Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: Klaas Wierenga <klaas@wierenga.net>
Mime-Version: 1.0 (1.0)
Date: Thu, 1 Aug 2024 21:48:24 +0200
Message-Id: <CB4ED5B4-B7DA-4CB1-A3EA-07571129D39F@wierenga.net>
References: <E5D49184-98BA-4515-9731-4EF5C915BED5@cloudflare.com>
In-Reply-To: <E5D49184-98BA-4515-9731-4EF5C915BED5@cloudflare.com>
To: Joe Abley <jabley@cloudflare.com>
Message-ID-Hash: O3PZC2ZBB4NXQV3KZXV4FLF3XOXXKIBT
CC: secdir@ietf.org, dnsop <dnsop@ietf.org>,
 draft-ietf-dnsop-rfc7958bis.all@ietf.org, last-call@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_Secdir_last_call_review_of_draft-ietf-dnsop-rfc7?=
	=?utf-8?q?958bis-03?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/6FVvIdKg3dZVNwapogUXGYRMmBA>

Hi Joe,

Sent from my iPhone

> On 1 Aug 2024, at 21:11, Joe Abley <jabley@cloudflare.com> wrote:
>=20
> =EF=BB=BFHi Klaas,
>=20
>> On Aug 1, 2024, at 20:33, Klaas Wierenga via Datatracker <noreply@ietf.or=
g> wrote:
>>=20
>> Reviewer: Klaas Wierenga
>> Review result: Has Nits
>>=20
>> The draft reads well and is clear. I have one question that is maybe wort=
h
>> answering in the security considerations. What is the impact of retrievin=
g the
>> trust anchors over http instead of https? Does that lead to a risk of end=
ing up
>> with an invalid set of trust anchors?
>>=20
>> Klaas
>=20
> There are risks of ending up with an invalid set of trust anchors regardle=
ss of what method is used to retrieve them. The use of TLS might mitigate so=
me risks, but it does not eliminate them (e.g. it does not address the risk o=
f a compromised CA issuing a certificate, or that the document being retriev=
ed over HTTPS has been modified at rest by some unauthorised third party.

True that it does not eliminate all risks, but I=E2=80=99d argue that the us=
e of http instead of https leads to a much more trivial to exploit attack su=
rface than your examples.

>=20
> There are compensatory controls that can be used to mitigate particular ri=
sks, but the decision to mitigate particular risks and the choice of mitigat=
ion will surely vary significantly depending on the nature of the relying pa=
rty. For some applications, trust-at-first-use might be perfectly appropriat=
e. Others might require different measures to be taken. Some might consider r=
etrieving the XML document described in this document to be too risky to do a=
t all, and might insist on manual, in-person attestations and verification o=
f new trust anchors before use.
>=20
> I think it would be inappropriate for this document to try and catalogue a=
ll possible use-cases and risks around this. However, I can see how it might=
 be useful to add a sentence saying this kind of thing out loud. I have not d=
iscussed this with my co-authors but I am interested to hear their reaction.=


I think that position is reasonable, and I would be happy with such a senten=
ce!

Klaas

>=20
>=20
> Joe
>=20