IETF Logo Mail Archive

[DNSOP] DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08

"Hollenbeck, Scott" <shollenbeck@verisign.com> Wed, 11 March 2020 18:20 UTC

Return-Path: <shollenbeck@verisign.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CE883A10D2 for <dnsop@ietfa.amsl.com>; Wed, 11 Mar 2020 11:20:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bd1mS5Vnce8E for <dnsop@ietfa.amsl.com>; Wed, 11 Mar 2020 11:20:58 -0700 (PDT)
Received: from mail5.verisign.com (mail5.verisign.com [69.58.187.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23DF13A10C2 for <dnsop@ietf.org>; Wed, 11 Mar 2020 11:20:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=1112; q=dns/txt; s=VRSN; t=1583950854; h=from:to:cc:subject:date:message-id: content-transfer-encoding:mime-version; bh=DVNSeichyRams9WzfFcojySZ3LroqtZQM9bMCf7NYgc=; b=VGv/yzW9TiBQCJ5n6/U1VQFY4CPMt05rjHde/i9El2stHSdiVi/C2/Bp 0AhWEgVe35DiGXNGK+4H7LiiylQhIBZS7uTR6ScTinbtG0UtlKOqSos+h NyHfUlKbCCue9d7wxW/BU7OT+bckzCF+B4kHvszIgyMK6SzLajtOI2qtx H33JgchX2qdzZ5oUrHk9a2k8285uVwluAodHMuV9b2ujleWSeTvyok0CY S56d5MAwX21Y95L6UlQt1+UGY+NDnk7cySFWMRQ1mVVU5DaLWuEcVo6ET Ukv4rS6QeU2nkQeADhZfMgfRLnu6niMQBNnLXyKeYh8lJ4kWpRSbKQ2Oh A==;
IronPort-SDR: XqDHq5CUsqCUwSkUoqxEHjJDvqakwu2s37vVjhHuMUZIcH2hMLBxy2Tg1b8U4I1z3Hx9wbdH7t sMJJbulsayzQkts14T+OhkstMmrt61ZZrjUyJ3aztEHns8F8wpNtKlLm7j9hDdpRmRGS8tPycG lKRQ1fnXyyWe72esCUS+OSBobVN56ROPJe/dTlVnCh8U5enhRvQu/wHcJUDBHEFwoC2pxRZIdt lubPZCs5K/zDxRlVm96mlB6GgBawjWFL1yGRNruN4DtuRKeW3Wz11dVr4fHz6QyEvfoe1yv5GK G9k=
X-IronPort-AV: E=Sophos;i="5.70,541,1574139600"; d="scan'208";a="850936"
IronPort-PHdr: 9a23:12T69RJTHZroJfJn2dmcpTZWNBhigK39O0sv0rFitYgXKv/5rarrMEGX3/hxlliBBdydt6sYzbOM6eu5ADRIyK3CmU5BWaQEbwUCh8QSkl5oK+++Imq/EsTXaTcnFt9JTl5v8iLzG0FUHMHjew+a+SXqvnYdFRrlKAV6OPn+FJLMgMSrzeCy/IDYbxlViDanbr5+MRq7oR/MusUIn4duJbs9xgbVrnBVZ+lY2GRkKE6ckBr7+sq+5oNo/T5Ku/Im+c5AUKH6cLo9QLdFEjkoMH076dPyuxXbQgSB+nUTUmMNkhpVGAfF9w31Xo3wsiThqOVw3jSRMNDsQrA1XTSi6LprSAPthSwaOTM17H3bh8pth61VuhKhowF0zZDSbo+bKfFyerrRcc4GSWZEWMtaSi5PDZ6mb4YXD+QPI/tWr5XzqVUNrBuxGQaiC+z0xz9Un3/237E23/g9HQ3Y2gErAtIAsG7TrNXwLKoeX+K7zK7MzTXHcfxW3yzy55bUfRAiuf2HQK9+ftbWyUkzCwPJgEibpIv+PzOV0eQNt2yb4PRmVe20lWEotwJxryOxxsgykInJh5kVylHL9SV/2oo6Odq4SEtibNOiDZBeuSaaN45sTcMjRWFloDs6yqYftZGnYicK0ognywTQa/yAbYiF5A/oWuWJITpgmX5pZKiziwuw/EWu0OHwS8m53VhQoidKltTArm0B2wDJ5sSaSPZx4l2t1SuA2g3Q8O1IPEM5mbLVK5E/wbM8ip8evEHBEyDqhEn5lqqbelg49ee07unqYqjpqYGSN4JxjgzxL7khldK5DO8lKAYBRXKb9v651LD7+E35R6hFgeMun6nCtZDaOdwbpqmkAw9Jyooj6wiwDzOh0NkAgHQJMEpLdA+HgIbxNF/BIez0Aemlj1SyjDhrwOrGPqX7DprXM3fPiqnhfaxm605a0gY80ddf55dMBrEAJvL8RFPxucTFAhMlKQC43uTqBdtn2o8DWW+CDLWVPazWvFOQ4+IgOeiMZIsbuDbnLPgl4ubjjWQ5mV8aeamp2YUYaHajEft4P0qZYmHhgskfHmcQvwo+V+3qiFKEUTJJe3myWKc86ikhCI26FYfDWpytgLuZ0Se/H51WYH1JBUqWHXj1aoWEXewDZziIIsJ6nDwESKShS5I71R6wug711btnIvDI9S0fsJLpzMJ16PHLlREu6Tx0CNyQ3HyLT2FvmWMIXyQ73KFhrkxhxFePy694g+ZXFY8b2/QcGAM7M5LVieBnDdr7QCrPY8uUUlu5T9TgCjY0BJplx94Ib087F8ikhBnZ9yS3H6IPmqOGBdo/9aeKjFbrIMMogVbB0K0siVMrScgLfVatgbJjvUCHHI7Ol0GUkaynfqc0wiPX9XyCwmzIt0ZdBl0jGZ7ZVGwSMxOF5e/y4VnPGvr3Ubk=
X-IPAS-Result: A2HvAwAnK2le/zGZrQpmHQEBAQkBEQUFAYF7gxWBO7AhPAkBAQEBAQEBAQEHARMQDAQBAQKEQYI0OBMCAwEBCwEBAQUBAQEBAQUDAQEBAoY/AQuCOylvODkBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQ8CH1Q3AV8/EgE+QiYBBA4Ngx+DCqxOhDUBgRSFBQaBOIxGgUI+gRGGNgGHVQSWfpkwAweCPJZjJZs6hGSKGJg/gxUCBAIEBQIVgWmBe3BQgm1PGA2UD4hWjkKBEAEB
Received: from BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1779.2; Wed, 11 Mar 2020 14:19:24 -0400
Received: from BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde]) by BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde%4]) with mapi id 15.01.1779.002; Wed, 11 Mar 2020 14:19:24 -0400
From: "Hollenbeck, Scott" <shollenbeck@verisign.com>
To: "linda.dunbar@futurewei.com" <linda.dunbar@futurewei.com>
CC: "dnsop@ietf.org" <dnsop@ietf.org>
Thread-Topic: DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08
Thread-Index: AdX30T1GApKjttEGSSWK9TMIh4Qhbw==
Date: Wed, 11 Mar 2020 18:19:24 +0000
Message-ID: <a88c3dbefb2346239a4be8c11f37695f@verisign.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.170.148.18]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/vMMLhvkKo9TFe4vw2_OlrQ8TLXQ>
Subject: [DNSOP] DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Mar 2020 18:21:00 -0000

(Sorry, this is a late response to a review request original sent to the dnsop list on 11 February)

Section 3.4 (DNS for Cloud Resources) includes these sentences:

"Globally unique names do prevent any possibility of collision at the present or in the future and they make DNSSEC trust manageable. It's not as if there is or even could be some sort of shortage in available names that can be used, especially when subdomains and the ability to delegate administrative boundaries are considered."

Could we make the last sentence stronger, perhaps with a statement like this from the US CERT WPAD Name Collision Vulnerability alert dated May 23, 2016?

"Globally unique names do prevent any possibility of collision at the present or in the future and they make DNSSEC trust manageable. Consider using a registered and fully qualified domain name (FQDN) from global DNS as the root for enterprise and other internal namespaces."

https://www.us-cert.gov/ncas/alerts/TA16-144A

The alert actually says "other internal namespace", but I think that's a typo.

Scott

v2.23.0 | Report a Bug | By Email