Re: [DNSOP] WG review of draft-ietf-homenet-dot-03

Ted Lemon <mellon@fugue.com> Tue, 21 March 2017 01:06 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDA4713161E for <dnsop@ietfa.amsl.com>; Mon, 20 Mar 2017 18:06:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QOZF27WTDmca for <dnsop@ietfa.amsl.com>; Mon, 20 Mar 2017 18:06:45 -0700 (PDT)
Received: from mail-qt0-x22e.google.com (mail-qt0-x22e.google.com [IPv6:2607:f8b0:400d:c0d::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E229E1294D0 for <dnsop@ietf.org>; Mon, 20 Mar 2017 18:06:44 -0700 (PDT)
Received: by mail-qt0-x22e.google.com with SMTP id n21so120854220qta.1 for <dnsop@ietf.org>; Mon, 20 Mar 2017 18:06:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=nE7A4rhgz/I7/aA4gjVM/EGbLecp6xI/cZD5kXHRSa0=; b=dfkfVgWzuCrTQmkeodrfMmVCVKDrrZBTm/85BhEsdUDcgKsTC1OUi3sFQKcFXF1n+Y EklyYns1s7oE2vSV/AJAnyJWfFS4CTYvQCFzoMViTMHbmubgWFt9ACzfHhkbpkQN9G0/ Pd6trMqUghU1HsMidHpcpNMe5SYTzzjsd4j6L4C9Y2s8L8neMdfwo6hcETNlwmyGWvYi 4fD0MMIYosWlUvy4V9mnpfd9FcL3DxIoPa2UbmX05jYgh9NUjs4a7/oxC/APRUVkLMlq AdVkcCsi1tdWcdqzTqsogcB/qurqZR8ggvgtMHfFezhvnsclyrD9voUCnhIQQdyqseC4 WLqw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=nE7A4rhgz/I7/aA4gjVM/EGbLecp6xI/cZD5kXHRSa0=; b=I9JXDXcNoMiAaqWNjDyzVCCK3mvgzn22AwXlsJbZwMpxOtaoiGemDYZJRyi0gYI341 eNJdkwa4UhpLxtmScNT4YHLRJZ+9X78bVkpjEsCPjyztLX69X0RS1afaWCWcyfIc+OTS 0+H1VQkdohyIv6pDfQmBOdqN24PnoUOKeHkBBqomC4Vyh8CfN6RBvM3kFqX3fEwEkDWr n1i0AsxPVF5B74Okg3IBlEZApvsnC2JW38+eAkc4tCr+/VTVUxD1bPGnmtQ6vHjg2gIZ qlsuCERWmF6gRCy9OQreMj4g4K45f4USFhBxXgiqXmEMWOw/pWn/JzetW2n0Jcn+3PD+ 4ucw==
X-Gm-Message-State: AFeK/H0cPfjF/L9CVDTctH0AXl/vA07kxnt8mJFguRyVQBj4DuYRGoJHNkub33Ozk7RotA==
X-Received: by 10.200.48.54 with SMTP id f51mr28500490qte.164.1490058403696; Mon, 20 Mar 2017 18:06:43 -0700 (PDT)
Received: from [10.0.30.228] (c-73-167-64-188.hsd1.ma.comcast.net. [73.167.64.188]) by smtp.gmail.com with ESMTPSA id h40sm13617930qtb.59.2017.03.20.18.06.42 for <dnsop@ietf.org> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Mar 2017 18:06:42 -0700 (PDT)
From: Ted Lemon <mellon@fugue.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_F9D0921A-2052-4A7E-A908-73B3D74295FC"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Date: Mon, 20 Mar 2017 21:06:40 -0400
References: <BE2A3845-D8AA-433A-9F00-1056ECFD335F@fugue.com> <21C8F856-FE3F-42A6-A8ED-888D0797B68B@vigilsec.com> <60C85486-E351-4C42-ADEB-FCBB56F4EA27@fugue.com> <AB11455F-7E43-4CB3-9F13-DB6A09F739EB@vigilsec.com> <CEC8CC6A-861A-471C-B7FA-4BB05C81CCF0@gmail.com> <F7AA49EF-2708-4948-9B60-6660DA6BC841@vigilsec.com> <734EC35A-4B1F-43EB-BE37-C34CA46BDA26@fugue.com> <203D2BEA-1008-48A0-9CE2-1FD621C6117F@shinkuro.com> <3134EDC2-FB00-41EA-8338-6E6B196137F1@fugue.com> <572B4EBA-F37F-4E92-A252-44BAF5DE7FF5@shinkuro.com> <20170321004827.GA25754@mournblade.imrryr.org>
To: dnsop <dnsop@ietf.org>
In-Reply-To: <20170321004827.GA25754@mournblade.imrryr.org>
Message-Id: <72896FC4-5F63-4880-8C4B-A941A63B91B6@fugue.com>
X-Mailer: Apple Mail (2.3259)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/eDIG4pj9d5u5LpjoUV7qBDrXv1w>
Subject: Re: [DNSOP] WG review of draft-ietf-homenet-dot-03
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 21 Mar 2017 01:06:47 -0000

On Mar 20, 2017, at 8:48 PM, Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:
> FWIW, when adding DANE support to Postfix,

Viktor, forgive me, but this is such a completely different use case than what we are talking about.   In this case, the Postfix mailer and the recursive validating resolver are both operated by the same entity.  You can use TSIG and be satisfied, or even trust the IP address if you are naive.

The homenet use case is completely different.   Here we are talking about devices that routinely roam among operational domains with no basis for trust or even knowledge of the trustworthiness of the local resolver.   In this case, trusting the local resolver could be anywhere from completely safe, to an opportunity to have your butt sniffed by your employer, to a completely corrupt Wifi hotspot that's been set up specifically to attack your device.   Trusting the network in this case is simply nonsensical, and there is no trust relationship that could make TSIG work.