Re: [DNSOP] DNS-in-JSON draft

"Paul Hoffman" <paul.hoffman@vpnc.org> Wed, 21 September 2016 18:39 UTC

Return-Path: <paul.hoffman@vpnc.org>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3FBC12B29D for <dnsop@ietfa.amsl.com>; Wed, 21 Sep 2016 11:39:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AMEXNeT_gZhF for <dnsop@ietfa.amsl.com>; Wed, 21 Sep 2016 11:39:46 -0700 (PDT)
Received: from mail.proper.com (Opus1.Proper.COM [207.182.41.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4E79812B138 for <dnsop@ietf.org>; Wed, 21 Sep 2016 11:39:46 -0700 (PDT)
Received: from [10.32.60.158] (50-1-99-230.dsl.dynamic.fusionbroadband.com [50.1.99.230]) (authenticated bits=0) by mail.proper.com (8.15.2/8.14.9) with ESMTPSA id u8LIdabo032991 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 21 Sep 2016 11:39:37 -0700 (MST) (envelope-from paul.hoffman@vpnc.org)
X-Authentication-Warning: mail.proper.com: Host 50-1-99-230.dsl.dynamic.fusionbroadband.com [50.1.99.230] claimed to be [10.32.60.158]
From: "Paul Hoffman" <paul.hoffman@vpnc.org>
To: "Jerry =?utf-8?q?Lundstr=C3=B6m?=" <jerry@dns-oarc.net>
Date: Wed, 21 Sep 2016 11:39:36 -0700
Message-ID: <4A606789-16AF-40B6-A91D-DCC6204871E6@vpnc.org>
In-Reply-To: <404afaa4-757a-b41b-fc11-384a0716d9f2@dns-oarc.net>
References: <DB336274-A631-471E-8277-D6690A87C834@vpnc.org> <e0aded33-9026-9b58-931b-a7549f25cc75@dns-oarc.net> <6239FBFC-7EB2-449C-BBA7-D0EAE0BF25D5@vpnc.org> <404afaa4-757a-b41b-fc11-384a0716d9f2@dns-oarc.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Mailer: MailMate (1.9.5r5263)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/soLFDcRlXivWqfJPqifc-lJ1A7Q>
Cc: dnsop WG <dnsop@ietf.org>
Subject: Re: [DNSOP] DNS-in-JSON draft
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Sep 2016 18:39:48 -0000

On 5 Sep 2016, at 23:26, Jerry Lundström wrote:

> Hi Paul,
>
> On 09/05/16 17:40, Paul Hoffman wrote:
>> On 5 Sep 2016, at 1:42, Jerry Lundström wrote:
>>
>>> - Non-ASCII octets escaping "\DDD" may lead to broken 
>>> implementations
>>> and/or encoding problem (oh so many printf()'ed JSON implementations 
>>> out
>>> there)
>>
>> Sure, but I'm not sure what to do about this. It's not really a 
>> security
>> consideration, and it's not really even about this format: that's 
>> true
>> for any application that gets a host name in return to a PTR query, 
>> yes?
>
> I was more commenting on the fact that it is escaping in a format that
> already support escaping. The JSON output would be double escaped and
> implementations would need to unescape it themselves rather then let
> JSON handle it.

Got it. I'l add a new bit to the Security Considerations about 
double-escaping.

>
>>> - The use of "!" and "*" in object attribute names will make it hard 
>>> to
>>> use in language that can read JSON and give out native objects such 
>>> as
>>> JavaScript.
>>
>> Yeah, I thought about that: it sucks for most programming languages.
>> Would people be happier if I used "B64" and "HEX" for trailers of 
>> names
>> instead of "!" and "*"? I guess I'm in control of the naming and can 
>> be
>> sure those don't appear at the end of object names.
>
> That would be better yes but it also got me thinking, why two 
> different
> ways of encoding it?
>
> Could be simplified by just using base64url (or base64).

I think I'll go with B64 and HEX. The reason for two encodings is that 
hand-editing
HEX is definitely easier than Base64, but DNSSEC keys are often 
expressed as
Base64.

--Paul Hoffman