Re: [dns-privacy] Addressing the DISCUSS points raised by the IESG on draft-ietf-dprive-xfr-over-tls-11

[Ben Schwartz <[e-mail]>]

ALPN: I think we should say that the ALPN is "dot", and use of ALPN is
OPTIONAL.

ACLs: IP ACLs, if present, should be applied before the TLS handshake, for
DoS defense.  Operators who want to maintain secret zone contents SHOULD
use cryptographic authentication instead.

On Tue, May 4, 2021 at 11:15 PM Eric Vyncke (evyncke) <evyncke=
[e-mail]> wrote:

> [Message sent to authors, WG, and the DISCUSS-holding area directors]
>
>
>
> As you have seen by now[1], this document has raised at least two blocking
> DISCUSS points and those points will be discussed during Thursday 6th of
> May telechat (i.e., tomorrow in my timezone).
>
>
>
> My own reading of those DISCUSS ballots (perhaps more ballots to come):
>
> - not using ALPN code
>
> - text about the comparison between IP ACL and crypto authentications
>
>
>
> If possible, then I would appreciate some replies before the telechat by
> the authors on the recent Ben Kaduk’s points as Allison Mankin’s reply [2]
> (as well as Sara Dickinson’s ones) has already addressed Martin Duke’s
> concern about ALPN.
>
>
>
> The WG view on using ALPN is also important to move forward as it is an
> important technical change.
>
>
>
> As usual, everyone is welcome to join the telechat [3] as observer, it
> should be a short one.
>
>
>
> Thank you in advance for your replies (again if possible),
>
>
>
> Regards
>
>
>
> -éric
>
>
>
> [1]
> https://datatracker.ietf.org/doc/draft-ietf-dprive-xfr-over-tls/ballot/
>
> [2]
> https://mailarchive.ietf.org/arch/msg/dns-privacy/HaQ7SO8Ma9TW3v0Wrh18LD6BNy8/
>
> [3]
> https://mailarchive.ietf.org/arch/msg/ietf-announce/X7t76SwcK1fjMQsGb2Wy11R-cnw/
> _______________________________________________
> dns-privacy mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>