Re: [dns-privacy] New Version Notification for draft-zatda-dprive-xfr-using-dso-00.txt

This is a great use of DSO and pub/sub. I support this work and I like the new acronym XuD in the spirit of DoT and DoH, etc.

Some minor comments:

In the Abstract is NOTITY/SOA instead of NOTIFY/SOA.

In the Terminology section, XuD is defined using DOS instead of DSO.

In the Overview, you mention clients should only subscribe for zones they are authorised to transfer. This needs a little more context. Who authorises a client? How does a client know it is authorised?

In 7.1, in a note, you mention TSIG can be used by the client to demonstrate that it is authorised so maybe this is what is meant earlier in the overview but it should be more explicit but also, it would be neat if SIG(0) certificate verification could be used for authorisation as well to obviate the need for out of band secret exchange.

In 7.1.1.1, there is mention of efficiently packing stream data into TCP segments. This is also in the PUSH draft but I think it should be removed from there and from here as well because once the data is encoded in a TLS session, it’s much more difficult for the sender to have control over the size of TCP segments sent.

In 7.3.1, you ask the question if the equivalent of a RECONFIRM message is needed. The answer is no. This is specific to the way service discovery currently works and it is not applicable in the XFR case.

Thanks,
Tom

> On Jul 9, 2019, at 5:03 AM, Sara Dickinson <sara@sinodun.com> wrote:
> 
> Hi All, 
> 
> A new draft has been submitted that outlines the basics of a DSO based mechanism for zone transfers requiring TLS. 
> 
> There is much more work to do on the details and potentially additional messaging to define but hopefully this includes information to get some initial feedback on this proposal.
> 
> Best regards
> 
> Sara. 
> 
>> On 8 Jul 2019, at 18:45, internet-drafts@ietf.org wrote:
>> 
>> 
>> A new version of I-D, draft-zatda-dprive-xfr-using-dso-00.txt
>> has been successfully submitted by Sara Dickinson and posted to the
>> IETF repository.
>> 
>> Name:        draft-zatda-dprive-xfr-using-dso
>> Revision:    00
>> Title:        DNS Zone Transfer using DNS Stateful Operations
>> Document date:    2019-07-08
>> Group:        Individual Submission
>> Pages:        21
>> URL:            https://www.ietf.org/internet-drafts/draft-zatda-dprive-xfr-using-dso-00.txt
>> Status:         https://datatracker.ietf.org/doc/draft-zatda-dprive-xfr-using-dso/
>> Htmlized:       https://tools.ietf.org/html/draft-zatda-dprive-xfr-using-dso-00
>> Htmlized:       https://datatracker.ietf.org/doc/html/draft-zatda-dprive-xfr-using-dso
>> 
>> 
>> Abstract:
>>  DNS zone transfers are transmitted in clear text, which gives
>>  attackers the opportunity to collect the content of a zone by
>>  eavesdropping on network connections.  This document specifies use of
>>  DNS Stateful Operations to enable a subscribe/publish mechanism for
>>  zone transfers reducing the over head introduced by NOTITY/SOA
>>  interactions prior to zone transfer request.  This additionally
>>  prevents zone contents collection via passive monitoring of zone
>>  transfers by restricting XFR using DSO to require TLS.
>> 
>> 
>> 
>> 
>> Please note that it may take a couple of minutes from the time of submission
>> until the htmlized version and diff are available at tools.ietf.org.
>> 
>> The IETF Secretariat
>> 
> 
> _______________________________________________
> dns-privacy mailing list
> dns-privacy@ietf.org
> https://www.ietf.org/mailman/listinfo/dns-privacy