Subject: [secdir] volunteer for draft-rafiee-intarea-cga-tsig

From: Sean Turner <[email-masked]>
Date: Tue, 19 Feb 2013 15:40:48 -0500

Anybody interested in CGAs that would like to review this one for Ralph?

spt

---

From: Sam Hartman <[email-masked]>
Date: Tue, 19 Feb 2013 18:39:07 -0500

I took a look at draft-rafiee-intarea-cga-tsig.

The idea is generally sound although I did not fully debug the algorithm
as discussed below. Unfortunately, the draft needs a lot of work before
it's ready.

Comments:

Section 3 contains a number of claims regarding protecting the exchanges
between the resolver and client. Is tsig actually used for DNS
resolution or just for update/zone transfer?
Section 3 should be reviewed to determine whether all the use cases are
in fact applicable for use of tsig.

The draft really needs help from someone with an eye towards
abstraction.
Section 4 repeates much of the key generation from the CGA specification
and repeats a lot of detail from the TSIG specification as well.
The rest of the draft tends to suffer from this as well.

Unfortunately, that approach--repeating (and sometimes changing) text
from CGA and TSIG is highly problematic. It makes it hard to evaluate
correctness of this specification and to identify all the differences
between this specification and the existing specifications.  In
addition, it makes it hard to understand how this specification might
interact with existing extensions to CGAs and existing or future
extensions to DNS-TSIG.

Please ask someone from the DNS community to review the shortening of
the TSIG exchange and the removal of the TKEY RR type.

The general textual clarity could be significantly improved.

I don't think this draft is ready for adoption, but I do think that the
ideas expressed here could be a valid basis for future work.

--Sam

---

From: Sean Turner <[email-masked]>
Date: Tue, 19 Feb 2013 19:04:02 -0500

Sam,

Many thanks!

spt

---

From: Ralph Droms <[email-masked]>
Date: Wed, 20 Feb 2013 09:33:34 -0500

Thanks for the quick review, Sam.

- Ralph

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 20 Feb 2013 16:03:57 -0500

> resolution or just for update/zone transfer?

Yes, TSIG can be used for resolution.  I run caching servers this way in
production, such that TSIG is used for queries from those servers to the
authoritative servers for my own zones.  Among other things, we use this
to extend the notion of multiple views visible to different clients into
the caches, such that the same set of caching servers cache multiple
views.

-- Jeff