IETF Logo Mail Archive

Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt

"John R Levine" <johnl@taugh.com> Sun, 29 July 2018 22:32 UTC

Return-Path: <johnl@taugh.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7235E130E66 for <dnsop@ietfa.amsl.com>; Sun, 29 Jul 2018 15:32:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=jaXy7dbM; dkim=pass (1536-bit key) header.d=taugh.com header.b=gm1Pya2Y
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QUuD4HR-vVGC for <dnsop@ietfa.amsl.com>; Sun, 29 Jul 2018 15:32:38 -0700 (PDT)
Received: from gal.iecc.com (gal.iecc.com [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5DF3E130E11 for <dnsop@ietf.org>; Sun, 29 Jul 2018 15:32:38 -0700 (PDT)
Received: (qmail 69618 invoked from network); 29 Jul 2018 22:32:36 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=10fe9.5b5e4084.k1807; bh=Om0LzGAP6IGS0LO2NOCvBRCqHIzvfudxnqu3reD6hw0=; b=jaXy7dbMH60A++2RDgQQUr5nlSShDd/jdPxkCovLllmGlYHTG7AghfHzHUEoxjtjld7WvhLALd92Z9iro6+dG/+9WVEHj6srys6g7GrDlXohsLrDprcsvEJ8N8XyGzV+8F211gYmolceMhfOBUVDFCNVo2llN8W6AW8IIsxy9pqoxzNxHtwaSpX/Kop6knaiGiHB/0Hmj5EMxtTn9bI1KH80rhJY5rv0HCr7nIaX9NPZ2ShkXAjBDJQU8BeUOLyH
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=10fe9.5b5e4084.k1807; bh=Om0LzGAP6IGS0LO2NOCvBRCqHIzvfudxnqu3reD6hw0=; b=gm1Pya2YrqpW8awIc9Lw0aaCCEpxMXhf1Aq+GQlquZ+WHBA+omFyyeTyuC3hh3N2V8Fipi2GD8M0FLOpgcrr+Dc2Ti79m8QlY6qxcsUrtQ2qbrkheyPQ/h+ejpG1EUw0LZq/lpeprJvaG8tNUAeWkid9y6LdU6m6k2WxL9nzeSUwh7Hd/vafnbk28OUzgV76HjrNRE8iraRmZC0//s5gfpDq+8BSWhaTZYRU4WWpqhIW64qm73C18ItzupnY8Le2
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.2/X.509/AEAD) via TCP6; 29 Jul 2018 22:32:36 -0000
Date: Sun, 29 Jul 2018 18:32:35 -0400
Message-ID: <alpine.OSX.2.21.1807291829370.50249@ary.qy>
From: John R Levine <johnl@taugh.com>
To: Florian Weimer <fw@deneb.enyo.de>
Cc: dnsop@ietf.org
In-Reply-To: <87wotdu4xn.fsf@mid.deneb.enyo.de>
References: <20180724143253.83ACC2002CE789@ary.qy> <87va8zh77f.fsf@mid.deneb.enyo.de> <alpine.OSX.2.21.1807281106550.71239@ary.qy> <87k1pfgy5i.fsf@mid.deneb.enyo.de> <alpine.OSX.2.21.1807281207520.72264@ary.qy> <87wotdu4xn.fsf@mid.deneb.enyo.de>
User-Agent: Alpine 2.21 (OSX 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; format="flowed"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/qr6FC3U9jOPxpppVPHWBbhgiyNw>
Subject: Re: [DNSOP] New Version Notification for draft-wessels-dns-zone-digest-01.txt
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 29 Jul 2018 22:32:41 -0000

>> I realize that hypothetically a malicious server could send you a large
>> file of garbage. ...

> A lot of other updaters use HTTPS, which does not have this issue if
> the terminating party is also the source of the data. ...

Doesn't that assume that the other server will never be compromised?  I 
realize that trying to guess how the other end might do bad things is a 
rathole, which is why I don't want try to invent anything beyond what we 
already have for dealing with downloaded files.

It seems to me that the clever bit about ZONEMD is that it uses the 
existing DNSSEC keys so you don't have to invent a new key management 
scheme.

Regards,
John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

PS: I agree that a paragraph or two about other ways that people 
distribute zone files wouldn't hurt.

v2.23.0 | Report a Bug | By Email