Re: [homenet] Paul Wouters' Discuss on draft-ietf-homenet-naming-architecture-dhc-options-21: (with DISCUSS)

Hi Paul,

Some brief element of response to your questions. While you are raising
comments within a DISCUSS see your comment as a very high level question on
what is the content of the draft with many questions related not to that
draft. I am happy to respond, but there is nothing actionable that can be
done, so please be more specific.

Yours,
Daniel

On Thu, Oct 20, 2022 at 1:58 AM Paul Wouters via Datatracker <
noreply@ietf.org> wrote:

> Paul Wouters has entered the following ballot position for
> draft-ietf-homenet-naming-architecture-dhc-options-21: Discuss
>
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
>
>
> Please refer to
> https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
> for more information about how to handle DISCUSS and COMMENT positions.
>
>
> The document, along with other ballot positions, can be found here:
>
> https://datatracker.ietf.org/doc/draft-ietf-homenet-naming-architecture-dhc-options/
>
>
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
>
> This might be my misunderstanding

of homenet, so hopefully easy to resolve.
>
> The HNA (hidden primary?) to DM (primary) DNS communication using DNS
> Update
> needs some kind of authentication, TSIG or SIG0 ?

no

> While TLS gives you privacy,
> the DNS Update cannot be done with only TLS (as far as I understand it).

please develop, but just in case, we do not use dns update to synchronize
the zone. we use AFXR/IXRF over TLS define din XoT.

> I
> don't see any DHCP options to relay authentication information for
> automatic
> deployment?

The FQDN "Distribution Manager FQDN" and "Reverse Distribution Manager FQDN"
are sufficent to set a TLS session.

So I don't understand how this would startup and be able to setup a
> secure DNS update channel ?
>

TLS needs only names. The certificates binds the names to a key used for
the authentication.

> There was also talk about using ACME for TLS certificates, but wouldn't
> that
> require that the HNA already has a provisioned and working homenet domain ?
>
The draft does not mention ACME so I do not see what you are referring to.

> (possibly more a question for the other draft, but just adding it here in
> case
> the hidden primary to primary is an "almost DNS Update" protocol that uses
> TLS
> instead f TSIG/SIG0.
>
> not at all. we do not use dns update at all for synchronizing the zones.

>
>
>
>
> _______________________________________________
> homenet mailing list
> homenet@ietf.org
> https://www.ietf.org/mailman/listinfo/homenet
>

-- 
Daniel Migault
Ericsson