IETF Logo Mail Archive

Re: [dns-privacy] [internet-drafts@ietf.org: I-D Action: draft-bortzmeyer-dprive-resolver-to-auth-00.txt]

Stephen Farrell <stephen.farrell@cs.tcd.ie> Tue, 02 January 2018 19:58 UTC

Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3155D12D80E for <dns-privacy@ietfa.amsl.com>; Tue, 2 Jan 2018 11:58:30 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.311
X-Spam-Level:
X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M4-K38vx4CjE for <dns-privacy@ietfa.amsl.com>; Tue, 2 Jan 2018 11:58:27 -0800 (PST)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA4251200C1 for <dns-privacy@ietf.org>; Tue, 2 Jan 2018 11:58:27 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 11B1BBE50; Tue, 2 Jan 2018 19:58:25 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4EN7XYw1U5pT; Tue, 2 Jan 2018 19:58:23 +0000 (GMT)
Received: from [10.244.2.100] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id ABE44BE49; Tue, 2 Jan 2018 19:58:23 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1514923103; bh=j0hYHHsZzSqYIWuBgxqDJqybaqIkvUrWdE6EHr7RffM=; h=Subject:To:References:From:Date:In-Reply-To:From; b=HHuXk+KwWCPPfwf8Z9YuXEiXDpdYeOCRKWHXkmI9qABVYUv9cQXo2GS/jN5TZ2eP/ Yk4SxN9UHyOMHLBJiIXqfAzNIRkeVKC0qOYckDmIjQW3/ytYoh6qpT2LunETfB012q f/C+GMnIPEmOWcI5jHATN8OVtVXM6cfatPSqehRY=
To: Stephane Bortzmeyer <bortzmeyer@nic.fr>, dns-privacy@ietf.org
References: <20180102113649.e74p7omulnfz2hrx@nic.fr>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url=
Message-ID: <3a557590-168d-50b0-ba19-e1f9fccf7867@cs.tcd.ie>
Date: Tue, 02 Jan 2018 19:58:23 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <20180102113649.e74p7omulnfz2hrx@nic.fr>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="uPmp7gfH4vph41x4YGCPxCW8jOEeKZa8k"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/DQ4Uy0d9sGqIgEfIbfTgtcMldGw>
Subject: Re: [dns-privacy] [internet-drafts@ietf.org: I-D Action: draft-bortzmeyer-dprive-resolver-to-auth-00.txt]
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Jan 2018 19:58:30 -0000

Hiya,

On 02/01/18 11:36, Stephane Bortzmeyer wrote:
> New Year Resolution for 2018: securing (privacy-wise) the
> communication from the resolver to the authoritative name server.
> 
> draft-bortzmeyer-dprive-step-2 was not a big success probably because
> it was too open, mentinong too many possibilities. Here, I propose
> just one method. Comments and criticisms welcome.
> 

Thanks for writing that.

I think I'd argue to postpone definition of the strict mode
entirely, as I can't see anything like that being used for a
long time yet, which means there'd be plenty of time to see
if DANE and/or some specific flavour of TLS1.3 is the right
thing to use.

Other than that, I like it and would love to see the WG refer
to this as part of a re-chartering effort.

S.

> 
> 
> _______________________________________________
> dns-privacy mailing list
> dns-privacy@ietf.org
> https://www.ietf.org/mailman/listinfo/dns-privacy
> 

-- 
PGP key change time for me.
New-ID 7B172BEA; old-ID 805F8DA2 expires Jan 24 2018.
NewWithOld sigs in keyservers.
Sorry if that mucks something up;-)

v2.23.0 | Report a Bug | By Email