Re: [Add] The ADD WG has placed draft-reddy-add-delegated-credentials in state "Call For Adoption By WG Issued"

Hi Martin,

Thanks for the feedback. Please see inline.

On Tue, 12 Dec 2023 at 03:39, Martin Thomson <mt@lowentropy.net> wrote:

> I don't see this as ready for adoption.  I have a lot of questions that
> the document doesn't answer.
>
> Why is this on the standards track?  It's just say "you could do X", where
> X is a standards-track document.  Informational is sufficient.
>

The standard track is required because it adds a new SVC parameter key,

>
> Given the relative levels of DC adoption, I'm not sure that this is going
> to make this deployment model much more accessible, but if OS vendors are
> on board, perhaps we'll see this change.
>

Yes, we see support from OS vendors.

>
> The deployment model for this is pretty narrow, given that DC is
> essentially a license to impersonate.  The idea of "managed" devices makes
> it plausible at least, but the use of specifically-delegated names is
> essential.  That means that the central DNS is obligated to support ACME so
> that it can obtain a bunch of certificates.  (That doesn't mean STAR.
> Regular ACME would suffice; see below.)
>
> The tlsdelegation SvcParam makes no sense to me.  If the client has
> configuration sufficient to authenticate, that can include whatever
> information it needs to find the right endpoint to ask for a delegation.
>

The "tlsdelegation" SvcParam is added to signal the client whether the
server is only accessible using DC. If the client does not DC, it will not
attempt to establish an authenticated secure connection with the discovered
Encrypted DNS server, it was discussed in IETF-117 WG meeting, see
https://datatracker.ietf.org/doc/minutes-117-add-202307260000/.

>
> There is no delegation protocol defined.  Is it the case that this is
> intended to be proprietary in the same way that authentication is ?
>

Yes, CPEs are managed using both standard and proprietary protocols.

>
> I don't agree with the premise that ACME doesn't work for the CPE.  That
> would be a simpler overall system.  It doesn't need to be STAR.  The CPE
> has some means of obtaining a name from its management system.  Then it
> uses ACME.  Maybe it uses the management system to support the challenge
> (for the emplacement of DNS records, say).  Maybe this part of the protocol
> is standardized, maybe not.
>

https://datatracker.ietf.org/doc/html/draft-reddy-add-delegated-credentials-03#section-1.3.2
discusses the same mechanism but the challenges with it are discussed in
the second paragraph of this section.

Cheers,
-Tiru

>
> Cheers,
> Martin
>
> On Sat, Dec 9, 2023, at 14:09, IETF Secretariat wrote:
> > The ADD WG has placed draft-reddy-add-delegated-credentials in state
> > Call For Adoption By WG Issued (entered by Glenn Deen)
> >
> > The document is available at
> > https://datatracker.ietf.org/doc/draft-reddy-add-delegated-credentials/
> >
> > Comment:
> > WG Adoption call will run until December 15 2023
> >
> > --
> > Add mailing list
> > Add@ietf.org
> > https://www.ietf.org/mailman/listinfo/add
>