Re: [homenet] review of draft-ietf-homenet-redact and draft-ietf-homenet-dot

> On Mar 12, 2017, at 9:59 AM, Andrew Sullivan <ajs@anvilwalrusden.com> wrote:
> 
> Hi,
> 
> On Sun, Mar 12, 2017 at 01:17:28PM +0100, Jari Arkko wrote:
> 
> [...]
>> Also, the insecure delegation in the root zone puts us into a
>> place where we have not been before, process-wise, because
>> this is a special use domain name and a proper TLD at the same
>> time, causing us to run both the ICANN and the IETF process,
> 
> As long as we understand "run the ICANN process" as including "getting
> ICANN to invent such a process", I agree with the above.

I agree with Andrew and think we need to consider this step quite carefully.  This text in the IANA considerations section:

   IANA is requested to set up insecure delegation for '.homenet' in the
   root zone pointing to the AS112 service [RFC7535], to break the
   DNSSEC chain of trust.

does not explain that there is no process through which IANA can set up that delegation.  It may not even be an IANA process.  If this text were to be published in an RFC, I don't think IANA can carry out that instruction today, and I don't think IANA has the authority to negotiate a process through which it can carry out the instruction in the future.

I think this text should be modified in some way, before the document is published, to recognize explicitly that no such process exists today and that such a process is requested as part of the implementation of the published document.

The homenet WG is, I believe, aware of the need for a process for instantiating an insecure delegation as requested in the -dot document.  In my opinion, the implicit request for such a process should be made explicit in some way.

- Ralph

> 
>> If we categorise .homenet as special, I don’t understand
>> why we need an insecure delegation. Software (e.g.,
>> local resolver) would *know* this is a special name
>> and it would never be the case that .homenet suddenly
>> turns into a delegated secure regular domain which needs
>> the chain of trust from the root. What gives?
> 
> Which "local resolver" do you mean?  There could be more than one, and
> it's not only resolvers.  You could do validation without doing
> resolution.  Basically, to get homenet without the provably insecure
> delegation, you need to give up on validation or you have to accept
> that homenet techniques won't work until everything has been upgraded.
> (I suppose that, since we're assuming v6, we might be waiting for that
> anyway ;-) )
> 
> Best regards,
> 
> A
> 
> -- 
> Andrew Sullivan
> ajs@anvilwalrusden.com
> 
> _______________________________________________
> homenet mailing list
> homenet@ietf.org
> https://www.ietf.org/mailman/listinfo/homenet