[dane] Question re draft -20, TLSA record expiry

Thierry Moreau <thierry.moreau@connotech.com> Tue, 01 May 2012 13:07 UTC

Message-ID: <4F9FE1BE.5010208@connotech.com>
Date: Tue, 01 May 2012 09:14:38 -0400
From: Thierry Moreau <thierry.moreau@connotech.com>
User-Agent: Thunderbird 2.0.0.17 (X11/20090608)
MIME-Version: 1.0
To: dane <dane@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: [dane] Question re draft -20, TLSA record expiry
Precedence: list

Hi,

I reviewed the draft draft-ietf-dane-protocol-20. Great work!

In section 5, item "Roll-over", I would be inclined to associate 
"expired TLSA records" with a combination of RRSIG signature expiry (an 
absolute time) and the original TTL field (the one 
data-integrity-protected by the RRSIG), not just the normal DNS TTL 
processing.

Or maybe this extra scrutiny is implied by the DNSSEC validation 
function on which the "using entity" (my words) must rely anyway. Then I 
venture to propose the following text:

"Note that the DNSSEC validation function [must/is expected to] provide 
a reliable TTL indication based on RRSIG fields including signature 
expiry and original TTL."

This way it reminds the domain manager that key pair cryptoperiods are 
managed through the DNSSEC signature process.

Thanks for the dedicated attention paid to the subtleties of DNSSEC 
piggybacked over the installed base of TLS server certification 
infrastructure!

-- 
- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, QC, Canada H2M 2A1

Tel. +1-514-385-5691

[dane] Question re draft -20, TLSA record expiry Thierry Moreau