[DNSOP] comments on draft-wessels-edns-key-tag-00

神明達哉 <jinmei@wide.ad.jp> Mon, 02 November 2015 04:23 UTC

MIME-Version: 1.0
Sender: jinmei.tatuya@gmail.com
Date: Mon, 02 Nov 2015 13:23:03 +0900
Message-ID: <CAJE_bqe3EMEQt=Mg629irMHqiWRbmxR9AgDN_fuYTOASWYg0gg@mail.gmail.com>
From: 神明達哉 <jinmei@wide.ad.jp>
To: dnsop <dnsop@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dnsop/AE7T-zOoPjXgeG6P0t-nRIFG8Hg>
Subject: [DNSOP] comments on draft-wessels-edns-key-tag-00
Precedence: list

I've read draft-wessels-edns-key-tag-00.  I think it's generally well
written.  I have a few small comments.

- Sections 5.2.1

   When the recursive server
   receives a query with the option set, the recursive server SHOULD set
   the edns-key-tag list for any outgoing iterative queries for that
   resolution chain to a union of the stub client's Key Tag(s) and the
   validating recursive resolver's Key Tag(s).

What if the recursive server receives the same query from multiple
clients with different key tags and tries to unify the multiple
original queries (some recursive server implementations do this
unification)?  Is it expected to include a union of all these key
tags?  What if the result of this makes the query too big (even if
it's quite unlikely to happen in practice)?

Same questions apply to Section 5.2.2.

- Regarding security considerations, should we worry about an attack
  where the attacker pretends to a massive number of different clients
  sending an old key tag, intending to prevent or delay the migration
  to a new key?

--
JINMEI, Tatuya

[DNSOP] comments on draft-wessels-edns-key-tag-00 神明達哉
Re: [DNSOP] comments on draft-wessels-edns-key-ta… Wessels, Duane