Re: [dns-privacy] Call for adoption: draft-vandijk-dprive-ds-dot-signal-and-pin

I do not support adopting this draft as-is.  I think this construction is
very clever, and points us in the right direction for authentication, but
it's extremely inflexible in regard to the transport protocol and key
updates.  As the draft notes, "a change in TLS keys on an auth may require
DS updates for thousands or even hundreds of thousands of domains", which
may not be under the administrative control of the authoritative server
operator.  This seems likely to make key rotation effectively impossible in
many potential deployments, as rotation cannot occur until _all_ customers
have updated their zones.

This draft could be suitable for "experimental" status, but for a
"standards track" document I think we should start with a design that
addresses these problems.

On Mon, Aug 10, 2020 at 7:44 AM Brian Haberman <brian@innovationslab.net>
wrote:

> Hi all,
>      During the DPRIVE session at IETF108, we discussed adopting
>
> https://datatracker.ietf.org/doc/draft-vandijk-dprive-ds-dot-signal-and-pin/
> and the results were inconclusive. The chairs would like to start a
> 2-week call for adoption to determine the WG's interest in this work.
>
>      Please respond to the mailing list with your view (positive or
> negative) and supporting rationale on adopting the draft. This WGLC will
> end on 2020-08-24 at 23:59 UTC.
>
> Regards,
> Brian & Tim
>
> _______________________________________________
> dns-privacy mailing list
> dns-privacy@ietf.org
> https://www.ietf.org/mailman/listinfo/dns-privacy
>

Re: [dns-privacy] Call for adoption: draft-vandijk-dprive-ds-dot-signal-and-pin

Attachment: smime.p7s