Re: [DNSOP] Working Group Last Call for: draft-ietf-dnsop-kskroll-sentinel

Warren Kumari <> Mon, 11 June 2018 19:30 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 266D0130EC1 for <>; Mon, 11 Jun 2018 12:30:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id hXfM_95aLxOV for <>; Mon, 11 Jun 2018 12:30:47 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:400c:c09::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id DE8A9130EBF for <>; Mon, 11 Jun 2018 12:30:46 -0700 (PDT)
Received: by with SMTP id e16-v6so16578467wmd.0 for <>; Mon, 11 Jun 2018 12:30:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sDffMAxWkOH+zmS73FNzs1q/im0tEdYNl7/kJpnZI7s=; b=P58oxCF1Ji/EebrlueP+2egcO4rsrItAG5z/8izeE45WtQNpKrcgzHnJ5O9u/Ly7AP AX+qmUh/APTKuy8OR5zCcdShQZ77L87mIUqNWPIcgcJheVCA/wb5rdywR+HcpKB9cAaX QyHsvcz77XbWpxIgxIdGrYRkfgHRQjI5moSA+5PXM2MTpwci037UWSghsWcoM22b0J66 plGArfGQ3J1sg1YT+/MoFqxnlsvGA0S8WCzJWvxBThJObf4CS9vAF0nR9JGtH1fRQPBw 1k4HaJ48SBnr51RdxFfkgryt/etUGVCjXSS85c8k7MGlEEGdniYWiKo0PcblXN1HV1DO f3gQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sDffMAxWkOH+zmS73FNzs1q/im0tEdYNl7/kJpnZI7s=; b=UTYpxGO/ai4h2cNK0RmJzlchR8z8I8p3B7PrglxWFK8g90GlTZAgrJFMj1HA0/8jIF DW/6/fxgiD4hD0jBoUpJKjMic81Cj+6kFWRsbIN9d4kEzQOdcOijXbB5frUPZe+Tlz/K NXrf5Bu7nUdKge+Sxu7Bplg4ZLO6qKZjaTBXg24MJCc+zaHNuX+06oJoE2HD81MOn9YL aWP9jRxy2deNnY/03dQPP9xblGXYQmdiMOZ0ZLKpBBQGVo5uj9C1eNKK3tvGpwP3cLoV EPsS74R8p47h4VL1COPpj/uvhf0hdOD50TQkJOZ8b+6DEWkmMcujTguIf4OHcgaAckAB yDFg==
X-Gm-Message-State: APt69E3rf+BvD+mSHIEm83JfBJONfX2z5/kovDyxguDc08b3Hnk0LG9T 17aWeechLFmgJW5FdPCdLJYXFbScKlnKigrhczM99A+9/A8=
X-Google-Smtp-Source: ADUXVKI3gTe01DwlFCM4WYuvedaE/9GjQV13lhe/Nx+2TDfY5iOisGXCLPx9WR5oXm9zY0Rwzz2+05rZ9ZL7PlIvlZM=
X-Received: by 2002:a1c:4189:: with SMTP id o131-v6mr160705wma.7.1528745445016; Mon, 11 Jun 2018 12:30:45 -0700 (PDT)
MIME-Version: 1.0
References: <> <> <> <> <> <> <> <>
In-Reply-To: <>
From: Warren Kumari <>
Date: Mon, 11 Jun 2018 15:30:09 -0400
Message-ID: <>
To: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= <>
Cc: dnsop <>
Content-Type: multipart/alternative; boundary="00000000000033e10c056e62c913"
Archived-At: <>
Subject: Re: [DNSOP] Working Group Last Call for: draft-ietf-dnsop-kskroll-sentinel
X-Mailman-Version: 2.1.26
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 11 Jun 2018 19:30:50 -0000

Dear WG (and chairs),

Firstly, thank you to everyone who supported this, those who provided
comments (especially pull requests!) and implementers.

We have made a number of improvements to the documents based upon your
comments - the diff can be seen here:

Possibly more helpful is the GitHub list of Pull Requests:

We've added an implementation section - I know that there were more
"client" side (the Javascript or similar automated tests); I'd been keeping
a note with a list, but seem to have misplaced it.

BIND and Unbound now support this; AFAIK, Knot supports the older name.

I *think* that we've managed to address the comments, but if we happened to
miss yours, please let us know.

>From my read of the WGs views, these, being *labels*, are not *Special Use
Domain Names*, and so don't need to be added to the SUDN registry.

The authors would like to thank the WG again, and ask that WGLC be resumed.


On Tue, Apr 24, 2018 at 9:02 AM Ondřej Surý <> wrote:

> And the MR was peer-review and merged into BIND master branch with intent
> to backport the feature into older release branches.
> I don’t think it’s a useful or helpful to change the rules for existing
> adopted work.  We need to have a discussion on the mechanisms that would
> allow implementors to know when to start the implementation of existing
> draft. From implementors point, it makes little sense to start implementing
> before the protocol change is almost fully baked (aka WGLC and further),
> because until then the protocol might change considerably.
> So, if we require implementation report further down the road, it needs to
> be more clearly defined than people suddenly shouting “this is not ready”
> when WGLC starts.  And while the attempt to implement something is
> certainly useful to get valuable feedback, it also imposes some costs (with
> undefined limit) on implementors (especially the open source implementors)
> and it sort of discards the whole “Proposed Standard” -> “Internet
> Standard” classification at global IETF level.
> I get that we probably need something more lightweight than “Internet
> Standard” at the WG level, but this needs to be discussed and consensus
> reached.
> ISC gave our feedback during the implementation and here are some nits
> from me (re-reading the document again):
> ~~~
> Section "2.  Protocol Walkthrough Example" will be made into Appendix at
> publication time, so just reminder here that you also need to change the
> references like "(see the logic below)” when you move the section - perhaps
> add direct reference to the other section this refers to?
> ~~~
> The table in 3.2 says:
> "Key Tag is trusted” and “Key Tag is not trusted” - it seems little bit
> confusing to me; I think that “Key is trusted” and “Key is not trusted”; or
> some change similar to this needs to be made:
> “First, the resolver determines if the Key Tag is trusted by comparing
> numerical value of <key-tag>
>    to any of the Key Tags of an active root zone KSK which is
>    currently trusted…"
> in paragraph just before the table you mix “Key Tag” and “keytag” and
> there’s also <key-tag>…
> My understanding of the text and the proposed fix:
> […]
>    First, the resolver determines if the numerical value of <key-tag> is
>    equal to any of the Key Tags of an active root zone KSK which is
>    currently trusted by the local resolver and is stored in its store of
>    trusted keys.  If a match is found the <key-tag> is trusted. An active
>    root zone KSK is one which could currently be used for
>    validation (that is, a key that is not in either the AddPend or
>    Revoked state as described in [RFC5011]).
>    Second, the resolver alters the response being sent to the original
>    query based on both the left-most label and the presence of a key
>    with given Key Tag in the trust anchor store.  Two labels and two
>    possible states of the <key-tag> generate four possible combinations
>    summarized in the table:
>     Label      |   <key-tag> is trusted    |   <key-tag> is not trusted
>     ------------------------------------------------------------------
>     is-ta      | return original answer  | return SERVFAIL
>     not-ta     | return SERVFAIL         | return original answer
> […]
> ~~~
>    o  A query name that is signed with a DNSSEC signature that cannot be
>       validated (such as if the corresponding RRset is not signed with a
>       valid RRSIG record).
> This is called “Bogus” by RFC 4033 Section 5 -> maybe a reference?
> ~~~
> In  Section: 7.  Privacy Considerations
> s/mechansim/mechanism/
> ~~~
> That is all folks.
> Cheers,
> Ondrej
> --
> Ondřej Surý
> > On 7 Apr 2018, at 08:27, Evan Hunt <> wrote:
> >
> > On Fri, Apr 06, 2018 at 10:09:50PM -0400, Warren Kumari wrote:
> >> I think I heard that ISC was considering adding support, but was
> >> planning on waiting till RFC / some sort of LC.
> >
> > Yes. The work in progress is available here:
> >
> >
> > --
> > Evan Hunt --
> > Internet Systems Consortium, Inc.
> >
> > _______________________________________________
> > DNSOP mailing list
> >
> >

I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of