Return-Path: X-Original-To: ietf@ietfa.amsl.com Delivered-To: ietf@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00181B2D64 for ; Mon, 13 Jul 2015 12:12:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b1crN44LlBNY for ; Mon, 13 Jul 2015 12:12:33 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0130.outbound.protection.outlook.com [207.46.100.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 241701B2D8A for ; Mon, 13 Jul 2015 12:11:59 -0700 (PDT) Received: from DM2PR0301MB0655.namprd03.prod.outlook.com (10.160.96.17) by DM2PR0301MB0654.namprd03.prod.outlook.com (10.160.96.16) with Microsoft SMTP Server (TLS) id 15.1.207.19; Mon, 13 Jul 2015 19:11:31 +0000 Received: from DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) by DM2PR0301MB0655.namprd03.prod.outlook.com ([10.160.96.17]) with mapi id 15.01.0207.004; Mon, 13 Jul 2015 19:11:31 +0000 From: Christian Huitema To: "ietf@ietf.org" Subject: RE: Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13 Thread-Topic: Gen-ART and OPS-Dir review of draft-wkumari-dhc-capport-13 Thread-Index: AQHQvZrOio2GMoXGj0KV+1V72uLabJ3ZvV0AgAAGDIA= Date: Mon, 13 Jul 2015 19:11:30 +0000 Message-ID: References: <55A2B3EE.9030406@nominum.com> <55A2D520.60907@nominum.com> <55A3F2B1.7020708@nominum.com> <55A402E5.5080003@nominum.com> <20150713184637.GP28047@mournblade.imrryr.org> In-Reply-To: <20150713184637.GP28047@mournblade.imrryr.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: ietf.org; dkim=none (message not signed) header.d=none; x-originating-ip: [131.107.160.254] x-microsoft-exchange-diagnostics: 1; DM2PR0301MB0654; 5:2RsW8Nv9+N5miXj3NFStnN6zW9AWat5nWGvJ8eQWYcho35DNEHH4rR3AfUNud8f0IQ0uh7+IfU0i81G6mUhs/3KzA9vcI+7aXTjgdk7Ve05vBNuh2TmwnX/d8/dKYu5250cYQ3mbXy3r0KBs2YMpPQ==; 24:Cj0/fQBq15MQMJ7+6ICMM+baDdlcvQ5RA7HrdyNOCHM0w4ZkFxiTW+STEe8BOy9CvWh6KWRpuGczIzjI+/VqwxtPBy8ebexLsdwqRqzRHU0=; 20:VgUuTNYYqiUxn7NaVOtebbVxq2l224+6wuuwWI8gBWaX1egsDYoWoZHqqpZTy6mXIbFT31RV14qgvMoNNuwMeA== x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DM2PR0301MB0654; x-o365ent-eop-header: Message processed by - O365_ENT: Allow from ranges (Engineering ONLY) x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401001)(5005006)(3002001); SRVR:DM2PR0301MB0654; BCL:0; PCL:0; RULEID:; SRVR:DM2PR0301MB0654; x-forefront-prvs: 0636271852 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(24454002)(377454003)(51704005)(106116001)(93886004)(77096005)(86362001)(50986999)(87936001)(54356999)(5003600100002)(2656002)(76176999)(122556002)(40100003)(2501003)(77156002)(62966003)(74316001)(110136002)(92566002)(76576001)(230783001)(107886002)(5001960100002)(66066001)(2950100001)(2900100001)(2351001)(46102003)(33656002)(86612001)(5002640100001)(189998001)(102836002)(450100001); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR0301MB0654; H:DM2PR0301MB0655.namprd03.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Jul 2015 19:11:30.7631 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0301MB0654 Archived-At: X-BeenThere: ietf@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IETF-Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Jul 2015 19:12:35 -0000 On Monday, July 13, 2015 11:47 AM, Viktor Dukhovni wrote=20 > On Mon, Jul 13, 2015 at 02:36:18PM -0400, Sam Hartman wrote: >=20 > > I have never been convinced that DNSsec validation of A or AAAA > > records has value. I understand I am a heretic in the security > > community for saying that, but there it is. >=20 > I'm inclined to agree that the value is marginal. > > ... > > Forging IP address records in DNS is rather tamper-evident. It is far mo= re > attractive to attack BGP, and MiTM or just monitor the traffic transparen= tly. Consider the use case. The hot spot controls the default router, and often = implements a NAT. They can decide to terminate the A or AAAA address wherev= er they please. The value of ensuring proper name to address resolution is = indeed marginal. -- Christian Huitema