Subject: [IPSECKEY] new draft -08

From: Michael Richardson <[email-masked]>
Date: Mon, 15 Dec 2003 15:15:50 -0500

-----BEGIN PGP SIGNED MESSAGE-----

Hi, I posted my comments on Wednesday.
They are at:
     http://www.sandelman.ottawa.on.ca/lists/html/ipseckey/msg00390.html
     http://www.sandelman.ottawa.on.ca/lists/html/ipseckey/msg00391.html

I had to get the newest XML RFC bibliography to be able to format with
the suggested updates to various RFCs. (They really are new)

I would appreciate some feedback on this.
  http://www.sandelman.ca/SSW/ietf/ipsec/key/ has the -08 draft.

Repeat of questions:

    IESG> say "unsigned"? also, why not just specify the semantics of the
    IESG> preference here, rather than pointing to a (rather unrelated) MX
    IESG> record RR? Hunting for the MX text in another document seems
    IESG> suboptimal (and results in an odd normative reference).

  Chairs? Copy and paste from 1035?
  We already reference 1035 for other reasons.

    IESG> >    Gateways listed in IPSECKEY records with  lower precedence are
    IESG> >    to be 
    IESG> >    attempted first.  Where there is a tie in precedence, the order
    IESG> >    should be non-deterministic.
    IESG>
    IESG> Note: the above text seems out of place, given the previous paragraph
    IESG> which just points to MX. Can't you just specify the behavior here (in
    IESG> its entirety) and remove the normative dependency?

  We could do that. Chairs?

    IESG> Bert Wijnen:

    IESG> Bigger issue:
    IESG>
    IESG> - The examples use the reverse DNS records to convey IPSECKEY record.
    IESG> Does this have some unstated assumptions about the deployment of
    IESG> IPSECKEY (e.g., to be usable, the participating nodes should record
    IESG> the RRs in reverse records), or is this just a coincidence?
    IESG> I note that the document does not discuss the deployment at all, but
    IESG> that is probably intentional.
    IESG> 
    IESG> If there is no connection to the reverse records, I'd suggest
    IESG> rewording at least 3 of the 5 examples to use e.g. "nodeX.example.com
    IESG> IN IPSECKEY ..."; if there is a requirement for reverse records, this
    IESG> issue needs to be explicitly discussed.. DNS deployment folks might
    IESG> have something to say about that :-)

  Chairs. Reverse is clearly in scope here.
  Can you discuss with Bert?

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-
This is the [email-masked] list.
Email to [email-masked] to be removed.

---

From: Rob Austein <[email-masked]>
Date: Mon, 15 Dec 2003 16:19:28 -0500

>   Can you discuss with Bert?

See "if there is a requirement for reverse records, this issue needs
to be explicitly discussed."

The issue is not whether or not IPSECKEY belongs in the reverse tree
(everyone on this list knows that it does, and Bert now knows too,
because I told him).  The issue is that the draft doesn't explain
this, it just assumes that the reader is already an expert on
opportunistic IPSEC and that this is therefore obvious.

Given that the reverse tree is, in general, notorious for bad
maintenance, Bert is correct that the doc should explain why stuffing
IPSECKEY RRs into the reverse tree is the right thing to do anyway.
-
This is the [email-masked] list.
Email to [email-masked] to be removed.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 16 Dec 2003 15:27:20 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Rob" == Rob Austein <[email-masked]> writes:
    >> Chairs. Reverse is clearly in scope here.  Can you discuss with Bert?

    Rob> See "if there is a requirement for reverse records, this issue needs
    Rob> to be explicitly discussed."

    Rob> The issue is not whether or not IPSECKEY belongs in the reverse tree
    Rob> (everyone on this list knows that it does, and Bert now knows too,
    Rob> because I told him).  The issue is that the draft doesn't explain
    Rob> this, it just assumes that the reader is already an expert on
    Rob> opportunistic IPSEC and that this is therefore obvious.

  okay.
  so what question does some text have to answer?

  Is it:
      "where is the IPSECKEY RR found?"
     
  or: "is the reverse map the place to find IPSECKEY RR?"

  To me, the location of the record has a lot to do with the semantics of
the record. You need to know what question was being asked of DNS to know
if the record will be found there.

-

---

From: Rob Austein <[email-masked]>
Date: Tue, 16 Dec 2003 15:51:30 -0500

> if the record will be found there.

"What is the usage model for the IPSECKEY RR, and why does this usage
model imply that the reverse tree is where one would normally expect
to find IPSECKEY RRs?"
-
This is the [email-masked] list.
Email to [email-masked] to be removed.

---

From: Michael Richardson <[email-masked]>
Date: Tue, 16 Dec 2003 19:03:45 -0500

-----BEGIN PGP SIGNED MESSAGE-----

    >> To me, the location of the record has a lot to do with the semantics
    >> of the record. You need to know what question was being asked of DNS
    >> to know if the record will be found there.

    Rob> "What is the usage model for the IPSECKEY RR, and why does this
    Rob> usage model imply that the reverse tree is where one would normally
    Rob> expect to find IPSECKEY RRs?"  

  I don't see a way to answer that without writing down semantics.
  I thought we weren't going there.

  If we are, then this becomes the OE WG.

-