Re: [DNSOP] post-dispatch dispatching a draft...

Warren Kumari <> Wed, 18 May 2022 02:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 104FCC14F734 for <>; Tue, 17 May 2022 19:50:11 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -7.098
X-Spam-Status: No, score=-7.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id kgP2uJ1dtmVh for <>; Tue, 17 May 2022 19:50:06 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4864:20::b30]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id C910EC14F718 for <>; Tue, 17 May 2022 19:50:06 -0700 (PDT)
Received: by with SMTP id t26so1478062ybt.3 for <>; Tue, 17 May 2022 19:50:06 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=+DlEcEY+nIDce3wUHXmdjKokojjWbNoQVNEOWLMtO6k=; b=XkqOAYLSaVCk9G2uq+lh9RLJBA2W64j1MYAH5Lt0/zM3durBeJqQorlz0BL1aGLX2r aCQuQ0FnBw3K5fjDDJ6MAQXAKKQkjJIZFDOcuBD44Kg686rinZS1oWw1pyIlmPN1ohXh T1LYyD26XDh9NRyzIQju1RMkgaArfMUQWW+GynpRZ4NyvPYBv1fgYdXsmeSqpIdGr7Zu gqn0TwvphEvcvZkD1nmRz7E8reT67sUISNNzFf1YE4muevpMnpH0qQG9vuQOs0oO2Sih T1KcqsPkHSS6RFaS7Mrz394W+CGRCqQMMoToyh3n+HNwmwDTYsnwfHcaQ/dnvHUSjIxY oDag==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20210112; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=+DlEcEY+nIDce3wUHXmdjKokojjWbNoQVNEOWLMtO6k=; b=OkiHLWslDbZNV2HTyw31QauHe5pNDh4e02ajC0C5RMNrKYrxjbn8e0ObO5gomeTmOj q5I36Gdd73MfluOjZEmdbN+59I8Niygk9dVYP3fxazyq9OHik4wA8cI0U8pWPtOAoEOH nr7BqmDwg+G7JeuzodsDBAIoWShyVEZEsPFpqvAxZ8dJ6NV+FSRV6OUGW98Cu9sCxtsv qKiWR0SyhGFHLJ7TUf5bp4I7RNxexuHn9wlYEXVlQdupNMIoqiD7WPOg6Fv6zDHbu6To vvjYhn/uVQXpgCsmynAJR3RD4s/Y8pqRvzzkg0ih/WWGmgIB7W4/eum5w+dWYHu+bt4j cBLA==
X-Gm-Message-State: AOAM530zr6yhIGFY5WfzLYA/nHapGIG6DouLqpqh61uzDMOg/ts055lG lPGvGj5jBAgvrZZaj7dh3ZAKiRzJyBTEMDFnoY5zCG2aeyc=
X-Google-Smtp-Source: ABdhPJw0+9dt8rLzZBkKTNDOGN123jDSmTy4Hd+aShZIpF2gh2kLMJu5vqjl7ns3F6/F6VlH8i+YgHYN7up5kga6b7o=
X-Received: by 2002:a05:6902:1501:b0:649:ff91:5409 with SMTP id q1-20020a056902150100b00649ff915409mr25988783ybu.278.1652842204989; Tue, 17 May 2022 19:50:04 -0700 (PDT)
Received: from 649336022844 named unknown by with HTTPREST; Wed, 18 May 2022 05:50:03 +0300
Mime-Version: 1.0
X-Superhuman-Draft-ID: draft0052536cb5c6d1b3
In-Reply-To: <>
References: <>
X-Mailer: Superhuman Desktop (2022-05-16T22:05:51Z)
X-Superhuman-ID: l3azk6ft.a0d70da9-b4aa-452c-bccd-66c38aeb385d
From: Warren Kumari <>
Date: Wed, 18 May 2022 05:50:03 +0300
Message-ID: <>
To: Stephen Farrell <>
Content-Type: multipart/alternative; boundary="0000000000007f9be905df40509c"
Archived-At: <>
Subject: Re: [DNSOP] post-dispatch dispatching a draft...
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 18 May 2022 02:50:11 -0000

On Tue, May 17, 2022 at 11:39 AM, Stephen Farrell <
> wrote:

> Hi all,
> At IETF 113 a draft of mine [1] was presented (slides [2]) at the dispatch
> session. Part of the upshot there was to check with dnsop if people felt
> asking for adoption here would be the right plan for this draft.
> The draft is concerned with (re-)publishing ECHConfigList values in
> SVCB/HTTPS RRs as the keys for ECH are rotated, but in the context where
> the ECH private key holder and the DNS publishing entities differ. As an
> FYI, ECH interop servers operated by Cloudflare and by me rotate such keys
> hourly so some new automation is needed for cases where one does not have
> some kind of dynamic DNS API available.

<no hats, personal view only, objects in rear-view mirror may be closer
than they appear, etc/>
'k,  so about the only terms I recognize from the above are 'DNS' and 'RR'
- the rest are deep TLS arcana…. to my mind that makes it seem much more
like it should be adopted in something like TLS, with some input / review


P.S: Yeah, yeah, ok, I also recognized the others, but my point is that the
document is much more (to my mind) related to TLS and well-known URIs and
similar, and that the DNS bit is much more secondary...

> To be clear: my own opinion is that adopting this in dnsop would not be a
> good plan, but that asking the TLS WG would be the right plan instead. That
> said though, even if this were adopted by TLS, I think it'd benefit from
> input from dnsop (and httpbis), once the adopted form of the draft had
> taken would could be a near-final overall shape. And who knows, maybe I'm
> wrong and this'd be better handled here.
> So - do people here consider it'd be useful to try for a call for adoption
> for this in dnsop, or do you agree with me that doing that in the tls wg
> would be better?
> Thanks,
> S.
> PS: If it's useful and there's time I'd be fine with asking the above
> again at the upcoming interim.
> [1]
> [2]
> _______________________________________________
> DNSOP mailing list