2017 11:55:42 -0700 (PDT) Received: from mail-pf0-x242.google.com (mail-pf0-x242.google.com [IPv6:2607:f8b0:400e:c00::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB68312946A; Tue, 6 Jun 2017 11:55:42 -0700 (PDT) Received: by mail-pf0-x242.google.com with SMTP id u1so263271pfg.1; Tue, 06 Jun 2017 11:55:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CaYsaeNdmcLnTMZ/Fhjih8BgrJqXPE8Fi9v5L6Bp+ag=; b=ii3fnoxKcWAH69uoiiUGYny3esg3tDYI81Rv50MNvEgWL5uHRTy7QasFvtVeDsO0wI bXhDb0ALFONn6DOCGd/6QAKJlVo4vMo2l5GS+ezj9cetlBSI4FEvu5bFlNUOC+SszPvI Rhe1I+cEW5SZO85AXczCYvdzrdZc9NoFDHSWR6Jj+Kbwnwn0KkrhSf96BBQ2zVwU+nVW 3h4/MXKvZyIWFm4HwCcE6UC1CThBMnn+TYloNlyKgtSTf27/JHmuD8h6ed0uYGZ1GoEF WgEIIeQlrAVIqZIbP9mHphVNf6sBQQNzJJLZtHTy/SK6JD1sOB/ZHwi8hBRz4dteEXP1 K58w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=CaYsaeNdmcLnTMZ/Fhjih8BgrJqXPE8Fi9v5L6Bp+ag=; b=TP0vUezCuR4e8LyxnlMfUF0ZuFGp1rC38hRbYphJB2MIdQcFMFmPJEjPhd++wvkJe/ HKXsWLVO9JgKBOJ3Tdy9/NoFaOZSfS266nY9l+WPKwgjX83w4oX/14E1Rvy8dnv02mv9 ycldNLhqnpYJJ/osCLGxTyTJai3fYZm/AlXlXF1t7tQk2MOIiT1w9k4BhJYRB03UhZZ2 nsJLwzILq5yrMRoxWgx5COWZ3wCpjL88ucCtME9Fk6S6nLcSKrORMWLsvEnvO0Qg4hDY GAqrRtpXowsnzNB7+h8gfuxiNNbUXGw/IXRqUEQfBi7iWNmWcOuvJPIelYWmT4ZWfade rWAg== X-Gm-Message-State: AODbwcDVjzjGeKCHRGqGGwEw0de2BXEc+Azht30TiG4+mUEHJcNpc2D5 /Z9316RnKreBYw== X-Received: by 10.84.162.204 with SMTP id o12mr23481690plg.23.1496775342155; Tue, 06 Jun 2017 11:55:42 -0700 (PDT) Received: from [192.168.43.251] ([106.208.233.240]) by smtp.gmail.com with ESMTPSA id w67sm63777107pfi.2.2017.06.06.11.55.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Jun 2017 11:55:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Suresh Krishnan In-Reply-To: <20170606081839.kqp4q5c235vu4of5@nic.fr> Date: Wed, 7 Jun 2017 00:25:25 +0530 Cc: The IESG , tjw.ietf@gmail.com, draft-ietf-dprive-dtls-and-tls-profiles@ietf.org, dns-privacy@ietf.org, dprive-chairs@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> <20170606081839.kqp4q5c235vu4of5@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jun 2017 18:55:44 -0000 Hi Stephane, > On Jun 6, 2017, at 1:48 PM, Stephane Bortzmeyer = wrote: >=20 > On Tue, May 09, 2017 at 08:43:15PM -0700, > Suresh Krishnan wrote=20 > a message of 37 lines which said: >=20 >> I do have a concern regarding section 7.3 as it is not clear what >> really is being requested on the DHCP front here. While using an IP >> address or an FQDN are generally both possible choices while >> providing configuration options using DHCP, the use of FQDNs for >> acquiring trusted DNS servers seems problematic. We have spent a >> great deal of effort writing up some of the potential issues in >> Section 8 of RFC7227. >=20 > It seems there was no reply to this DISCUSS? Yes. There was no response to this DISCUSS. > If so, let me give my > opinion: I disagree with the DISCUSS. Not sure what you are disagreeing with. Are you saying this text is = clear about what is needed from the eventual DHCP option(s)? > Section 7.3 is just here to lay > down some paths toward a future and possible DHCP extension. What is(are) the paths? If it was clear, I wouldn=E2=80=99t really be = asking. =20 > It does > not attempt to standardize one. It does not request anything from the > current DHCP servers. What does this text mean? "However when using a Strict profile the DHCP servers used as sources of authentication domain names MUST be considered secure and trustworthy. This document does not attempt to describe secured and trusted relationships to DHCP servers." The strict profile requires the DHCP server to be =E2=80=9Csecure and = trustworthy=E2=80=9D but declines to define what it means by =E2=80=9Csecu= re and trusted=E2=80=9D. So I cannot tell if it requires anything from = current DHCP servers or not.=20 >=20 > Mentioning section 8 of RFC 7227 could help, but this section does not > discuss the DNS-specific issues (such as the fact we need both IP > address and name of the DNS resolver, which RFC 7227 frame it as an > exclusive choice). >=20 > Possible solution if it is absolutely necessary to clear the DISCUSS: > moving section 7.3 to an appendix to make clear it is not part of the > DNS-over-TLS profiles definition. If the text is taken out, I will certainly clear.=20 Thanks Suresh= From nobody Tue Jun 6 12:23:14 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F941129411; Tue, 6 Jun 2017 12:23:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 196bRPQ5pLf7; Tue, 6 Jun 2017 12:23:10 -0700 (PDT) Received: from mail.bortzmeyer.org (aetius.bortzmeyer.org [217.70.190.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 781D71242EA; Tue, 6 Jun 2017 12:23:10 -0700 (PDT) Received: by mail.bortzmeyer.org (Postfix, from userid 10) id 4900B31D32; Tue, 6 Jun 2017 21:23:08 +0200 (CEST) Received: by mail.sources.org (Postfix, from userid 1000) id 064C6190C30; Tue, 6 Jun 2017 21:21:39 +0200 (CEST) Date: Tue, 6 Jun 2017 21:21:39 +0200 From: Stephane Bortzmeyer To: Suresh Krishnan Cc: Stephane Bortzmeyer , tjw.ietf@gmail.com, draft-ietf-dprive-dtls-and-tls-profiles@ietf.org, dns-privacy@ietf.org, The IESG , dprive-chairs@ietf.org Message-ID: <20170606192139.GA20893@sources.org> References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> <20170606081839.kqp4q5c235vu4of5@nic.fr> <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> X-Transport: UUCP rules X-Operating-System: Debian GNU/Linux 8.8 X-Charlie: Je suis Charlie User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Jun 2017 19:23:12 -0000 On Wed, Jun 07, 2017 at 12:25:25AM +0530, Suresh Krishnan wrote a message of 42 lines which said: > > If so, let me give my opinion: I disagree with the DISCUSS. > > Not sure what you are disagreeing with. Are you saying this text is > clear about what is needed from the eventual DHCP option(s)? IMHO, yes. > The strict profile requires the DHCP server to be “secure and > trustworthy” but declines to define what it means by “secure and > trusted”. So I cannot tell if it requires anything from current DHCP > servers or not. Proposal for a new 7.3: In the typical case, a DHCP server [RFC2131] [RFC3315] provides a list of IP addresses for DNS resolvers (see section 3.8 of [RFC2132]), but does not provide a domain name for the DNS resolver, thus preventing the use of most of the authentication methods described here. (All those that are based on a mechanism with ADN in table 2.) In the future, a DHCP server might use a DHCP extension to provide a list of authentication domain names for the offered DNS servers, which correspond to IP addresses listed. People who wish to work on such a yet-to-come extension may be interested in section 8 of [RFC7227]. Even with this future extension, this leaves open the issue of the trust in the DHCP server. Of course, in a typical hotspot, the DHCP server is not to be trusted (see section 23 of [RFC3315]) for the Strict profile. When using an Opportunistic profile, it would be reasonable to use the ADN indicated by the DHCP server, given the security expectation of that profile. Some clients may have an established trust relationship with a known DHCP server for discovering their network configuration. When using a Strict profile the DHCP servers used as sources of authentication domain names is sensible only if the server is considered secure and trustworthy. This document does not attempt to describe secured and trusted relationships to DHCP servers, which is a purely DHCP issue. (Still open, at the time of writing.) Whilst some implementation work is in progress to secure IPv6 connections for DHCP, IPv4 connections have received little to no implementation attention in this area. From nobody Wed Jun 7 06:28:20 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EF8B12EC45; Wed, 7 Jun 2017 06:28:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Oj_nlNPof7DV; Wed, 7 Jun 2017 06:28:10 -0700 (PDT) Received: from haggis.mythic-beasts.com (haggis.mythic-beasts.com [IPv6:2a00:1098:0:86:1000:0:2:1]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11A4B12EC42; Wed, 7 Jun 2017 06:28:10 -0700 (PDT) Received: from [2001:b98:204:102:fffa::1b] (port=54037) by haggis.mythic-beasts.com with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1dIb0I-0000bL-Ki; Wed, 07 Jun 2017 14:28:07 +0100 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Sara Dickinson In-Reply-To: <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> Date: Wed, 7 Jun 2017 14:27:56 +0100 Cc: The IESG , Tim Wicinski , draft-ietf-dprive-dtls-and-tls-profiles@ietf.org, dns-privacy@ietf.org, dprive-chairs@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> <20170606081839.kqp4q5c235vu4of5@nic.fr> <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> To: Suresh Krishnan , Stephane Bortzmeyer X-Mailer: Apple Mail (2.3273) X-BlackCat-Spam-Score: -28 X-Mythic-Debug: State = no_sa; Score = Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2017 13:28:13 -0000 > On 6 Jun 2017, at 19:55, Suresh Krishnan = wrote: >=20 > Hi Stephane, >>=20 >> It seems there was no reply to this DISCUSS? >=20 > Yes. There was no response to this DISCUSS. Apologies, I indirectly responded to a similar comment another review = (in that we would need to update the text given that there were several = comments on it) but hadn=E2=80=99t proposed any new text. The revised = I-D is still being worked on. > On 6 Jun 2017, at 20:21, Stephane Bortzmeyer = wrote: >>=20 >> The strict profile requires the DHCP server to be =E2=80=9Csecure and >> trustworthy=E2=80=9D but declines to define what it means by = =E2=80=9Csecure and >> trusted=E2=80=9D. So I cannot tell if it requires anything from = current DHCP >> servers or not. Stephane was correct in that this section was not requesting or = proposing anything specific with regard to DHCP, only outlining a = potential future use case.=20 I have proposed some minor modifications to Stephane=E2=80=99s text = below which could make this even clearer, however if this isn=E2=80=99t = sufficient then I think moving this to an appendix would be the best = option.=20 Sara.=20 > Proposal for a new 7.3: 7.3 No configuration - dynamic discovery of ADN=20 This section discusses the general case of a DNS client discovering both = the authentication domain name and IP address dynamically. This is not = possible at the time of writing by any standard means. However since, = for example, a future DHCP extension could (in principle) provide this = mechanism the required security properties of such mechanisms are = outlined here.=20 When using a Strict profile the dynamic discovery technique used as a = source of authentication domain names MUST be considered secure and trustworthy. This requirement does not apply when = using an Opportunistic profile given the security expectation of that profile.=20 7.3.1 DHCP In the typical case today, a DHCP server [RFC2131] [RFC3315] provides a = list of IP addresses for DNS resolvers (see section 3.8 of [RFC2132]), but does not provide a domain name for the DNS resolver, thus preventing the use of most of the authentication methods described here. (All those that are based on a mechanism with ADN in table 2.) This document does not specify or request any DHCP extension to provide = authentication domain names. However, if one is developed in future work = the issues outlined in section 8 of [RFC7227] should be taken into = account as should the Security Considerations in section 23 of = [RFC3315]) .=20 This document does not attempt to describe secured and trusted relationships to DHCP servers, which is a purely DHCP issue (still open, at the time of writing.) Whilst some implementation work is in progress to secure IPv6 connections for DHCP, IPv4 connections have received little to no implementation attention in this area. From nobody Wed Jun 7 11:43:38 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAEC812EC40; Wed, 7 Jun 2017 11:43:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5126lE7H2zOa; Wed, 7 Jun 2017 11:43:15 -0700 (PDT) Received: from mail-it0-x242.google.com (mail-it0-x242.google.com [IPv6:2607:f8b0:4001:c0b::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ABDAE12ECEB; Wed, 7 Jun 2017 11:42:11 -0700 (PDT) Received: by mail-it0-x242.google.com with SMTP id 201so189916itu.1; Wed, 07 Jun 2017 11:42:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JTtv9OU/lN03YVvmiI0vGQqGDjFBqQlZAuMAuuPiX9A=; b=AEllKVC/kXKjBKo5wraeSQ7baehRVj5Cs6mAdBGkWmYWf6Y6QPcEvwHxw3hWhTPcmW EM073RWrw1P6hxgC/8jNtyuSslXDW71g+EkmY+bpaOrMhuf2EkNuuR8GLSF0CQS3uXeW AMyc4T0AHkmgCbTQg6w9sj4s6lI4U7Rat3NudNNw8O0NKoVPqwi0eKhz/mTtQVMqFZC+ O0hQ3euNaAyHKNwK/YK4aosL1DP4Xi0CrTs/CzSRpzcXsLt6oQiyVywS2f4O+w1TGCFr ECEtbdGzjsQiXakC/9cf5aQshwYy+MO1uPsLcQXgAHbKxqSnJ1pWimM/QOXqRDJVh1xC ZI6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=JTtv9OU/lN03YVvmiI0vGQqGDjFBqQlZAuMAuuPiX9A=; b=Uo8i5741NVWyALyn5OMtf0G4lZCSVASE++zWIYO/pTok+Jm0Hpa8MaUJ7VlCbSpT8C Hunfvca14QRadhqaRm5eTEYa5D8i9NJk0P7TbThiyoEnvC+Pq+nopyy6JhN4nrVPPntt 98ic4Mc6s7cAvwzZrRvY/5hwRlRnduZjkUGpZrn8Q93pLcQ1i7rvcqPn4CSaD+5+ebfd 8ktyljxIlgJiZtHNqSxj24UWIEzsvN1JOEJWoUMKNGRYI+Mujl3GNfHxfIAKhTgroGUI fvjhp3e3YJqdIuK1tXiwhqZDlU37dvctXDwqy31y06Xi4NMztptmsGPV9gPHE+GwX2hj kEUQ== X-Gm-Message-State: AODbwcAFR25ielbMlzuSafe0klPKxzbMNXDhnw//Vr0HLF7HMtugw4X5 Uhs2WUV3nChrNg== X-Received: by 10.36.0.142 with SMTP id 136mr1481761ita.116.1496860931011; Wed, 07 Jun 2017 11:42:11 -0700 (PDT) Received: from [10.0.0.10] ([117.193.186.117]) by smtp.gmail.com with ESMTPSA id z31sm1447061ita.25.2017.06.07.11.42.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Jun 2017 11:42:10 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Suresh Krishnan In-Reply-To: Date: Thu, 8 Jun 2017 00:12:03 +0530 Cc: Stephane Bortzmeyer , The IESG , Tim Wicinski , draft-ietf-dprive-dtls-and-tls-profiles@ietf.org, dns-privacy@ietf.org, dprive-chairs@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> <20170606081839.kqp4q5c235vu4of5@nic.fr> <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> To: Sara Dickinson X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2017 18:43:18 -0000 Hi Stephane/Sara, I will be happy with either of your text proposals as they certainly = clarify things for me. Regards Suresh > On Jun 7, 2017, at 6:57 PM, Sara Dickinson wrote: >=20 >=20 >> On 6 Jun 2017, at 19:55, Suresh Krishnan = wrote: >>=20 >> Hi Stephane, >>>=20 >>> It seems there was no reply to this DISCUSS? >>=20 >> Yes. There was no response to this DISCUSS. >=20 > Apologies, I indirectly responded to a similar comment another review = (in that we would need to update the text given that there were several = comments on it) but hadn=E2=80=99t proposed any new text. The revised = I-D is still being worked on. >=20 >=20 >> On 6 Jun 2017, at 20:21, Stephane Bortzmeyer = wrote: >>>=20 >>> The strict profile requires the DHCP server to be =E2=80=9Csecure = and >>> trustworthy=E2=80=9D but declines to define what it means by = =E2=80=9Csecure and >>> trusted=E2=80=9D. So I cannot tell if it requires anything from = current DHCP >>> servers or not. >=20 > Stephane was correct in that this section was not requesting or = proposing anything specific with regard to DHCP, only outlining a = potential future use case.=20 >=20 > I have proposed some minor modifications to Stephane=E2=80=99s text = below which could make this even clearer, however if this isn=E2=80=99t = sufficient then I think moving this to an appendix would be the best = option.=20 >=20 > Sara.=20 >=20 >=20 >=20 >> Proposal for a new 7.3: >=20 > 7.3 No configuration - dynamic discovery of ADN=20 >=20 > This section discusses the general case of a DNS client discovering = both the authentication domain name and IP address dynamically. This is = not possible at the time of writing by any standard means. However = since, for example, a future DHCP extension could (in principle) provide = this mechanism the required security properties of such mechanisms are = outlined here.=20 >=20 > When using a Strict profile the dynamic discovery technique used as a = source of authentication domain names MUST be > considered secure and trustworthy. This requirement does not apply = when using an Opportunistic profile given the > security expectation of that profile.=20 >=20 > 7.3.1 DHCP >=20 > In the typical case today, a DHCP server [RFC2131] [RFC3315] provides = a list > of IP addresses for DNS resolvers (see section 3.8 of [RFC2132]), but > does not provide a domain name for the DNS resolver, thus preventing > the use of most of the authentication methods described here. (All > those that are based on a mechanism with ADN in table 2.) >=20 > This document does not specify or request any DHCP extension to = provide authentication domain names. However, if one is developed in = future work the issues outlined in section 8 of [RFC7227] should be = taken into account as should the Security Considerations in section 23 = of [RFC3315]) .=20 >=20 > This document does not attempt to describe secured and > trusted relationships to DHCP servers, which is a purely DHCP > issue (still open, at the time of writing.) Whilst some > implementation work is in progress to secure IPv6 connections for > DHCP, IPv4 connections have received little to no implementation > attention in this area. >=20 >=20 >=20 >=20 From nobody Mon Jun 12 03:16:04 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F1DC1294EE for ; Mon, 12 Jun 2017 03:16:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qMajudS26u3O for ; Mon, 12 Jun 2017 03:16:02 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E560212704B for ; Mon, 12 Jun 2017 03:16:01 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 23E8628054E for ; Mon, 12 Jun 2017 12:16:00 +0200 (CEST) Received: by mx4.nic.fr (Postfix, from userid 500) id 1F324280593; Mon, 12 Jun 2017 12:16:00 +0200 (CEST) Received: from relay01.prive.nic.fr (unknown [10.1.50.11]) by mx4.nic.fr (Postfix) with ESMTP id 18C4F28054E for ; Mon, 12 Jun 2017 12:16:00 +0200 (CEST) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 162116023DF3 for ; Mon, 12 Jun 2017 12:16:00 +0200 (CEST) Received: by b12.nic.fr (Postfix, from userid 1000) id 0F5B340E20; Mon, 12 Jun 2017 12:16:00 +0200 (CEST) Date: Mon, 12 Jun 2017 12:16:00 +0200 From: Stephane Bortzmeyer To: dns-privacy@ietf.org Message-ID: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Operating-System: Debian GNU/Linux 9.0 X-Kernel: Linux 4.9.0-3-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000063, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2017.6.12.100015 Archived-At: Subject: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jun 2017 10:16:03 -0000 draft-ietf-dprive-padding-policy is now expired. Anyone knows what happens? I think that the results presented by Daniel Kahn Gillmor at NDSS were very promising (allowing to base policies on facts). From nobody Mon Jun 12 04:39:14 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51A6412E3AE for ; Mon, 12 Jun 2017 04:39:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hRv0fbMmZYLr for ; Mon, 12 Jun 2017 04:39:12 -0700 (PDT) Received: from mail.sbg.nic.at (mail.sbg.nic.at [83.136.33.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4080712E05C for ; Mon, 12 Jun 2017 04:39:10 -0700 (PDT) Received: from nics-exch2.sbg.nic.at ([10.17.175.6]) by mail.sbg.nic.at with XWall v3.52f ; Mon, 12 Jun 2017 13:39:01 +0200 Received: from NICS-EXCH2.sbg.nic.at ([fe80::a5b2:6e42:e54d:9d57]) by NICS-EXCH2.sbg.nic.at ([fe80::a5b2:6e42:e54d:9d57%12]) with mapi id 14.03.0351.000; Mon, 12 Jun 2017 13:38:57 +0200 From: Alexander Mayrhofer To: Stephane Bortzmeyer , "dns-privacy@ietf.org" Thread-Topic: [dns-privacy] Padding policies draft Thread-Index: AQHS42TxTjAJAZW3FU2TDIbYmMlaLKIhGZmg Date: Mon, 12 Jun 2017 11:38:56 +0000 Message-ID: <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> References: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> In-Reply-To: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> Accept-Language: en-US, de-DE Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.168.3.18] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-XWALL-BCKS: auto Archived-At: Subject: Re: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Jun 2017 11:39:13 -0000 Hi, > draft-ietf-dprive-padding-policy is now expired. Anyone knows what > happens? What happened is that (obviously) i did not update the draft with the late= st findings. =20 > I think that the results presented by Daniel Kahn Gillmor at NDSS were > very promising (allowing to base policies on facts). I do agree, though i think the community should discuss the implications be= fore we "set in stone" dkg's findings. Is the recommendation that he made a= lso the view of the working group? Opinions? best, Alex From nobody Tue Jun 13 00:37:53 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB9F9129B3A for ; Tue, 13 Jun 2017 00:37:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wgcROBUmn1ZH for ; Tue, 13 Jun 2017 00:37:49 -0700 (PDT) Received: from time-travellers.nl.eu.org (c.time-travellers.nl.eu.org [IPv6:2a02:2770::21a:4aff:fea3:eeaa]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAFC0128961 for ; Tue, 13 Jun 2017 00:37:49 -0700 (PDT) Received: from [2001:470:78c8:2::9] (helo=earth.zonnestelsel.tk) by time-travellers.nl.eu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.80) (envelope-from ) id 1dKgP8-0007FM-Jw; Tue, 13 Jun 2017 07:38:22 +0000 Date: Tue, 13 Jun 2017 07:37:40 +0000 From: Shane Kerr To: Alexander Mayrhofer Cc: "dns-privacy@ietf.org" Message-ID: <20170613073740.69d4d92f@earth.zonnestelsel.tk> In-Reply-To: <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> References: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> X-Mailer: Claws Mail 3.14.1 (GTK+ 2.24.31; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; boundary="Sig_/C5U.pBxB_mTMfHaP9sjFy94"; protocol="application/pgp-signature" Archived-At: Subject: Re: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jun 2017 07:37:52 -0000 --Sig_/C5U.pBxB_mTMfHaP9sjFy94 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Alexander and all, tl;dr Lets move forward with our best guesses now. dkg's recommendations seem good, but maybe we can tweak these based on expected maximum packet sizes. [ apologies for the rambling post ] At 2017-06-12 11:38:56 +0000 Alexander Mayrhofer wrote: > Hi, >=20 > > draft-ietf-dprive-padding-policy is now expired. Anyone knows what > > happens? =20 >=20 > What happened is that (obviously) i did not update the draft with > the latest findings.=20 > > > I think that the results presented by Daniel Kahn Gillmor at NDSS > > were very promising (allowing to base policies on facts). =20 >=20 > I do agree, though i think the community should discuss the > implications before we "set in stone" dkg's findings. Is the > recommendation that he made also the view of the working group? > Opinions? By NDSS I guess we mean this work? https://gitlab.labs.nic.cz/labs/knot/merge_requests/692 I had not seen the presentation, and it was very interesting. I knew that dkg was working on this, but didn't know he had actually put it together. Nice to see actual measurements and modeling based on the measurements! One implicit assumption in this though is that bandwidth costs are important to minimize. My understanding is that DNS actually uses very little bandwidth compared to actual traffic - which is reasonable since DNS is basically metadata. While we see a lot of DoS or DDoS or reflection attacks that consume a lot of bandwidth, mostly these are problems because DNS uses UDP without validating source address; in DNS over TCP/TLS/DTLS/HTTP we don't have that problem. I am told that packets-per-second is the much bigger problem with DNS. This makes sense because DNS is a horrible protocol for modern network and server architectures in terms of performance, so we are almost always CPU-bound. For me this implies that we need to be very careful to avoid padding in a way that adds extra packets. Note that we cannot insure this, because there will always be some packets near the magical 1500 byte Ethernet boundary, and we'll want to pad them, but those are rare even with DNSSEC and encryption bloating things. It also implies that padding which does NOT add extra packets might not matter so much. What we can say for sure is that we have no real idea how moving to DNS-over-TLS is going to impact the performance of DNS going forward. Does the CPU time for encrypting matter more than the CPU time for doing DNS processing? Is it just a rounding error? Will the extra handshakes for TLS be the highest cost? Will maintaining state about clients on the server to minimize handshakes make memory our bottleneck?=20 Bringing us back to the question at hand... I think we should go ahead and make recommendations based on the best guesses that we have now. Those seem to be dkg's. Sure, it would be nice if we replicated the work based on additional resolver data sets. I don't see many people volunteering to do that work though. And sure, it would be nice if we could have a handful of cryptanalysts able to publish their results=20 think about the problem and make recommendations, but I don't see any of them around either. :) The only question I have is whether we want to expand the response padding a little. I see a few options: 1. We could pad to 500 bytes, which would mean saving a packet for DNS messages between 1404 (468*3) and 1500 bytes long in the usual case. 2. We could pad to 486 bytes, which means that we would get as many paddings as possible in a 1460 byte packet (small enough for tunneled IPv6 traffic). This would save a packet for DNS messages between 1404 and 1460 bytes. I especially like that 486 is easily confused with 468, dkg's original recommendation. ;) A similar logic about packet sizes might be applied for query padding, but in practice queries are never that big so I am happy with the 128 byte recommendation. Cheers, -- Shane --Sig_/C5U.pBxB_mTMfHaP9sjFy94 Content-Type: application/pgp-signature Content-Description: OpenPGP digitale handtekening -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEdhRx2J+MnJeBOVlgNzKXnPlnswYFAlk/lkQACgkQNzKXnPln swb2LA//R+I6qrno864s+kWkW56m0U0w3MrV1Yl+MdhMO0DbtLSQtkdH2J9pMazh 0OgJEqFYZwdKDwXLHSWJuax200HVE4smVlmh/AfsZ90yAetv+6Wubzn6vS7Ya3Px +jaDcI0LmCQOV80THOfjhxJrwwmTKx5pk6LfgioZsvgkZsy1DTO6FKQq37jyu36+ D295TS3WlfVKRdizjZHuWcpRxn4UC7ZaHyyjwwK3FES95CyDm0TfVD62klQxU+d6 3kPk55uWFhG4pXZHkyM9Vh3qEP8o3IDHBBcEhEFGByA89BnXpIatigLweL9/3S4A +XFsdVrvz/GZcKeA2D96ullWDUThmgdvst4YR4XGqA936pNpLo+44cFWKKzibUr6 cclltSOt4vN5APe7O9L804/MvY72V75iATNPk28KSJFgzPmK3s5dYtSxapSyZ2bO 80OKmX/qhOcIcHjEgfisC5rCgDrYdOvuRDpNdE30PXjW+kClOMVCHfCByMl6Z5Qm lNJAQWLA6oDs57OTdwqhqETR+WvZOy0AQVEV4gs1wZZorMnab2x2i5JH0IOQO6vz 4K/HsUh+CVN6zkYVSbCAJSOzrsgl33W7unAZkU/82IbQNF2+B4y+e18AprBqPTK4 GsyRWgfNp8xh/ftV6/lQofzBH+a4o2GNABRUGtXsEHlSnlQ3Mq8= =NQVA -----END PGP SIGNATURE----- --Sig_/C5U.pBxB_mTMfHaP9sjFy94-- From nobody Thu Jun 15 18:12:51 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8E271205F1; Thu, 15 Jun 2017 18:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wg_1O4CBFLdo; Thu, 15 Jun 2017 18:12:40 -0700 (PDT) Received: from out.west.pexch112.icann.org (pfe112-ca-2.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C4D7C129C25; Thu, 15 Jun 2017 18:12:40 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Thu, 15 Jun 2017 18:12:38 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1178.000; Thu, 15 Jun 2017 18:12:38 -0700 From: Terry Manderson To: Suresh Krishnan , Sara Dickinson CC: Tim Wicinski , Stephane Bortzmeyer , The IESG , "dprive-chairs@ietf.org" , "draft-ietf-dprive-dtls-and-tls-profiles@ietf.org" , "dns-privacy@ietf.org" Thread-Topic: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) Thread-Index: AQHSyT+Q1CvwZxqsokWHHmm2TiZxC6IYHdqAgACx6YCAATbVAIAAV8OAgA2naQA= Date: Fri, 16 Jun 2017 01:12:38 +0000 Message-ID: <3D2ADE97-A5A1-4A10-875F-3E776C6F9A34@icann.org> References: <149438779589.28796.5612447657226364837.idtracker@ietfa.amsl.com> <20170606081839.kqp4q5c235vu4of5@nic.fr> <5AC191C7-C001-4439-B609-5DC289D84944@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.20.0.170309 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3580456356_491847746" MIME-Version: 1.0 Archived-At: Subject: Re: [dns-privacy] Suresh Krishnan's Discuss on draft-ietf-dprive-dtls-and-tls-profiles-09: (with DISCUSS) X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jun 2017 01:12:43 -0000 --B_3580456356_491847746 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Thanks Suresh.. Authors, any ETA on when the revs that addresses Suresh's and EKR's Discuss= es? Cheers Terry On 8/06/2017, 4:42 AM, "iesg on behalf of Suresh Krishnan" wrote: Hi Stephane/Sara, I will be happy with either of your text proposals as they certainly = clarify things for me. =20 Regards Suresh =20 > On Jun 7, 2017, at 6:57 PM, Sara Dickinson wrote: >=20 >=20 >> On 6 Jun 2017, at 19:55, Suresh Krishnan = wrote: >>=20 >> Hi Stephane, >>>=20 >>> It seems there was no reply to this DISCUSS? >>=20 >> Yes. There was no response to this DISCUSS. >=20 > Apologies, I indirectly responded to a similar comment another review= (in that we would need to update the text given that there were several com= ments on it) but hadn=E2=80=99t proposed any new text. The revised I-D is still be= ing worked on. >=20 >=20 >> On 6 Jun 2017, at 20:21, Stephane Bortzmeyer wro= te: >>>=20 >>> The strict profile requires the DHCP server to be =E2=80=9Csecure and >>> trustworthy=E2=80=9D but declines to define what it means by =E2=80=9Csecure an= d >>> trusted=E2=80=9D. So I cannot tell if it requires anything from current D= HCP >>> servers or not. >=20 > Stephane was correct in that this section was not requesting or propo= sing anything specific with regard to DHCP, only outlining a potential futur= e use case.=20 >=20 > I have proposed some minor modifications to Stephane=E2=80=99s text below w= hich could make this even clearer, however if this isn=E2=80=99t sufficient then I= think moving this to an appendix would be the best option.=20 >=20 > Sara.=20 >=20 >=20 >=20 >> Proposal for a new 7.3: >=20 > 7.3 No configuration - dynamic discovery of ADN=20 >=20 > This section discusses the general case of a DNS client discovering b= oth the authentication domain name and IP address dynamically. This is not p= ossible at the time of writing by any standard means. However since, for exa= mple, a future DHCP extension could (in principle) provide this mechanism th= e required security properties of such mechanisms are outlined here.=20 >=20 > When using a Strict profile the dynamic discovery technique used as a= source of authentication domain names MUST be > considered secure and trustworthy. This requirement does not apply wh= en using an Opportunistic profile given the > security expectation of that profile.=20 >=20 > 7.3.1 DHCP >=20 > In the typical case today, a DHCP server [RFC2131] [RFC3315] provides= a list > of IP addresses for DNS resolvers (see section 3.8 of [RFC2132]), but > does not provide a domain name for the DNS resolver, thus preventing > the use of most of the authentication methods described here. (All > those that are based on a mechanism with ADN in table 2.) >=20 > This document does not specify or request any DHCP extension to provi= de authentication domain names. However, if one is developed in future work = the issues outlined in section 8 of [RFC7227] should be taken into account a= s should the Security Considerations in section 23 of [RFC3315]) .=20 >=20 > This document does not attempt to describe secured and > trusted relationships to DHCP servers, which is a purely DHCP > issue (still open, at the time of writing.) Whilst some > implementation work is in progress to secure IPv6 connections for > DHCP, IPv4 connections have received little to no implementation > attention in this area. >=20 >=20 >=20 >=20 =20 =20 --B_3580456356_491847746 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIYwwYJKoZIhvcNAQcCoIIYtDCCGLACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC FowwggV0MIIEXKADAgECAhAJ0fxYYYV36W1njUywVtW8MA0GCSqGSIb3DQEBCwUAMGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xNTAzMjYw MDAwMDBaFw0xODAzMjYxMjAwMDBaMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv cm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEYMBYGA1UEAxMPVGVycnkgTWFu ZGVyc29uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwTImt0Ol/9dOAbnm4lby 4RG1iQEnHVB5UJTYqwX8kqEhA5NPFHbMX22ChnP7M/zIlY+OP2TfKcwfdF5DJN4ybt4gFGzE 9ksigMe365F0uA2Q4+CskwqWo2fGIqrhgb0C68bg6EnZxj73KlJ0mvbQqzLBY8fVwr8srWpB BexjbYSeXp/+0W41ZOJPcdii59TDXRBGuziWjp+rd7yh8KCzKcj/Px1TzAE5U/TftZOfigYi h6KTTDZBGnN+4DDaaCnZ93rveayavI3hd4agqiIWe/gB78+0vHyk5DFoe6HkwuL0qJVaBW57 KIt8AYq+p0P+igNhiQoHkPx3VvS7ZViGdQIDAQABo4IB8jCCAe4wHwYDVR0jBBgwFoAU5wIj gABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFIXwv/ZX+K34v+mCL8g1Coo9c6lMMAwGA1Ud EwEB/wQCMAAwJAYDVR0RBB0wG4EZdGVycnkubWFuZGVyc29uQGljYW5uLm9yZzAOBgNVHQ8B Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYK YIZIAYb9bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT MIGIBgNVHR8EgYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0 U0hBMkFzc3VyZWRJRENBLWcxLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29t L0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRENBLWcxLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYB BQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2Nh Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG 9w0BAQsFAAOCAQEAH1Dvq3r4yh4+zU4t+5Rg3EzwMpSPxApBivVcW/KPq9uwdlu3yGBPJlG9 j4BXOT7fEUEGpCfyfRhBzTReyc2zask73fDRTzNFl5U3gqzOre5+Xtzv0qHyZGZ2EGcPTFv9 oaAVTug//Z6ZSr4dtDphV/7uSA4Hj1riFh5yxHErwUfrbCneIspVqwSVJqjkKWGID6W0YB0D cYJZGlyAH0FP/4+TMDxXOti2ypQrsZpNSfvc4TGC1p13Lyp4XEY+UysVtcypAgersTBN6gCb 7ueBt5KPTj9pH4w4C0lNO6rRIc6AGtJIuXHYyiy9CXUTOT5xLToXLZCyPXd+HFuWwdD9lzCC Bk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcNAQELBQAwZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEzMTEwNTEyMDAw MFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr +Lp+yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQ elAfJUXo8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK 3OnZ9ZEXjsYhrTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uC ig1xGOSm4IksG/OyczzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/ BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzAB hhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9j cmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0 dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYD VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgB hv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCC AWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABpAHMAIABD AGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABhAGMAYwBl AHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBD AFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5ACAAQQBn AHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBiAGkAbABp AHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAgAGgAZQBy AGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP2Ne8 lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrg YhmZpgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg 4/mgVgxIEM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmw XZG0k4f5lpaBVUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1Y EhEybr1DDE0023vGQtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIwggO3 MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x JDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBa Fw0zMTExMTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQg SUQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfz t2D5cRKlrtwmlIiq9M71IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq 9g+YMjZ2zN7dPKii72r7IfJSYd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OM M9nYLxj+KA+zp4PWw25EwGE1lhb+WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJ fDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwO sLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Yd08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGG MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXroq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1Ud IwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBBQUAA4IBAQCiDrzf4u3w 43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwSTFjk0z2DSUVYlzVpGqhH6lbG easS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJs13rsgkq6ybteL59Pyvz tyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLxvlBnt2y98/Efaww2 BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76jRslbWyPpbdh AbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIHAzCCBeugAwIBAgIQD89pSVGb AJQ9+ZeKCcX9BTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGln aUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2Vy dCBBc3N1cmVkIElEIENBLTEwHhcNMTIwMzI3MDAwMDAwWhcNMTUwMzI3MTIwMDAwWjCBrDEL MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFzAVBgNVBAcTDk1hcmluYSBkZWwg UmV5MTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jwb3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMg YW5kIE51bWJlcnMxFzAVBgNVBAsTDkROUyBPcGVyYXRpb25zMRgwFgYDVQQDEw9UZXJyeSBN YW5kZXJzb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkYWeFt1OjJ30tsKGB BQiMjfoNTDSC6JG1CpPj05eZpit0LVkMU0jrtrHczcRzMuqdkaE/QTBjmprbRatlrMEq7uv+ yU9U35crRmjx3yuZDD/6SOO4ZnMFBJvWdevSOWq+8wU4hAEANOnBirYCfF4oixVCBy1bkat1 hsY5xUx5QB12OpnYA0/57QJ6BL7z1ZuF6lJ4yYmU0qI88q9atkahb8l7Nm5TgEbpg6ryyN98 ixnFLmhC/gPoYKHczP3y+JHaMveuJl75hHq6ZuHeH2PyX20VFsXNBKJrvZ8BhTZOoozuNapP jiG6HLdqngPuTz3JVyTTR2FX809nclnxoMWjAgMBAAGjggNoMIIDZDAfBgNVHSMEGDAWgBQV ABIrE5iymQftHt+ivlcNK2cCzTAdBgNVHQ4EFgQUs8L0dmF6T/V40vXJJzF+YNyzNo0wJAYD VR0RBB0wG4EZdGVycnkubWFuZGVyc29uQGljYW5uLm9yZzAOBgNVHQ8BAf8EBAMCBaAwHQYD VR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMH0GA1UdHwR2MHQwOKA2oDSGMmh0dHA6Ly9j cmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRENBLTEuY3JsMDigNqA0hjJodHRw Oi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURDQS0xLmNybDCCAcUGA1Ud IASCAbwwggG4MIIBtAYKYIZIAYb9bAQBAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cu ZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYe ggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEA dABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8A ZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMAIABhAG4AZAAgAHQA aABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAA dwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAgAGEA cgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIAeQAgAHIA ZQBmAGUAcgBlAG4AYwBlAC4wdwYIKwYBBQUHAQEEazBpMCQGCCsGAQUFBzABhhhodHRwOi8v b2NzcC5kaWdpY2VydC5jb20wQQYIKwYBBQUHMAKGNWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 LmNvbS9EaWdpQ2VydEFzc3VyZWRJRENBLTEuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN AQEFBQADggEBAGKcMSvyr3YW8kKqyqdspTEKTc6lR6H6OITyC056f6PlMmFZ+nWlkopWlflz QcxOUZv3+5rNogNcwczrxr+eaSx9J+pYCEU3rgBs3yiLDwsD72EJJDAD1x84fQOOJtfYb4oE 4Djzco83Dk4h6sMAiUg0xGcdewhJK80D6tb3xtS75PgFoxLcQrBprLghx2mY8EPErBiO1uXA NWOEU3EH+kvXiKUrDsFyGHQ4FqvVIYv2plu68ltOmBh+wR2oraoJpt9jGbond1MyVFOvi48e 7hgPRXupNbjxB4Wl0wKKGz0qT3ToBpp8VAkULtjiO/iPLx4knuwwvy5sRAwuZAfpVE4xggH/ MIIB+wIBATB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNV BAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ RCBDQQIQCdH8WGGFd+ltZ41MsFbVvDAJBgUrDgMCGgUAoF0wIwYJKoZIhvcNAQkEMRYEFIuE x4ZqZ6QUJPLUP7w26ANb108eMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN AQkFMQ8XDTE3MDYxNjAxMTIzNlowDQYJKoZIhvcNAQEBBQAEggEAD1Iuyz0vCMX8HGazyRAB +WdRdwItMlJjS6J11qN4xt/SRm1wNvvOYN4mvTi9Ln3aEtNngkS8ZdByiFagOpw2X2o2TIzp MCiA9gPhcDByoxRL1q3C5ERSXgBWXB7oRRBX4+Tpt/7n2e36S9Oib8E3Cooo4mwh4AmgOMZY 9kMtaenZ6dKi7EXZ3SE5A4rLtQ32hq1uyeIQsuEkmRS9d+cVvU1TM1GfsNgdfp1PG1lByzct 7U01B5Ts2K4XRMLgyvEITntGtJeYoJWD8RQh/idP2PIPNIWm2pLIr/4Ha09FX85iDbiRMk8+ pmdZ0wASZmD4guycQBgGUbyszIQQhP5q2w== --B_3580456356_491847746-- From nobody Thu Jun 15 18:29:55 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8896B12EB14 for ; Thu, 15 Jun 2017 18:29:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.203 X-Spam-Level: X-Spam-Status: No, score=-4.203 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bsQRSLsh4d65 for ; Thu, 15 Jun 2017 18:29:51 -0700 (PDT) Received: from out.west.pexch112.icann.org (pfe112-ca-1.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E14A7129408 for ; Thu, 15 Jun 2017 18:29:51 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1178.4; Thu, 15 Jun 2017 18:29:49 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1178.000; Thu, 15 Jun 2017 18:29:49 -0700 From: Terry Manderson To: "dns-privacy@ietf.org" CC: Brian Haberman Thread-Topic: Change of DPRIVE co-chair Thread-Index: AQHS5kALfmH2vLlu7EOdiaNTX/L/Qg== Date: Fri, 16 Jun 2017 01:29:48 +0000 Message-ID: <0AB5EB62-552C-4522-BD02-28C89E103DC2@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.20.0.170309 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3580457387_593413627" MIME-Version: 1.0 Archived-At: Subject: [dns-privacy] Change of DPRIVE co-chair X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jun 2017 01:29:53 -0000 --B_3580457387_593413627 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit DPRIVE Colleagues, As you may have noticed Warren has firmly taken hold of the reins as required for an OPS AD. He is stepping down from the co-chair role in DPRIVE. I'd like to express my sincere thanks to Warren for his work in the first phase of DPRIVE. Finding a replacement for Warren took some consideration given DPRIVE wishes to expand its scope to seriously look at options related to resolver to authoritative. This won't be a walk in the park!! (and I think you all know this already) What made this decision harder is that when you have a well-functioning Working Group (like DPRIVE) you really don't want to mess with it!! This is as much about the chairs as it is for the involvement and professionalism of the WG participants! I have asked Brian Haberman to join the WG leadership as co-chair with Tim. Brian has accepted and will be seated as co-chair by Prague. Cheers Terry --B_3580457387_593413627 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIYwwYJKoZIhvcNAQcCoIIYtDCCGLACAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC FowwggV0MIIEXKADAgECAhAJ0fxYYYV36W1njUywVtW8MA0GCSqGSIb3DQEBCwUAMGUxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJRCBDQTAeFw0xNTAzMjYw MDAwMDBaFw0xODAzMjYxMjAwMDBaMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZv cm5pYTEUMBIGA1UEBxMLTG9zIEFuZ2VsZXMxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEYMBYGA1UEAxMPVGVycnkgTWFu ZGVyc29uMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwTImt0Ol/9dOAbnm4lby 4RG1iQEnHVB5UJTYqwX8kqEhA5NPFHbMX22ChnP7M/zIlY+OP2TfKcwfdF5DJN4ybt4gFGzE 9ksigMe365F0uA2Q4+CskwqWo2fGIqrhgb0C68bg6EnZxj73KlJ0mvbQqzLBY8fVwr8srWpB BexjbYSeXp/+0W41ZOJPcdii59TDXRBGuziWjp+rd7yh8KCzKcj/Px1TzAE5U/TftZOfigYi h6KTTDZBGnN+4DDaaCnZ93rveayavI3hd4agqiIWe/gB78+0vHyk5DFoe6HkwuL0qJVaBW57 KIt8AYq+p0P+igNhiQoHkPx3VvS7ZViGdQIDAQABo4IB8jCCAe4wHwYDVR0jBBgwFoAU5wIj gABP2Ne8lAvZP3Q5STI8inkwHQYDVR0OBBYEFIXwv/ZX+K34v+mCL8g1Coo9c6lMMAwGA1Ud EwEB/wQCMAAwJAYDVR0RBB0wG4EZdGVycnkubWFuZGVyc29uQGljYW5uLm9yZzAOBgNVHQ8B Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMEMGA1UdIAQ8MDowOAYK YIZIAYb9bAQBAjAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BT MIGIBgNVHR8EgYAwfjA9oDugOYY3aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0 U0hBMkFzc3VyZWRJRENBLWcxLmNybDA9oDugOYY3aHR0cDovL2NybDQuZGlnaWNlcnQuY29t L0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRENBLWcxLmNybDB5BggrBgEFBQcBAQRtMGswJAYIKwYB BQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2Nh Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMkFzc3VyZWRJRENBLmNydDANBgkqhkiG 9w0BAQsFAAOCAQEAH1Dvq3r4yh4+zU4t+5Rg3EzwMpSPxApBivVcW/KPq9uwdlu3yGBPJlG9 j4BXOT7fEUEGpCfyfRhBzTReyc2zask73fDRTzNFl5U3gqzOre5+Xtzv0qHyZGZ2EGcPTFv9 oaAVTug//Z6ZSr4dtDphV/7uSA4Hj1riFh5yxHErwUfrbCneIspVqwSVJqjkKWGID6W0YB0D cYJZGlyAH0FP/4+TMDxXOti2ypQrsZpNSfvc4TGC1p13Lyp4XEY+UysVtcypAgersTBN6gCb 7ueBt5KPTj9pH4w4C0lNO6rRIc6AGtJIuXHYyiy9CXUTOT5xLToXLZCyPXd+HFuWwdD9lzCC Bk4wggU2oAMCAQICEASueWBmZpAaucV/pmxb3M0wDQYJKoZIhvcNAQELBQAwZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTEzMTEwNTEyMDAw MFoXDTI4MTEwNTEyMDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgU0hBMiBB c3N1cmVkIElEIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3PgRIz9qte/A J3kbLQWHohBDMd8O1BUbT3ekIs4+jHDwvgeO3ScqvAEdtiwKyt1pWB9B7WoFH9pjeFkeIiwr +Lp+yTU7VvEffEJ+JbAjGcZFONc9RPkgfGCuHLBaGAS+jzv3qfCUmqYMY0m2QRdTQDK9T+ZQ elAfJUXo8Ymvzf9e/1Dz8BcR/73FifW9YrnY+45FBIVtmc3FSE39JqsCNkXqNtdfauIagkEK 3OnZ9ZEXjsYhrTg8E+Yef2ac1U3ZRtr2z1KnfTskw7TBUTXGm+vU737kewPhRL16CzfgT8uC ig1xGOSm4IksG/OyczzBsJKeGH29q33FfQihLMKfcwIDAQABo4IC+DCCAvQwEgYDVR0TAQH/ BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzAB hhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wgYEGA1UdHwR6MHgwOqA4oDaGNGh0dHA6Ly9j cmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwOqA4oDaGNGh0 dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwHQYD VR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMIIBswYDVR0gBIIBqjCCAaYwggGiBgpghkgB hv1sAAIEMIIBkjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCC AWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABpAHMAIABD AGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABhAGMAYwBl AHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBD AFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5ACAAQQBn AHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBiAGkAbABp AHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAgAGgAZQBy AGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjAdBgNVHQ4EFgQU5wIjgABP2Ne8 lAvZP3Q5STI8inkwHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQELBQADggEBAE7UiSe5/R2Hd34PKAWQ8QovyTs+vZOckMav+pFRhzJUa+jKwXFRXJmOtfrg YhmZpgeafBMn2+UCooQS2RX2CkRXxDSPbXMfOtagAT3e44LkRWuy6yX9gF4dOZC+W0L2zpFg 4/mgVgxIEM4zaHvNk6vwastPWA+5e10bBIGepyLiV0kn7pKTCL5pCFMCOi5dyBn0UIBOAtmw XZG0k4f5lpaBVUCOZu2C2LsoX+1MYe0GWCgZUxFEvEcgKbIEbNiJVJk7ddtneCweknjGVT1Y EhEybr1DDE0023vGQtvsvqubYUwGkuOO3yEqUFcEwGCiNdUknmY3CUnP1fhls+DibsIwggO3 MIICn6ADAgECAhAM5+DlF9hG/o/lYPwb8DA5MA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYT AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x JDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBa Fw0zMTExMTAwMDAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMx GTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQg SUQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAK0OFc7kQ4BcsYfz t2D5cRKlrtwmlIiq9M71IDkoWGAM+IDaqRWVMmE8tbEohIqK3J8KDIMXeo+QrIrneVNcMYQq 9g+YMjZ2zN7dPKii72r7IfJSYd+fINcf4rHZ/hhk0hJbX/lYGDW8R82hNvlrf9SwOD7BG8OM M9nYLxj+KA+zp4PWw25EwGE1lhb+WZyLdm3X8aJLDSv/C3LanmDQjpA1xnhVhyChz+VtCshJ fDGYM2wi6YfQMlqiuhOCEe05F52ZOnKh5vqk2dUXMXWuhX0irj8BRob2KHnIsdrkVxfEfhwO sLSSplazvbKX7aqn8LfFqD+VFtD/oZbrCF8Yd08CAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGG MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFEXroq/0ksuCMS1Ri6enIZ3zbcgPMB8GA1Ud IwQYMBaAFEXroq/0ksuCMS1Ri6enIZ3zbcgPMA0GCSqGSIb3DQEBBQUAA4IBAQCiDrzf4u3w 43JzemSUv/dyZtgy5EJ1Yq6H6/LV2d5Ws5/MzhQouQ2XYFwSTFjk0z2DSUVYlzVpGqhH6lbG easS2GeBhN9/CTyU5rgmLCC9PbMoifdf/yLil4Qf6WXvh+DfwWdJs13rsgkq6ybteL59Pyvz tyY1bV+JAbZJW58BBZurPSXBzLZ/wvFvhsb6ZGjrgS2U60K3+owe3WLxvlBnt2y98/Efaww2 BxZ/N3ypW2168RJGYIPXJwS+S86XvsNnKmgR34DnDDNmvxMNFG7zfx9jEB76jRslbWyPpbdh AbHSoyahEHGdreLD+cOZUbcrBwjOLuZQsqf6CkUvovDyMIIHAzCCBeugAwIBAgIQD89pSVGb AJQ9+ZeKCcX9BTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGln aUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2Vy dCBBc3N1cmVkIElEIENBLTEwHhcNMTIwMzI3MDAwMDAwWhcNMTUwMzI3MTIwMDAwWjCBrDEL MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFzAVBgNVBAcTDk1hcmluYSBkZWwg UmV5MTwwOgYDVQQKEzNJbnRlcm5ldCBDb3Jwb3JhdGlvbiBmb3IgQXNzaWduZWQgTmFtZXMg YW5kIE51bWJlcnMxFzAVBgNVBAsTDkROUyBPcGVyYXRpb25zMRgwFgYDVQQDEw9UZXJyeSBN YW5kZXJzb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkYWeFt1OjJ30tsKGB BQiMjfoNTDSC6JG1CpPj05eZpit0LVkMU0jrtrHczcRzMuqdkaE/QTBjmprbRatlrMEq7uv+ yU9U35crRmjx3yuZDD/6SOO4ZnMFBJvWdevSOWq+8wU4hAEANOnBirYCfF4oixVCBy1bkat1 hsY5xUx5QB12OpnYA0/57QJ6BL7z1ZuF6lJ4yYmU0qI88q9atkahb8l7Nm5TgEbpg6ryyN98 ixnFLmhC/gPoYKHczP3y+JHaMveuJl75hHq6ZuHeH2PyX20VFsXNBKJrvZ8BhTZOoozuNapP jiG6HLdqngPuTz3JVyTTR2FX809nclnxoMWjAgMBAAGjggNoMIIDZDAfBgNVHSMEGDAWgBQV ABIrE5iymQftHt+ivlcNK2cCzTAdBgNVHQ4EFgQUs8L0dmF6T/V40vXJJzF+YNyzNo0wJAYD VR0RBB0wG4EZdGVycnkubWFuZGVyc29uQGljYW5uLm9yZzAOBgNVHQ8BAf8EBAMCBaAwHQYD VR0lBBYwFAYIKwYBBQUHAwQGCCsGAQUFBwMCMH0GA1UdHwR2MHQwOKA2oDSGMmh0dHA6Ly9j cmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRENBLTEuY3JsMDigNqA0hjJodHRw Oi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURDQS0xLmNybDCCAcUGA1Ud IASCAbwwggG4MIIBtAYKYIZIAYb9bAQBAjCCAaQwOgYIKwYBBQUHAgEWLmh0dHA6Ly93d3cu ZGlnaWNlcnQuY29tL3NzbC1jcHMtcmVwb3NpdG9yeS5odG0wggFkBggrBgEFBQcCAjCCAVYe ggFSAEEAbgB5ACAAdQBzAGUAIABvAGYAIAB0AGgAaQBzACAAQwBlAHIAdABpAGYAaQBjAGEA dABlACAAYwBvAG4AcwB0AGkAdAB1AHQAZQBzACAAYQBjAGMAZQBwAHQAYQBuAGMAZQAgAG8A ZgAgAHQAaABlACAARABpAGcAaQBDAGUAcgB0ACAAQwBQAC8AQwBQAFMAIABhAG4AZAAgAHQA aABlACAAUgBlAGwAeQBpAG4AZwAgAFAAYQByAHQAeQAgAEEAZwByAGUAZQBtAGUAbgB0ACAA dwBoAGkAYwBoACAAbABpAG0AaQB0ACAAbABpAGEAYgBpAGwAaQB0AHkAIABhAG4AZAAgAGEA cgBlACAAaQBuAGMAbwByAHAAbwByAGEAdABlAGQAIABoAGUAcgBlAGkAbgAgAGIAeQAgAHIA ZQBmAGUAcgBlAG4AYwBlAC4wdwYIKwYBBQUHAQEEazBpMCQGCCsGAQUFBzABhhhodHRwOi8v b2NzcC5kaWdpY2VydC5jb20wQQYIKwYBBQUHMAKGNWh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0 LmNvbS9EaWdpQ2VydEFzc3VyZWRJRENBLTEuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcN AQEFBQADggEBAGKcMSvyr3YW8kKqyqdspTEKTc6lR6H6OITyC056f6PlMmFZ+nWlkopWlflz QcxOUZv3+5rNogNcwczrxr+eaSx9J+pYCEU3rgBs3yiLDwsD72EJJDAD1x84fQOOJtfYb4oE 4Djzco83Dk4h6sMAiUg0xGcdewhJK80D6tb3xtS75PgFoxLcQrBprLghx2mY8EPErBiO1uXA NWOEU3EH+kvXiKUrDsFyGHQ4FqvVIYv2plu68ltOmBh+wR2oraoJpt9jGbond1MyVFOvi48e 7hgPRXupNbjxB4Wl0wKKGz0qT3ToBpp8VAkULtjiO/iPLx4knuwwvy5sRAwuZAfpVE4xggH/ MIIB+wIBATB5MGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNV BAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IFNIQTIgQXNzdXJlZCBJ RCBDQQIQCdH8WGGFd+ltZ41MsFbVvDAJBgUrDgMCGgUAoF0wIwYJKoZIhvcNAQkEMRYEFCeH QgmYxopPS3xcsDp5C2S2WJ7uMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcN AQkFMQ8XDTE3MDYxNjAxMjk0N1owDQYJKoZIhvcNAQEBBQAEggEAUGIDraK3ZETOvOzQ341U 8lDtvSsNJKAHvChoHSHK2Rny3ep4y3Oe7+PzhjVOwIn27XRnnX3N8iEbXWKXwA0fDMqrnWM1 KRx3v2+izzPRWixnCOIm4NTDDl+vE6l5SSJvfRILHUvX2HQ4IdtVEBCc+qqSi3HnArGwjNjR VyhjHA4RWp3VVA0BGuZyxQQJ7Vgog8VtvLI3MuopGjk/cXEGf96IlwmIiIkHfU9mTdF8V4VT 10AHYnFbAbChRXmZAwkuR4BReggTuN6MXHqnfqF+oFiNWzjZ5N2hq7iqAfDgUuAure+88dph vH4T73+FKl192eFaMyzw1UyAN1PDRRgwmQ== --B_3580457387_593413627-- From nobody Fri Jun 16 01:49:44 2017 Return-Path: X-Original-To: dns-privacy@ietf.org Delivered-To: dns-privacy@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F1B51316E3; Fri, 16 Jun 2017 01:49:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: dns-privacy@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.54.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149760298355.24202.1993259713348794426@ietfa.amsl.com> Date: Fri, 16 Jun 2017 01:49:43 -0700 Archived-At: Subject: [dns-privacy] I-D Action: draft-ietf-dprive-dtls-and-tls-profiles-10.txt X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jun 2017 08:49:43 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS PRIVate Exchange of the IETF. Title : Usage and (D)TLS Profiles for DNS-over-(D)TLS Authors : Sara Dickinson Daniel Kahn Gillmor Tirumaleswar Reddy Filename : draft-ietf-dprive-dtls-and-tls-profiles-10.txt Pages : 29 Date : 2017-06-16 Abstract: This document discusses Usage Profiles, based on one or more authentication mechanisms, which can be used for DNS over Transport Layer Security (TLS) or Datagram TLS (DTLS). These profiles can increase the privacy of DNS transactions compared to using only clear text DNS. This document also specifies new authentication mechanisms - it describes several ways a DNS client can use an authentication domain name to authenticate a (D)TLS connection to a DNS server. Additionally, it defines (D)TLS protocol profiles for DNS clients and servers implementing DNS-over-(D)TLS. This document updates RFC 7858. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-dprive-dtls-and-tls-profiles-10 https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dtls-and-tls-profiles-10 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-and-tls-profiles-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Fri Jun 16 01:52:37 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8B841316E3 for ; Fri, 16 Jun 2017 01:52:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id meoqhrUK4aUz for ; Fri, 16 Jun 2017 01:52:33 -0700 (PDT) Received: from balrog.mythic-beasts.com (balrog.mythic-beasts.com [IPv6:2a00:1098:0:82:1000:0:2:1]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A4FE1316EA for ; Fri, 16 Jun 2017 01:52:25 -0700 (PDT) Received: from [2001:b98:204:102:fffa::1b] (port=52977) by balrog.mythic-beasts.com with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1dLmzO-00018H-Su for dns-privacy@ietf.org; Fri, 16 Jun 2017 09:52:23 +0100 From: Sara Dickinson Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Fri, 16 Jun 2017 09:52:21 +0100 References: <149760298355.24202.1993259713348794426@ietfa.amsl.com> To: dns-privacy@ietf.org In-Reply-To: <149760298355.24202.1993259713348794426@ietfa.amsl.com> Message-Id: <380A58CC-0127-454B-8507-DF2C844FF662@sinodun.com> X-Mailer: Apple Mail (2.3273) X-BlackCat-Spam-Score: -28 X-Mythic-Debug: State = no_sa; Score = Archived-At: Subject: Re: [dns-privacy] I-D Action: draft-ietf-dprive-dtls-and-tls-profiles-10.txt X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Jun 2017 08:52:36 -0000 Hi All,=20 Here is an update to the draft which attempts to address the majority of = the comments received during IESG review so far. Given the number and = extent of the changes I would request further careful review of this = version, particularly from the working group.=20 Changes are: * Clarified the specific attacks the Usage Profiles mitigate against. * Revised wording in the draft relating to 'security/privacy = guarantees=E2=80=99 and generally improved consistency of wording = throughout the document. * Corrected and added a number of references: - RFC7924 is now Normative - RFC7918 and RFC8094 are now Normative (and therefore Downrefs) - draft-ietf-tls-tls13, draft-ietf-dprive-padding-policy,RFC3315 and = RFC7227 added * Terminology: Update definition of Privacy-enabling DNS server and = moved normative definition to section 4. * Section 5 and 6.3: Included discussion of the additional attacks = possible when using meta-queries to bootstrap the DNS service * Section 5: Added sentence on why Opportunistic Profile may fallback = for latency reasons. * Section 5.1: Added discussion of when clients might change Usage = Profiles. * Section 6.4: Added caveat on use of combined authentication re = RFC7469. * Section 6.5: Added more detail on how authentication results might be = used in Opportunistic. Opportunistic clients now SHOULD try for the = best case. * Section 7.3: Re-worked this section and the discussion of DHCP. * Section 9: Removed unnecessary text, added condition on use of RFC7250 = (Raw public keys). * Section 11.: More detail on padding policies. * Numerous editorial corrections. Regards Sara.=20 > On 16 Jun 2017, at 09:49, internet-drafts@ietf.org wrote: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. > This draft is a work item of the DNS PRIVate Exchange of the IETF. >=20 > Title : Usage and (D)TLS Profiles for DNS-over-(D)TLS > Authors : Sara Dickinson > Daniel Kahn Gillmor > Tirumaleswar Reddy > Filename : draft-ietf-dprive-dtls-and-tls-profiles-10.txt > Pages : 29 > Date : 2017-06-16 >=20 > Abstract: > This document discusses Usage Profiles, based on one or more > authentication mechanisms, which can be used for DNS over Transport > Layer Security (TLS) or Datagram TLS (DTLS). These profiles can > increase the privacy of DNS transactions compared to using only = clear > text DNS. This document also specifies new authentication = mechanisms > - it describes several ways a DNS client can use an authentication > domain name to authenticate a (D)TLS connection to a DNS server. > Additionally, it defines (D)TLS protocol profiles for DNS clients = and > servers implementing DNS-over-(D)TLS. This document updates RFC > 7858. >=20 >=20 > The IETF datatracker status page for this draft is: > = https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/ >=20 > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-dprive-dtls-and-tls-profiles-10 > = https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dtls-and-tls-profi= les-10 >=20 > A diff from the previous version is available at: > = https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-dprive-dtls-and-tls-profile= s-10 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy From nobody Fri Jun 23 17:15:33 2017 Return-Path: X-Original-To: dns-privacy@ietf.org Delivered-To: dns-privacy@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 48112129B25; Fri, 23 Jun 2017 17:07:15 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: dns-privacy@ietf.org, terry.manderson@icann.org X-Test-IDTracker: no X-IETF-IDTracker: 6.55.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <149826283529.7840.13377516035367923872.idtracker@ietfa.amsl.com> Date: Fri, 23 Jun 2017 17:07:15 -0700 Archived-At: Subject: [dns-privacy] dprive - Requested session has been scheduled for IETF 99 X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Jun 2017 00:07:15 -0000 Dear Tim Wicinski, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. dprive Session 1 (1:00:00) Tuesday, Morning Session I 0930-1200 Room Name: Congress Hall III size: 250 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: DNS PRIVate Exchange Area Name: Internet Area Session Requester: Tim Wicinski Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 70 Conflicts to Avoid: First Priority: dnsop homenet dnssd opsawg Second Priority: intarea saag People who must be present: Terry Manderson Warren Kumari Tim Wicinski Resources Requested: Special Requests: --------------------------------------------------------- From nobody Wed Jun 28 03:01:24 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70F731287A7 for ; Wed, 28 Jun 2017 03:01:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJrX_y7QzZ0S for ; Wed, 28 Jun 2017 03:01:21 -0700 (PDT) Received: from haggis.mythic-beasts.com (haggis.mythic-beasts.com [IPv6:2a00:1098:0:86:1000:0:2:1]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB4DE12942F for ; Wed, 28 Jun 2017 03:01:20 -0700 (PDT) Received: from [2001:b98:204:102:fffa::1b] (port=62635) by haggis.mythic-beasts.com with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1dQ9ma-0002Un-G3; Wed, 28 Jun 2017 11:01:13 +0100 From: Sara Dickinson Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_41F51DE9-E25B-46C6-B816-E38AD6460200" Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) Date: Wed, 28 Jun 2017 11:01:07 +0100 In-Reply-To: <20170613073740.69d4d92f@earth.zonnestelsel.tk> Cc: Alexander Mayrhofer , "dns-privacy@ietf.org" To: Shane Kerr References: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> <20170613073740.69d4d92f@earth.zonnestelsel.tk> X-Mailer: Apple Mail (2.3273) X-BlackCat-Spam-Score: -28 X-Mythic-Debug: State = no_sa; Score = Archived-At: Subject: Re: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 10:01:23 -0000 --Apple-Mail=_41F51DE9-E25B-46C6-B816-E38AD6460200 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 13 Jun 2017, at 08:37, Shane Kerr = wrote: >=20 > Alexander and all, >=20 > tl;dr Lets move forward with our best guesses now. dkg's > recommendations seem good, but maybe we can tweak these based on > expected maximum packet sizes. I agree, I think an update to the draft referencing dkg=E2=80=99s work = is the best way to proceed. This seems a good topic for discussion in = Prague.=20 Sara.=20= --Apple-Mail=_41F51DE9-E25B-46C6-B816-E38AD6460200 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On 13 Jun 2017, at 08:37, Shane Kerr <shane@time-travellers.org> wrote:

Alexander and all,
tl;dr Lets move forward with our best guesses = now. dkg's
     recommendations seem good, but = maybe we can tweak these based on
     expected maximum packet = sizes.


I agree, = I think an update to the draft referencing dkg=E2=80=99s work is the = best way to proceed. This seems a good topic for discussion in = Prague. 

Sara. 
= --Apple-Mail=_41F51DE9-E25B-46C6-B816-E38AD6460200-- From nobody Wed Jun 28 03:02:46 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30A53129462 for ; Wed, 28 Jun 2017 03:02:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8sR1-UV7JP0T for ; Wed, 28 Jun 2017 03:02:43 -0700 (PDT) Received: from mail-wm0-x231.google.com (mail-wm0-x231.google.com [IPv6:2a00:1450:400c:c09::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FB181287A7 for ; Wed, 28 Jun 2017 03:02:43 -0700 (PDT) Received: by mail-wm0-x231.google.com with SMTP id b184so52959383wme.1 for ; Wed, 28 Jun 2017 03:02:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=QUFIpHATwxl9nffBVJNLbmY0q6ILlES54ObNSafafmQ=; b=KuFcChdOcXM7cFxiVTpjZjdsKvEEJTiQ7mZ3t00NVt8krm799MFiLttWqlA/W/2mxP bbHj5CZp0+opfHRozozBDZ8wJYBMqNbivpVcpbgFq4WEoMcXlU2pg+VMR8piK3eRNrGL yWyOdJkUUNrgZV7rPUKb/HzDvjjrZgiv1HDhZ1rmbJj0pibKIju26khc22FNls16+0Gc OPvHYSmFPSsDY92OZnuz4kXl053hHKuHiYHdifCDmdK9ZJ7Sm4lImHwl17nu7g6lqCrP sEbS8Zyi7OP+iCsFBnTRduUBux306tt7BuSfLEPHT9FwxYTp8D1TCU8H+THaYkcY5eg8 zG8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=QUFIpHATwxl9nffBVJNLbmY0q6ILlES54ObNSafafmQ=; b=Autb5+XZ1yk0WropgCrOZ+TYp7ps3cpMhK+rv0XTKS9ATuYfBx+xtaCaxTURcPjzJF IlNv2sl7BcBQ4N2CqbquHFawxSwH16PZXhwLb1/S505YCRLbb8ZmN6llhvm9n3EqI5Ye 51mqrQMKRPfqOs40wvE7leQsFTHnsjcEBPIRtuC7OQGldcwS/IeTCrxIOeXxxt66lTcS e9Vk0tCRFv94Uoo4dBxGECbYBBO90zWxj8yKFChrorQr/P2kY5Uxv+ktr9JahbR+fh3+ lBtPVih74uFbO7mVw7hldJtp5hSIydUIkZIgeNZNSI0T37AomTt46vMSeRRv0B8Cj7ui uqgw== X-Gm-Message-State: AKS2vOzAfrb5G/4Sh7Wim4SpfHtOUBTRxZD8uqhEaaeAC1VKNIvNqUrr TaMhzSjD1RvVwEPX X-Received: by 10.80.183.232 with SMTP id i37mr7169049ede.50.1498644161891; Wed, 28 Jun 2017 03:02:41 -0700 (PDT) Received: from twicinski-ltm1.internal.salesforce.com (252-197.icannmeeting.org. [199.91.197.252]) by smtp.googlemail.com with ESMTPSA id g25sm1019555eda.59.2017.06.28.03.02.40 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 28 Jun 2017 03:02:41 -0700 (PDT) To: dns-privacy@ietf.org References: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> <20170613073740.69d4d92f@earth.zonnestelsel.tk> From: Tim Wicinski Message-ID: <5bd9f87d-b35b-66d9-4a6d-4f9a753d2bd1@gmail.com> Date: Wed, 28 Jun 2017 12:02:38 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 10:02:45 -0000 On 6/28/17 12:01 PM, Sara Dickinson wrote: > >> On 13 Jun 2017, at 08:37, Shane Kerr > > wrote: >> >> Alexander and all, >> >> tl;dr Lets move forward with our best guesses now. dkg's >> recommendations seem good, but maybe we can tweak these based on >> expected maximum packet sizes. > > > I agree, I think an update to the draft referencing dkg’s work is the > best way to proceed. This seems a good topic for discussion in Prague. > I agree this would be a great discussion topic in Prague. tim From nobody Wed Jun 28 03:34:45 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED15812EAEB for ; Wed, 28 Jun 2017 03:34:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e113wLH5U_2U for ; Wed, 28 Jun 2017 03:34:42 -0700 (PDT) Received: from mail.sbg.nic.at (mail.sbg.nic.at [83.136.33.227]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3584129462 for ; Wed, 28 Jun 2017 03:34:40 -0700 (PDT) Received: from nics-exch2.sbg.nic.at ([10.17.175.6]) by mail.sbg.nic.at with XWall v3.52f ; Wed, 28 Jun 2017 12:34:38 +0200 Received: from NICS-EXCH2.sbg.nic.at ([fe80::a5b2:6e42:e54d:9d57]) by NICS-EXCH2.sbg.nic.at ([fe80::a5b2:6e42:e54d:9d57%12]) with mapi id 14.03.0351.000; Wed, 28 Jun 2017 12:34:33 +0200 From: Alexander Mayrhofer To: Tim Wicinski , "dns-privacy@ietf.org" Thread-Topic: [dns-privacy] Padding policies draft Thread-Index: AQHS42TxTjAJAZW3FU2TDIbYmMlaLKIhGZmggAEt9ACAF7sNgIAAAG0AgAApyMA= Date: Wed, 28 Jun 2017 10:34:33 +0000 Message-ID: <19F54F2956911544A32543B8A9BDE07598FC3E03@NICS-EXCH2.sbg.nic.at> References: <20170612101600.i4gbl2mhed4e4s5e@nic.fr> <19F54F2956911544A32543B8A9BDE07598FA3B32@NICS-EXCH2.sbg.nic.at> <20170613073740.69d4d92f@earth.zonnestelsel.tk> <5bd9f87d-b35b-66d9-4a6d-4f9a753d2bd1@gmail.com> In-Reply-To: <5bd9f87d-b35b-66d9-4a6d-4f9a753d2bd1@gmail.com> Accept-Language: en-US, de-DE Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.10.0.163] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-XWALL-BCKS: auto Archived-At: Subject: Re: [dns-privacy] Padding policies draft X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 10:34:44 -0000 PiA+IEkgYWdyZWUsIEkgdGhpbmsgYW4gdXBkYXRlIHRvIHRoZSBkcmFmdCByZWZlcmVuY2luZyBk a2figJlzIHdvcmsgaXMgdGhlDQo+ID4gYmVzdCB3YXkgdG8gcHJvY2VlZC4gVGhpcyBzZWVtcyBh IGdvb2QgdG9waWMgZm9yIGRpc2N1c3Npb24gaW4gUHJhZ3VlLg0KPiA+DQo+IA0KPiBJIGFncmVl IHRoaXMgd291bGQgYmUgYSBncmVhdCBkaXNjdXNzaW9uIHRvcGljIGluIFByYWd1ZS4NCg0KSSds bCBzcGluIGEgcmV2aXNpb24gb2YgdGhlIGRvY3VtZW50LCBob3BlZnVsbHkgdG9tb3Jyb3kgLSBp IHRoaW5rIHRoZSBkb2MgaXRzZWxmIHdvdWxkIHJlcXVpcmUgbGlrZSA1IG1pbnMgYWlydGltZSwg dGhvdWdoIHRoZSBkaXNjdXNzaW9uIGNvdWxkIGdldCBsb25nZXIuIGRrZywgd291bGQgeW91IHdh bnQgdG8gam9pbiBmb3IgYSAzLW1pbiByZWhlYXJzYWwgb2YgdGhlIHdvcmsgeW91IGRpZCBmb3Ig TkRTUz8NCg0KYmVzdCwNCkFsZXgNCg0K From nobody Wed Jun 28 03:37:43 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23C1512942F for ; Wed, 28 Jun 2017 03:37:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dEXS0mY8YHRK for ; Wed, 28 Jun 2017 03:37:41 -0700 (PDT) Received: from haggis.mythic-beasts.com (haggis.mythic-beasts.com [IPv6:2a00:1098:0:86:1000:0:2:1]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C9BF5127B73 for ; Wed, 28 Jun 2017 03:37:41 -0700 (PDT) Received: from [2001:b98:204:102:fffa::1b] (port=64077) by haggis.mythic-beasts.com with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1dQALo-0003J8-PG; Wed, 28 Jun 2017 11:37:39 +0100 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Sara Dickinson In-Reply-To: <20161120163620.GA20877@sources.org> Date: Wed, 28 Jun 2017 11:37:33 +0100 Cc: dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20161120163620.GA20877@sources.org> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3273) X-BlackCat-Spam-Score: -28 X-Mythic-Debug: State = no_sa; Score = Archived-At: Subject: Re: [dns-privacy] New version of draft-bortzmeyer-dprive-step-2 X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 Jun 2017 10:37:43 -0000 > On 20 Nov 2016, at 16:36, Stephane Bortzmeyer = wrote: > Here is a new version of draft-bortzmeyer-dprive-step-2 incorporating, > I believe, all comments from the meeting in IETF 97 @ Seoul. Comments > and discussions welcome. Stephane,=20 Just wondering what the status of draft-bortzmeyer-dprive-step is? I = know it was discussed it in Soeul and there was an -05 version published = last December but that has just expired a few days ago. Do you plan to = do an update before Prague?=20 Regards Sara.=20= From nobody Fri Jun 30 04:27:35 2017 Return-Path: X-Original-To: dns-privacy@ietfa.amsl.com Delivered-To: dns-privacy@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E81112EC03; Fri, 30 Jun 2017 04:27:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w465GNOZzd4y; Fri, 30 Jun 2017 04:27:32 -0700 (PDT) Received: from mail-wr0-x22c.google.com (mail-wr0-x22c.google.com [IPv6:2a00:1450:400c:c0c::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A35412ECAD; Fri, 30 Jun 2017 04:27:32 -0700 (PDT) Received: by mail-wr0-x22c.google.com with SMTP id k67so202205022wrc.2; Fri, 30 Jun 2017 04:27:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=gZJ6b1W20ZhEkgR30pR02rTy4R/B88XY0FBSXEVToMg=; b=dPTcO7OSg4ppBLvK9ZsNryPNZQva817QxP6Z6/BIbnAw2GiT5rvlfilKE958UJOC5E W+B8W/UlMduFfc1X/4VS82PFDWUhpANUwDj+qBGw41bH1Yeu3kzPcKcSrK5Y+a9STwGZ 1IowK+CaEyzx0muN+ScxACPxhM5gH6FR9wnzv6c4CSUdVNaJSdxdcjymZfPYlzu8J1gD IWlPMot8tvTDKeIhGq2oooTn+gcvVhSZEPO0RQCLauFbtotpPc2VfNeGJHywLcVvyyej 1pUUZxeAxFh5T/uXByNTBGQcCyiJrgVql5UukMfSZ2t4caUKpt2h7UL4lLZqiyadgCzZ IZ3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=gZJ6b1W20ZhEkgR30pR02rTy4R/B88XY0FBSXEVToMg=; b=Xb8BNpwcTMZH3ArPa8P7kFiSV4pG9OEspsV/jFRWJkh73Pj8JOBNxUb/rWlRFGmpOR pXYx/XdgN9er+T7DXYsX/5+XISL6bx8bpIeMlb4FeO6eFYLq5+23BrYkpNFOKeO/hiol dEMjw/JZSWEUlC40sK9GShsS7I8+lNGf2P/f6ZKSN1HlbPcfivgm+L8egjJVduFRdFtc liD9v7je3oC0KViapZxSD8nlYkRx05F9enEK81BkKK3J8dBEshKb72cSExrfrRF4akfg W3MyQfpUdiLw8Jxb0ai2t6khesmR6wB2fDXQHQmk61PKQJ0G77l39Q0qsAcDxiLppiDF aBoQ== X-Gm-Message-State: AKS2vOzl4K4GHWZaj+YOaVKAmJrgAjzyL2ZGBL4i8ZpKpHKZJNihEDzF clZz12w1gWIR9tejz1lckwgTYmBCog== X-Received: by 10.223.176.119 with SMTP id g52mr26244128wra.26.1498822050741; Fri, 30 Jun 2017 04:27:30 -0700 (PDT) MIME-Version: 1.0 Received: by 10.223.170.152 with HTTP; Fri, 30 Jun 2017 04:27:30 -0700 (PDT) From: tjw ietf Date: Fri, 30 Jun 2017 13:27:30 +0200 Message-ID: To: "dns-privacy@ietf.org" Cc: "dprive-chairs@ietf.org" Content-Type: multipart/alternative; boundary="001a113cae76ea82db05532bb36b" Archived-At: Subject: [dns-privacy] Call for Agenda Items and draft cutoff reminder X-BeenThere: dns-privacy@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Jun 2017 11:27:34 -0000 --001a113cae76ea82db05532bb36b Content-Type: text/plain; charset="UTF-8" Hi We're going to have a DPRIVE session in Prague, though it will be an hour long. There are a few current things to discuss, and authors should submit a note to dprive-chairs@ietf.org to get added to the agenda. I'll have a draft agenda this weekend . Also reminder the draft submission cutoff is Monday 3 July at 23:59 UTC. thanks tim (and brian) --001a113cae76ea82db05532bb36b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

Hi

We're going to ha= ve a DPRIVE session in Prague, though it will be an hour long. There are a = few current things to discuss, and authors should submit a note to dprive-chairs@ietf.org to get added = to the agenda. =C2=A0 I'll have a draft agenda =C2=A0this weekend .=C2= =A0

Also reminder the draft submission cutoff is M= onday 3 July at 23:59 UTC. =C2=A0=C2=A0

thanks

tim=C2=A0
(and brian)

<= div>
--001a113cae76ea82db05532bb36b--