Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

神明達哉 <jinmei@wide.ad.jp> Fri, 27 July 2018 21:23 UTC

Return-Path: <jinmei.tatuya@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 172F4130E52 for <dnsop@ietfa.amsl.com>; Fri, 27 Jul 2018 14:23:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.422
X-Spam-Level:
X-Spam-Status: No, score=-0.422 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, FROM_EXCESS_BASE64=0.979, HEADER_FROM_DIFFERENT_DOMAINS=0.25, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gFxw4WKoGXsb for <dnsop@ietfa.amsl.com>; Fri, 27 Jul 2018 14:23:04 -0700 (PDT)
Received: from mail-lj1-f178.google.com (mail-lj1-f178.google.com [209.85.208.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7364A130DFF for <dnsop@ietf.org>; Fri, 27 Jul 2018 14:23:04 -0700 (PDT)
Received: by mail-lj1-f178.google.com with SMTP id l15-v6so5567723lji.6 for <dnsop@ietf.org>; Fri, 27 Jul 2018 14:23:04 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=E+/6OhG+KBPjbzxyxKIBCOkuHunJZib8niAcKZ4mzxM=; b=NvXaTVV8QPPBO7Ornjk+5Bq2hGWtrmLfIqO50eRCClRiZ5KLuavIM7k91/EFIgtgnL kM+yd49NuvVQ7S0zEeGsbTNjikir34cCN37xBlNh6Hkm6z2fijKizQpkhcGXWlEA6Wn9 YiEwnG0ueXjHChaH85VlAkNLunRqptDdWH+6rKdldUqRFw1QPgcwXcdRxDXB3piaoPg8 eaeGrtMOitirfpRAv3FD9AvDA3gmZhmPXxTx+c/rscprxajo82rFyrbXQN3hpZNHm+aq y6RLUhKZHrFkjIOxqRN6w1T5SVxfSVuRirzeWHh2J0r9vPZI4Lrf6UXHIWFxCYSI9mUy 6lWA==
X-Gm-Message-State: AOUpUlHrPmJ/BWXvxCLxBYCnsFJatKcJpSJ2gTGLD2hP9NyJ5b7EaC9R 2r04FHD0bTrSLv0S7VlD2GEoGNpRuRkcQrXP848=
X-Google-Smtp-Source: AAOMgpcE4iLS4Qh9Gvf6xezEqWX/QWdP77Zhq0AnPC967uzUQi5ygPTmcBxcEJLwC9c0ty1oQjp0N5pRqUCQd34pssU=
X-Received: by 2002:a2e:93c4:: with SMTP id p4-v6mr5801272ljh.150.1532726582651; Fri, 27 Jul 2018 14:23:02 -0700 (PDT)
MIME-Version: 1.0
References: <4DCC5A51-1AB0-47B6-92B5-79B6894F9A9C@verisign.com> <CAJE_bqcELQbQeHPvvEBHOxpRyWYL76BmT_-G4jW4pTnUUXFMUw@mail.gmail.com> <CAAObRXL2LoB3f=296ZPE1Pp1nHkG---pRPAmyO1trTROxneHDQ@mail.gmail.com> <FF0A0A24-705F-46E3-BF31-314078636EE2@isc.org> <CAAObRXLjnOeaGZyHhvxH3xPwGBp=zxx6AjLSSm=CXR33NM-LjA@mail.gmail.com> <CAJE_bqetth7KLPsFaQD_S9w-LQYLaAz+7c9F9iG7TLX7zfzaOQ@mail.gmail.com> <CAHw9_iKcxzpuS7sdxoET1gmF5jbE9udFS7Dzg-TSj+pYiQ27NA@mail.gmail.com>
In-Reply-To: <CAHw9_iKcxzpuS7sdxoET1gmF5jbE9udFS7Dzg-TSj+pYiQ27NA@mail.gmail.com>
From: 神明達哉 <jinmei@wide.ad.jp>
Date: Fri, 27 Jul 2018 14:22:50 -0700
Message-ID: <CAJE_bqehef98f-V5kYgsCvoMn6s0jMc0FhxsVdj9u_mx2YA76Q@mail.gmail.com>
To: Warren Kumari <warren@kumari.net>
Cc: songlinjian@gmail.com, dnsop <dnsop@ietf.org>, mweinberg=40verisign.com@dmarc.ietf.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/W_5YImZskW8nt0dkZF3R4bTrh1s>
Subject: Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 27 Jul 2018 21:23:06 -0000

At Fri, 27 Jul 2018 16:43:44 -0400,
Warren Kumari <warren@kumari.net> wrote:

> > Right, so I think one main question is why the root DNS zone case is
> > so special that a protocol extension is justified.  Personally, I'm
> > not yet fully convinced about it through the discussion so far.  As
> > several other people seem to be persuaded, however, maybe I'm too wary
> > just because of my hat of handling eventual "named triggers an
> > assertion failure after zone transfer for some bogus zone digest"
> > CVEs.  But at the same time, if my sense of the wg's take on the "DNS
> > camel" discussion is correct, I think we (WG) should require a higher
> > level of justification for new protocol features.
>
> This can, but does not have, to be built into the nameserver itself.

True, and I might feel much better if the draft said "name server
implementations MUST NOT compute or validate the zone digest
in their code":-).  More seriously, my concern with the "hat" wouldn't
be addressed simply because it can be implemented outside of a name server
implementation.  In fact, I can see it'll eventually be included in
code base I'll have to maintain if it's officially adopted and
published.  On the other hand, if we're okay with an out-of-band
implementation (independently from whether we like it in a name
server), then I guess it will become less distinguishable from
out-of-band digest approaches.  Either way it requires the operators
to use an additional tool, and it's therefore more operationally
costly, error prone, or easier to be ignored/forgotten.

--
JINMEI, Tatuya