Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Sara Dickinson <sara@sinodun.com>
In-Reply-To: <20161007094840.GA27400@laperouse.bortzmeyer.org>
Date: Fri, 7 Oct 2016 18:32:21 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <34B559CE-B72D-467D-BF1B-36F9B991DD47@sinodun.com>
References: <5dc29c0c-9f34-dcac-8d94-f2722ee6a4ba@gmail.com>
 <20161007094840.GA27400@laperouse.bortzmeyer.org>
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/2VCT__PXoLoi3EjE0qWVepgqHPs>
Cc: Tim Wicinski <tjw.ietf@gmail.com>,
 "dns-privacy@ietf.org" <dns-privacy@ietf.org>
Subject: Re: [dns-privacy] Working Group Last Call
 draft-ietf-dprive-dtls-and-tls-profile
Precedence: list


> On 7 Oct 2016, at 10:48, Stephane Bortzmeyer <bortzmeyer@nic.fr> =
wrote:
>=20
> On Thu, Oct 06, 2016 at 02:58:09AM -0400,
> Tim Wicinski <tjw.ietf@gmail.com> wrote=20
> a message of 28 lines which said:
>=20
>> This starts a Working Group Last Call for:
>>   draft-ietf-dprive-dtls-and-tls-profile
>=20
> Executive summary: OK for me,
> draft-ietf-dprive-dtls-and-tls-profiles-03 can (and should) be
> published. I find that touchy issues, such as the relationship with
> the authentication mechanisms described in RFC 7858, or such as the
> table 1 "DNS Privacy Protection by Usage Profile and type of attacker"
> are nicely done.

Good to know - thanks.=20

>=20
> The table 1 could use some details about the possibility of detection
> for passive attacks (for active attacks, it is addressed in section
> 5). These details were promised in
> =
<https://mailarchive.ietf.org/arch/msg/dns-privacy/8VMIuFKWZUAzP7UWivLn9fA=
_Ew4>
> :-)

Yes, thanks for catching (again)! I will add an example similar to the =
one in the mail thread into section 5 so that the discussion of =
detection of active and passive attacks are together.=20

>=20
> Technical question:
>=20
> The document seems to use "X.509" and "PKIX" as synonyms. Is it really
> the case?

Paul=E2=80=99s suggestions of using PKIX throughout seems sensible.

>=20
> Small legal detail:
>=20
>> this application [extended to be used for recursive clients and
>> authoritative servers] is out of scope for the DNS PRIVate Exchange
>> (DPRIVE) Working Group per its current charter.
>=20
> A bit exaggerated: the current charter says "it [the DPRIVE WG] may
> also later consider mechanisms that provide confidentiality between
> Iterative Resolvers and Authoritative Servers=E2=80=9D

A reasonable point. I copied that text directly from RFC7858 =
(DNS-over-TLS) as that is how the scope is justified in that =
document=E2=80=A6..=20

>=20
> Editorial detail:
>=20
>> but may be the subject of a future I-D.
>=20
> Should probably be removed before it becomes a RFC.

How about I change it to =E2=80=9Cmay be the subject of future work=E2=80=9D=
?  Unless such an ID is likely to appear in the very near future?  :-)

Sara.=20=