IETF Logo Mail Archive

Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

Mark Andrews <marka@isc.org> Fri, 22 June 2018 01:52 UTC

Return-Path: <marka@isc.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 535B2130DC9 for <dnsop@ietfa.amsl.com>; Thu, 21 Jun 2018 18:52:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.901
X-Spam-Level:
X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TY0cS4zSUW-B for <dnsop@ietfa.amsl.com>; Thu, 21 Jun 2018 18:52:51 -0700 (PDT)
Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6690A130DC6 for <dnsop@ietf.org>; Thu, 21 Jun 2018 18:52:51 -0700 (PDT)
Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id BD26C3AB001; Fri, 22 Jun 2018 01:52:50 +0000 (UTC)
Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id 7AADE160041; Fri, 22 Jun 2018 01:52:50 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id 635D7160068; Fri, 22 Jun 2018 01:52:50 +0000 (UTC)
Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 9tA1a5qbzl0d; Fri, 22 Jun 2018 01:52:50 +0000 (UTC)
Received: from [172.30.42.90] (c27-253-115-14.carlnfd2.nsw.optusnet.com.au [27.253.115.14]) by zmx1.isc.org (Postfix) with ESMTPSA id 4DCC1160041; Fri, 22 Jun 2018 01:52:49 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
From: Mark Andrews <marka@isc.org>
In-Reply-To: <30E5CEA0-F7D9-46B5-B262-599C2101D479@verisign.com>
Date: Fri, 22 Jun 2018 11:52:46 +1000
Cc: Petr Špaček <petr.spacek@nic.cz>, "dnsop@ietf.org WG" <dnsop@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <6298ECD8-E915-4F82-AB88-CC52CCC5970C@isc.org>
References: <4DCC5A51-1AB0-47B6-92B5-79B6894F9A9C@verisign.com> <CAJE_bqcELQbQeHPvvEBHOxpRyWYL76BmT_-G4jW4pTnUUXFMUw@mail.gmail.com> <27C44216-581A-4991-A739-ECE8B7F8AA35@verisign.com> <884c2d11-9db0-7668-59c9-baa8574a03f7@time-travellers.org> <37873808-8354-b26b-34f4-880ea7a5f0da@nic.cz> <CAHPuVdWXBDHdiQ2Z1uFx=mZFRBpjndiki+6Eno-2qFoe6hAovw@mail.gmail.com> <20180619231512.GA26273@jurassic> <CAHPuVdVSXNKZEhZ_2-vV_9py_n5Dw+FaMXXBbQtORwGF2xuDQw@mail.gmail.com> <ebf643d5-a85d-2f72-88f3-3710acde4746@nic.cz> <30E5CEA0-F7D9-46B5-B262-599C2101D479@verisign.com>
To: "Wessels, Duane" <dwessels=40verisign.com@dmarc.ietf.org>
X-Mailer: Apple Mail (2.3273)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/DBlo6qa17UAt8Yg7PXY3Uu8J5Cs>
Subject: Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Jun 2018 01:52:54 -0000

> On 22 Jun 2018, at 1:55 am, Wessels, Duane <dwessels=40verisign.com@dmarc.ietf.org> wrote:
> 
> 
>> On Jun 20, 2018, at 11:19 PM, Petr Špaček <petr.spacek@nic.cz> wrote:
>> 
>>> 
>>> Longer term, perhaps the best solution will end up being XFR using DNS over 
>>> TLS (or HTTPS) with server authentication. Yes, I realize that authoritative
>>> servers are not yet the targets of those protocols, but it's probably
>>> only a matter
>>> of time.
>> 
>> HTTPS over TLS is what we did for root zone import into Knot Resolver's
>> cache (from version 2.3 onwards but beware, there are little bugs which
>> were fixed in 2.4 - to be released soon).
> 
> The problem I'm seeking to solve is somewhat different, and its probably
> not clearly stated in the draft so I will add some text to rectify that.
> 
> I'm not trying to solve the problem that SIG(0), SIG(AXFR), or TLS addresses
> -- that you're talking to the right server and that data wasn't modified
> in transit.
> 
> My goal is to ensure that when you receive a zone file -- however you
> receive it (DNS, HTTPS, P2P file sharing, Avian Carrier) -- you get the
> data that the zone publisher actually published.

SIG(AXFR) does that.  It is part of the zone’s contents.

> DW
> 
> 
> 
> _______________________________________________
> DNSOP mailing list
> DNSOP@ietf.org
> https://www.ietf.org/mailman/listinfo/dnsop

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org

v2.23.0 | Report a Bug | By Email