Re: [homenet] Adam Roach's No Objection on draft-ietf-homenet-dot-12: (with COMMENT)

[Ted Lemon <[e-mail]>]

Argh, I spaced out on doing these changes because the security review was so extensive.   Sorry about that.   I'm making changes to my version of the document, but I will refrain from further confusing the datatracker—assuming that this document is approved tomorrow, I can submit an update with these changes and any others that come up on the telechat.

> On Aug 28, 2017, at 11:18 PM, Adam Roach <[e-mail]> wrote:
> Oh! That makes a lot more sense -- I should have chased down that section in 6761. I think what's tripping me up is the introduction in the homenet-dot draft: "This section defines the behavior of systems involved in domain name resolution when resolving queries for names ending with '.home.arpa.' (as per [RFC6761])." -- it would be clearer if it said something more like "This section reserves the '.home.arpa.' subdomain according to the procedures outlined in [RFC6761] section 4."

The requirement to put this in the IANA considerations section is actually probably a bad idea, because it would create a lot of irrelevant chaff for the IANA to parse through.   I think it was well-intended, but I've never actually seen it done this way in previous RFC 6761 allocations.   That said, your basic point is correct—there should be a better explanation of what's going on in this section.   I've updated the introductory text for this section as follows:

	This section specifies considerations for systems involved in domain name resolution
	when resolving queries for names ending with '.home.arpa.'.  Each items in this section
	addresses some aspect of the DNS or the process of resolving domain names that would be
	affected by this special use allocation.  Detailed explanations of these items can be
	found in <xref target="RFC6761"/>, Section 5.


>>> With the explanation in section 6:
>>> 
>>>   it may be useful for the resolver to identify different
>>>   homenets on which it has resolved names
>>> 
>>> Doesn't this mitigation in the security section require name resolution
>>> libraries to recognize names that end in ".home.arpa." as special so that it
>>> can treat them differently?
>> 
>> Section 6 is talking about future work.   If we come up with a way to do this, then it would update this document, changing the normative requirement.
> 
> To me, this reads as something that could be done unilaterally by the local resolver according to their own reasonable notion of what the proper mitigations might be here. I would suggest rephrasing to make it clearer that this suggestion pertains to _future_ work; e.g., "To prevent this from happening, future documents may define behavior that allows resolvers to identify and distinguish among different homenets on which they have resolved names, and take appropriate measures to avoid such confusion."
> 
> 
Yup, that makes sense.   Proposed update:

	  To prevent this from happening, it could be useful for the resolver to securely
	  differentiate between different homenets, and between identical names on different
	  homenets.  However, a mechanism for doing this has not yet been standardized, and
	  doing so is out of scope for this document.  It is expected that this will be explored in
	  future work.

OK?