Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\))
From: Joe Abley <jabley@cloudflare.com>
In-Reply-To: 
 <172253719755.2383132.16085097683731517707@dt-datatracker-659f84ff76-9wqgv>
Date: Thu, 1 Aug 2024 21:11:16 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <E5D49184-98BA-4515-9731-4EF5C915BED5@cloudflare.com>
References: 
 <172253719755.2383132.16085097683731517707@dt-datatracker-659f84ff76-9wqgv>
To: Klaas Wierenga <klaas@wierenga.net>
Message-ID-Hash: VNTJKYYVGTKPPXHLXCR6LQS2223VHOYN
CC: secdir@ietf.org, dnsop <dnsop@ietf.org>,
 draft-ietf-dnsop-rfc7958bis.all@ietf.org, last-call@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BDNSOP=5D_Re=3A_Secdir_last_call_review_of_draft-ietf-dnsop-rfc7?=
	=?utf-8?q?958bis-03?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/dnsop/cGwLEnstpAxuSDT8vkRjheMAyWc>

Hi Klaas,

On Aug 1, 2024, at 20:33, Klaas Wierenga via Datatracker =
<noreply@ietf.org> wrote:

> Reviewer: Klaas Wierenga
> Review result: Has Nits
>=20
> The draft reads well and is clear. I have one question that is maybe =
worth
> answering in the security considerations. What is the impact of =
retrieving the
> trust anchors over http instead of https? Does that lead to a risk of =
ending up
> with an invalid set of trust anchors?
>=20
> Klaas

There are risks of ending up with an invalid set of trust anchors =
regardless of what method is used to retrieve them. The use of TLS might =
mitigate some risks, but it does not eliminate them (e.g. it does not =
address the risk of a compromised CA issuing a certificate, or that the =
document being retrieved over HTTPS has been modified at rest by some =
unauthorised third party.

There are compensatory controls that can be used to mitigate particular =
risks, but the decision to mitigate particular risks and the choice of =
mitigation will surely vary significantly depending on the nature of the =
relying party. For some applications, trust-at-first-use might be =
perfectly appropriate. Others might require different measures to be =
taken. Some might consider retrieving the XML document described in this =
document to be too risky to do at all, and might insist on manual, =
in-person attestations and verification of new trust anchors before use.

I think it would be inappropriate for this document to try and catalogue =
all possible use-cases and risks around this. However, I can see how it =
might be useful to add a sentence saying this kind of thing out loud. I =
have not discussed this with my co-authors but I am interested to hear =
their reaction.


Joe