Subject: Re: [dnssd] Secdir telechat review of draft-ietf-dnssd-push-19

From: Tom Pusateri <[email-masked]>
Date: Sat, 15 Jun 2019 12:47:16 -0400

Does this address your concerns?

> On May 17, 2019, at 11:59 AM, Tom Pusateri <[email-masked]> wrote:
> 
> Will also address TLS comments.
> 
>> 3. In the section of Security Considerations:
>>   1) you should also mention that TLS provides the anti-replay protection
>>   service for DNS Push;

I have added a 4th security service in the Security section:

Anti-replay protection:  TLS provides for the detection of and
      prevention against messages sent previously over a TLS connection
      (such as DNS Push Notifications).  Prior messages cannot be re-
      sent at a later time as a form of a man-in-the-middle attack.

>> 2) maybe you need to consider the client
>>   authentication to achieve policy control and detect illegal client;

I have added a new paragraph in the Security section:

As a consequence of requiring TLS, client certificate authentication
   and verification may also be enforced by the server for stronger
   client-server security or end-to-end security.  However,
   recommendations for security in particular deployment scenarios are
   outside the scope of this document.

>> 3) TLS
>>   WG are specifying the SNI encryption mechanism, will it influence your TLS
>>   name authentication?

SNI encryption has no effect on our use of TLS name authentication.

Thanks,
Tom

---

From: Ted Lemon <[email-masked]>
Date: Sat, 15 Jun 2019 13:21:06 -0400

The primary motivation for using tls is opportunistic security. Authentication would be interesting to add. SNI encryption would be interesting but I think is a separate topic. 

Client authorization might be useful in some cases, but generally is not done in DNS servers. To address these would require a security analysis of much broader scope than is appropriate for this document. We’ve talked about this in the context of homenet. 

Sent from my iPhone

> On Jun 15, 2019, at 12:47 PM, Tom Pusateri <[email-masked]> wrote:
> 
> _______________________________________________
> dnssd mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnssd

---

From: Tom Pusateri <[email-masked]>
Date: Sat, 15 Jun 2019 13:34:38 -0400

I agree with your comments and think my additional text (in combination with what was already there) is also in the spirit of your comments and does not conflict. Are you suggesting there is a conflict?

Thanks,
Tom

> On Jun 15, 2019, at 1:21 PM, Ted Lemon <[email-masked]> wrote:
>

---

From: Tom Pusateri <[email-masked]>
Date: Sat, 15 Jun 2019 13:40:10 -0400

By the way, you can see the updated version in context here (ignore the date):

https://github.com/pusateri/draft-ietf-dnssd-push <https://github.com/pusateri/draft-ietf-dnssd-push>

Thanks,
Tom

> On Jun 15, 2019, at 1:34 PM, Tom Pusateri <[email-masked]> wrote:
>

---

From: Ted Lemon <[email-masked]>
Date: Sat, 15 Jun 2019 13:43:20 -0400

No, just chiming in. This was something I had to think about during the implementation, so it’s familiar territory. 

Sent from my iPhone

---

From: "Xialiang (Frank, Network Standard & Patent Dept)" <[email-masked]>
Date: Mon, 24 Jun 2019 07:53:58 +0000

Hi Tom,
Sorry for responding your response email promptly.

I have checked the latest version -20 draft, and thought it have addressed all my security issues.
Thanks!

B.R.
Frank

-----邮件原件-----
发件人: Tom Pusateri [mailto:[email-masked]] 
发送时间: 2019年6月16日 0:47
收件人: Xialiang (Frank, Network Standard & Patent Dept) <[email-masked]>
抄送: [email-masked]; [email-masked]; IETF <[email-masked]>; [email-masked]
主题: Re: [dnssd] Secdir telechat review of draft-ietf-dnssd-push-19

Thanks,
Tom