Re: [DNSOP] I-D Action: draft-ietf-dnsop-svcb-httpssvc-02.txt

[Ben Schwartz <[e-mail]>]

It occurs to me that I hit "publish" on this draft without updating the
release notes, so I'll mention some of the many changes since -01 here
instead:

 - All changes to Alt-Svc have been removed.  I would like to see some
updates to Alt-Svc, but since this draft is now in DNSOP, and any changes
to Alt-Svc are going to require a long discussion, we've removed them from
this draft and will consider them separately in the future.
- The examples have been expanded and reorganized.
- Priority zero is now the definition of AliasForm, instead of being
reserved for AliasForm.
- Repeated SvcParamKeys are no longer allowed.
- The "=" sign may be omitted in a key=value pair if the value is also
empty.
- In the wire format, SvcParamKeys must be in sorted order.
- New text regarding how to handle resolution timeouts (clients must fail
hard to avoid a downgrade attack)
- Expanded description of recursive resolver behavior
- Much more precise description of the intended ALPN behavior
- Match the HSTS specification's language on HTTPS enforcement
- Removed 'esniconfig=""' mechanism and simplified ESNI connection logic

As always, please review and send comments.  We also expect to do a
presentation on this draft (remotely) in the DNSOP session.

On Mon, Mar 9, 2020 at 4:12 PM <[e-mail]> wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Domain Name System Operations WG of the
> IETF.
>
>         Title           : Service binding and parameter specification via
> the DNS (DNS SVCB and HTTPSSVC)
>         Authors         : Ben Schwartz
>                           Mike Bishop
>                           Erik Nygren
>         Filename        : draft-ietf-dnsop-svcb-httpssvc-02.txt
>         Pages           : 36
>         Date            : 2020-03-09
>
> Abstract:
>    This document specifies the "SVCB" and "HTTPSSVC" DNS resource record
>    types to facilitate the lookup of information needed to make
>    connections for origin resources, such as for HTTPS URLs.  SVCB
>    records allow an origin to be served from multiple network locations,
>    each with associated parameters (such as transport protocol
>    configuration and keying material for encrypting TLS SNI).  They also
>    enable aliasing of apex domains, which is not possible with CNAME.
>    The HTTPSSVC DNS RR is a variation of SVCB for HTTPS and HTTP
>    origins.  By providing more information to the client before it
>    attempts to establish a connection, these records offer potential
>    benefits to both performance and privacy.
>
>    TO BE REMOVED: This proposal is inspired by and based on recent DNS
>    usage proposals such as ALTSVC, ANAME, and ESNIKEYS (as well as long
>    standing desires to have SRV or a functional equivalent implemented
>    for HTTP).  These proposals each provide an important function but
>    are potentially incompatible with each other, such as when an origin
>    is load-balanced across multiple hosting providers (multi-CDN).
>    Furthermore, these each add potential cases for adding additional
>    record lookups in-addition to AAAA/A lookups.  This design attempts
>    to provide a unified framework that encompasses the key functionality
>    of these proposals, as well as providing some extensibility for
>    addressing similar future challenges.
>
>    TO BE REMOVED: The specific name for this RR type is an open topic
>    for discussion.  "SVCB" and "HTTPSSVC" are meant as placeholders as
>    they are easy to replace.  Other names might include "B", "SRV2",
>    "SVCHTTPS", "HTTPS", and "ALTSVC".
>
>    TO BE REMOVED: This document is being collaborated on in Github at:
>    https://github.com/MikeBishop/dns-alt-svc [1].  The most recent
>    working version of the document, open issues, etc. should all be
>    available there.  The authors (gratefully) accept pull requests.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-httpssvc/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-02
> https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-httpssvc-02
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-svcb-httpssvc-02
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
>
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop
>