[DNSOP] Fwd: New Version Notification for draft-thomassen-dnsop-dnssec-bootstrapping-02.txt

[Peter Thomassen <[e-mail]>]

Dear DNSOP and DNSSEC bootstrapping aficionados,

This draft introduces automatic bootstrapping of DNSSEC delegations. It uses an in-band method for DNS operators to publish information about the zones they host, per-zone and with authentication. With this protocol, DS provisioning can happen securely and without delay.

We requested a slot at IETF 112 to present the draft, and it would be great to have some discussions about it then. We'd also like to work towards adoption in the WG if there is interest.

There are no technical changes from the previous version -01. Updates are exclusively on clarity, framing (as an RFC 8078 authentication method instead of a separate protocol), and otherwise editorial.

Thanks,
Peter


-------- Forwarded Message --------
Subject: New Version Notification for draft-thomassen-dnsop-dnssec-bootstrapping-02.txt
Date: Mon, 25 Oct 2021 16:56:41 -0700
From: [e-mail]
To: Nils Wisiol <[e-mail]>, Peter Thomassen <[e-mail]>


A new version of I-D, draft-thomassen-dnsop-dnssec-bootstrapping-02.txt
has been successfully submitted by Peter Thomassen and posted to the
IETF repository.

Name:		draft-thomassen-dnsop-dnssec-bootstrapping
Revision:	02
Title:		Automatic DNSSEC Bootstrapping using Authenticated Signals from the Zone's Operator
Document date:	2021-10-25
Group:		Individual Submission
Pages:		15
URL:            https://www.ietf.org/archive/id/draft-thomassen-dnsop-dnssec-bootstrapping-02.txt
Status:         https://datatracker.ietf.org/doc/draft-thomassen-dnsop-dnssec-bootstrapping/
Html:           https://www.ietf.org/archive/id/draft-thomassen-dnsop-dnssec-bootstrapping-02.html
Htmlized:       https://datatracker.ietf.org/doc/html/draft-thomassen-dnsop-dnssec-bootstrapping
Diff:           https://www.ietf.org/rfcdiff?url2=draft-thomassen-dnsop-dnssec-bootstrapping-02

Abstract:
    This document introduces an in-band method for DNS operators to
    publish arbitrary information about the zones they are authoritative
    for, in an authenticated fashion and on a per-zone basis.  The
    mechanism allows managed DNS operators to securely announce DNSSEC
    key parameters for zones under their management, including for zones
    that are not currently securely delegated.

    Whenever DS records are absent for a zone's delegation, this signal
    enables the parent's registry or registrar to cryptographically
    validate the CDS/CDNSKEY records found at the child's apex.  The
    parent can then provision DS records for the delegation without
    resorting to out-of-band validation or weaker types of cross-checks
    such as "Accept after Delay" ([RFC8078]).

    [ Ed note: Text inside square brackets ([]) is additional background
    information, answers to frequently asked questions, general musings,
    etc.  They will be removed before publication.  This document is
    being collaborated on at https://github.com/desec-io/draft-thomassen-
    dnsop-dnssec-bootstrapping/ (https://github.com/desec-io/draft-
    thomassen-dnsop-dnssec-bootstrapping/).  The most recent version of
    the document, open issues, etc. should all be available there.  The
    authors gratefully accept pull requests. ]

                                                                                   


The IETF Secretariat