Re: [DNSOP] KSK-Sentinel -- "Walkin' on the SUN"?

Ted Lemon <mellon@fugue.com> Tue, 15 May 2018 17:25 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09EE112DA72 for <dnsop@ietfa.amsl.com>; Tue, 15 May 2018 10:25:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.909
X-Spam-Level:
X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rOWGRp2IbLx6 for <dnsop@ietfa.amsl.com>; Tue, 15 May 2018 10:25:23 -0700 (PDT)
Received: from mail-it0-x244.google.com (mail-it0-x244.google.com [IPv6:2607:f8b0:4001:c0b::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AA948126C25 for <dnsop@ietf.org>; Tue, 15 May 2018 10:25:23 -0700 (PDT)
Received: by mail-it0-x244.google.com with SMTP id z6-v6so3457122iti.4 for <dnsop@ietf.org>; Tue, 15 May 2018 10:25:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=25OIJEV4pR25xj6sCJfQzZ0+qWK9WLvQ3j3WWBza1hs=; b=nVFlnvVwcPzx9szvXaoe0Qee19ZJXVL/jhj8PHLURggSyY3rX0HIboEpx6P4aZIzZO xZziVFjQ7ld6GxENtl46MPGvKQB4OTsOz67VqYOxvK6wDTaFnLL8fxajaZYjoWofilT2 B3ZMlhuV8m0YosRaI59tpcsgW/CjBGggY0mY9iC1EDVOdhsVK+2AirQosVc7l6t/SAnr TEh+eQiZM8rBfG0y5LfhSp5PpLWfQAmjCg8Y/WhBZMRBEQ90/yHZRHhacp2J3qbITY53 dlfDFdJBGCZWLDPz5zaP5mtemsiiduSSmlB3DHB5x/+WUlZB9+o44JOT7iJ9EdC671M/ icTA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=25OIJEV4pR25xj6sCJfQzZ0+qWK9WLvQ3j3WWBza1hs=; b=Nhzemzh64buCEPexNo9Mjj1XPAnGA4MYSHL2HA8lLW93VRabPIDTpdkKm9GXNssHgb vZmI9C2TkgEr+XSlEWbndRqi4im/BXv5hiBVePLVRxTc1UVVZbzV/ys7+O6ZUJFI1y7a s7qGufw3CTgICbYygKM6GyrS0i1FKLooPIi1NbvP/HXo78QksOhDv3FrZuoZqr1Z4XVI xlCE3vXE+5tCHxVOyOIROj3QDtOhQVJW3391nJu1QPl0r89Z+Vp34kVSon4OXtXyduRO TJKVrvpLgYaSbkndG9Kct9apBoOBBef+cqzhmRdu800cyPukHhfcHpvSLZ/xsFz4RTeY U7pQ==
X-Gm-Message-State: ALKqPweeHxpshdivG66orT7RLi6D+vS6t6s3G0RkT9FhwUfg5LUHtlWr DmlKquE5Uo6yiGwZx6Rq1qznp9P6YP62dFTN5r5AXw==
X-Google-Smtp-Source: AB8JxZpIVS1pGVzMnHUDe2DDi3iPh5iIhGOHqyTbXNlICFzmOHSMSk4Ye05YzS2ujknaFevZ98VTbSfJ8WrHPvzwoqc=
X-Received: by 2002:a6b:9107:: with SMTP id t7-v6mr17503377iod.32.1526405122671; Tue, 15 May 2018 10:25:22 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a4f:8cd8:0:0:0:0:0 with HTTP; Tue, 15 May 2018 10:24:42 -0700 (PDT)
In-Reply-To: <CAAiTEH_7cndQDvoz24VGaRhCcpS5JkJX7_H68DX1xKk0e9jFCQ@mail.gmail.com>
References: <CAHw9_iKPTT686F8piMGJG=ESnioaunJDTKurabvMA6NucqvBow@mail.gmail.com> <alpine.DEB.2.11.1805151043220.1809@grey.csi.cam.ac.uk> <CAPt1N1=ussiww-a_tGJyUxgf7HCGTx-9LCyENSzmjWGP1D=ysQ@mail.gmail.com> <alpine.DEB.2.11.1805151732070.1809@grey.csi.cam.ac.uk> <CAAiTEH_7cndQDvoz24VGaRhCcpS5JkJX7_H68DX1xKk0e9jFCQ@mail.gmail.com>
From: Ted Lemon <mellon@fugue.com>
Date: Tue, 15 May 2018 13:24:42 -0400
Message-ID: <CAPt1N1m0NF53EF74peECpV5sMiY7wtQae8isWfF5vmcUzBJ47A@mail.gmail.com>
To: Matthew Pounsett <matt@conundrum.com>
Cc: Tony Finch <dot@dotat.at>, dnsop <dnsop@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000001efe2a056c41e3b0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/ReGlMCODf4zxeOBtwgmL_mVR1sU>
Subject: Re: [DNSOP] KSK-Sentinel -- "Walkin' on the SUN"?
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 15 May 2018 17:25:26 -0000

Hm, well, the analogy I was making is that this is essentially a signal to
an application, which happens to be a caching name server.  "Other name
servers treat them as ordinary names" is not a reason not to list a
special-use name in the registry.   Ideally we want names like this to have
as small an implementation footprint as possible.   The reason I am
objecting to the idea that this is a special-use name is that it doesn't
seem fundamentally different to _tcp, aside from the detail of what
software happens to consume it.   Special-use names do generally require
special treatment by the system, even though we hope that the footprint
will be as small as possible.   Right now entries in the table are either
not global names (which doesn't apply here) or are intended for special
purposes (e.g., example.com, invalid), or require a protocol other than DNS
to resolve (local, onion).

The case for handling this as a special-use name is that we'd want
implementors of naming software to find it in the registry so that they'd
know to do it, but I don't think that applies here—the downside to not
doing it is that you don't get the new feature, not that something breaks.
  That's very similar to the downside of not knowing what _tcp means.

On Tue, May 15, 2018 at 12:39 PM, Matthew Pounsett <matt@conundrum.com>
wrote:

>
>
> On 15 May 2018 at 12:34, Tony Finch <dot@dotat.at> wrote:
>
>> Ted Lemon <mellon@fugue.com> wrote:
>>
>> > It might be useful to compare this to labels like _tcp that appear in
>> SRV
>> > records and elsewhere.
>>
>> The reason for listing a name in the RCF 6761 registry is because it needs
>> special handling of some kind in DNS software. That isn't the case for the
>> _underscore names, which (from the DNS point of view) are just ordinary
>> domain names that have conventional uses in applications.
>>
>> I'm going to suggest a modification to your first sentence.  The reason
> for listing a name int he RFC 6761 registry is because it needs special
> handling of some kind in DNS software that would otherwise be unaware of
> the special handling required by that name.  In this case, the only name
> servers that need to handle these names specially are the ones implementing
> the technology.. all other name servers treat them as ordinary names.
>
>