Re: [DNSOP] [Fwd: New Version Notification for draft-vandijk-dnsop-ds-digest-verbatim-00.txt]

[Peter van Dijk <[e-mail]>]

Hello Paul,

On Fri, 2020-09-25 at 17:13 -0400, Paul Wouters wrote:
> I could see a use of publishing a DNSKEY at the parent in a DS record
> that could be used for encrypted connections towards child nameservers.

Me too! :-)

> But we talked about this within the context of your other proposals,
> and the view of a number of people and some large operators was that
> this encryption is a per-nameserver thing, and not a per-zone thing.

Lacking defined use cases and alternative proposals, I'm still
considering the possible future where we have one method for each of
those focuses, with different tradeoffs.

> Another item not covered here we talked about before, is that child
> data published in the parent MUST have cryptographic confirmation at
> the child. Or else parents can coerce child data.

Yes, I'm aware! I wanted to keep the -00 simple to first test for
appetite in the WG.

One of the DOTPIN co-authors brought up your 'child confirmation' idea
for both drafts I posted this week, and in both cases, that seems to be
an addition that could easily work. For this draft, in CDS or CDNSKEY;
for the other draft, either by mandating 'some form of it' for anything
that allocates out of the reserved range, or even by specifying right
now 'odd numbers go in the parent, even numbers go in the child, and
content needs to match'.

However, so far it does not look like any of my drafts have gotten
stuck because of -this- so I'm not inclined to put those words in yet.
After adoption seems like plenty of time to discuss this.

> It seems the setup of this record is geared towards a generic mechanism
> of "child publishes stuff at the parent" which muddles the clear child
> vs parent zone divider we have now. It would need a very strong use
> case, but the other use case offered is "might be handy in the future".

Yes - both drafts are 'this may prevent pain later'. I only have
halfbaked ideas for what you could do with 'non-hashed parent-side
publication of child data' (which both drafts provide): DoH URLs,
signed delegation NS sets (which I consider a prime candidate for
'enabling TLSA in child', but that could be done DOTPIN style instead
of either of these drafts), etc.

> While I agree that DNS infrastructure updates have been extremely slow,
> I do think in recent years it has been much better and is still
> improving. So I am less concerned about anything taking 5 years again.

Now if only we could apply that optimism to operator-registry communications :)

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/