IETF Logo Mail Archive

Re: [DNSOP] [Ext] About key tags

Paul Hoffman <paul.hoffman@icann.org> Wed, 28 February 2024 21:34 UTC

Return-Path: <paul.hoffman@icann.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DA47C14F697 for <dnsop@ietfa.amsl.com>; Wed, 28 Feb 2024 13:34:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.21
X-Spam-Level:
X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x6L1H4_1TL5V for <dnsop@ietfa.amsl.com>; Wed, 28 Feb 2024 13:34:52 -0800 (PST)
Received: from ppa4.dc.icann.org (ppa4.dc.icann.org [192.0.46.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A702C14F61E for <dnsop@ietf.org>; Wed, 28 Feb 2024 13:34:52 -0800 (PST)
Received: from MBX112-W2-CO-2.pexch112.icann.org (out.mail.icann.org [64.78.33.6]) by ppa4.dc.icann.org (8.17.1.24/8.17.1.24) with ESMTPS id 41SLYlWl014952 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 28 Feb 2024 13:34:47 -0800
Received: from MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) by MBX112-W2-CO-1.pexch112.icann.org (10.226.41.128) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Wed, 28 Feb 2024 13:34:49 -0800
Received: from MBX112-W2-CO-1.pexch112.icann.org ([169.254.44.235]) by MBX112-W2-CO-1.pexch112.icann.org ([169.254.44.235]) with mapi id 15.02.1258.028; Wed, 28 Feb 2024 13:34:49 -0800
From: Paul Hoffman <paul.hoffman@icann.org>
To: Mark Andrews <marka@isc.org>
CC: "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: [DNSOP] [Ext] About key tags
Thread-Index: AQHaXynQcSewI8Xfb0yAZB8Nz1aZ2bEKT0iAgAAyPYCAAStKgIAASjQAgAA/RYCAAAE8AIAAAsCAgAE2sYCAABTEgIAAGREAgAAQ3ACAEXRTAIAAJ+OAgAAPFICAAX7ggIAABygAgAACuoA=
Date: Wed, 28 Feb 2024 21:34:49 +0000
Message-ID: <79BE8275-0E19-4E68-813C-A0612F9D1814@icann.org>
References: <9C4B65D7-EC9D-40BC-9B23-825F7FE8FB7E@isc.org> <20240227220905.E06018410007@ary.qy> <641C2E38-F1A8-435B-BA6F-770FEE9AEEA5@icann.org> <424DEFFC-0836-4C6E-842A-F2B332459A8B@isc.org>
In-Reply-To: <424DEFFC-0836-4C6E-842A-F2B332459A8B@isc.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.0.32.234]
x-source-routing-agent: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3C62A55081D87F43835B8DFAB8590667@pexch112.icann.org>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.272,Aquarius:18.0.1011,Hydra:6.0.619,FMLib:17.11.176.26 definitions=2024-02-28_08,2024-02-27_01,2023-05-22_02
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/NHBcQuqe0Ua155L1JBXwl-e1LDo>
Subject: Re: [DNSOP] [Ext] About key tags
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 28 Feb 2024 21:34:52 -0000

On Feb 28, 2024, at 13:25, Mark Andrews <marka@isc.org> wrote:
> The point of forbidding is to allow the validator to safely stop as soon as possible when it is under attack.

If that is the point, why not just document that a validator is allowed to do that, such as if it sees three matching keytags? That seems much more direct.

--Paul Hoffman

v2.23.0 | Report a Bug | By Email