Re: [Last-Call] [DNSOP] Secdir last call review of draft-ietf-dnsop-server-cookies-04
Stephen Farrell <stephen.farrell@cs.tcd.ie> Wed, 02 December 2020 20:38 UTC
Return-Path: <stephen.farrell@cs.tcd.ie>
X-Original-To: last-call@ietfa.amsl.com
Delivered-To: last-call@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 961DC3A1491; Wed, 2 Dec 2020 12:38:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, NICE_REPLY_A=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6PzJFUuTZmtp; Wed, 2 Dec 2020 12:38:08 -0800 (PST)
Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2FF1F3A148B; Wed, 2 Dec 2020 12:38:07 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 3C353BE1C; Wed, 2 Dec 2020 20:38:04 +0000 (GMT)
X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie
Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 15sMEhRQMRsA; Wed, 2 Dec 2020 20:37:59 +0000 (GMT)
Received: from [10.244.2.119] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 94984BE20; Wed, 2 Dec 2020 20:37:59 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1606941479; bh=hQw1N4hW+6YTWGjt2fzTyaLMn17aB1ADz27S1cxB+/c=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=ObmL36bLlCjGNLFMlh0b67Ve7LlQGUrOeeAfhO7pc6sTvkYbFeOrRUC2Y4QlXf5Gx 2HMRn/rhF3CgrTwaMgAI1sYAUkFP/1JS8gKZga+oskQ/Zf9tLesWRCTrQmVrvw/M0L wZbsFFuIvMPMK7CfDo7oRTeYWAB3DPZFOXiTA1p4=
To: Ondřej Surý <ondrej@isc.org>
Cc: last-call@ietf.org, draft-ietf-dnsop-server-cookies.all@ietf.org, dnsop@ietf.org, secdir@ietf.org
References: <160693121881.9413.5642470305677631145@ietfa.amsl.com> <17AFD6F5-11DA-41BC-8C37-E1893648041D@isc.org>
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Message-ID: <75c266ba-573a-29e3-621d-aea9b27f195f@cs.tcd.ie>
Date: Wed, 02 Dec 2020 20:37:57 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.5.0
MIME-Version: 1.0
In-Reply-To: <17AFD6F5-11DA-41BC-8C37-E1893648041D@isc.org>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="y37CmToVLBK4ueKrOXn6fvra4AbAVdNT5"
Archived-At: <https://mailarchive.ietf.org/arch/msg/last-call/7yqJ_Yd6r_IKE8qL2y6ehrN2lKM>
Subject: Re: [Last-Call] [DNSOP] Secdir last call review of draft-ietf-dnsop-server-cookies-04
X-BeenThere: last-call@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF Last Calls <last-call.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/last-call>, <mailto:last-call-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/last-call/>
List-Post: <mailto:last-call@ietf.org>
List-Help: <mailto:last-call-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/last-call>, <mailto:last-call-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Dec 2020 20:38:11 -0000
Hiya, On 02/12/2020 18:25, Ondřej Surý wrote: > Stephen, > > ad 1) the performance is crucial for DNS over UDP and PRF such as > SipHash is more efficient than HMACs. No, it wasn’t consulted with > CFRG, and I can’t speak for Willem, but I am confident enough to make > the decision. SipHash is widely used for hash tables virtually > anywhere now. The text says that you need a MAC though. Personally, I think it'd be wiser to (double-)check before using novel crypto even if the only novelty is use in a standards track RFC. > > ad 2) we need a value that’s synchronized well enough and monotonic. > I honestly don’t see any value in using 64-bit value here. Using > unixtime has a value in itself, it’s a well-known and there’s a > little room for any implementor to make a mistake in an > implementation. The interoperability is more important than the > actual value of the counter. It’s write only counter, nobody is going > to interpret it after it has been generated, and it’s wide enough to > prevent brute forcing. So what happens after 2038? That's really not v. far in the future any more. Cheers, S. > > Cheers, Ondřej -- Ondřej Surý — ISC (He/Him) > >> On 2. 12. 2020, at 18:47, Stephen Farrell via Datatracker >> <noreply@ietf.org> wrote: >> >> Reviewer: Stephen Farrell Review result: Has Issues >> >> I see two issues here worth checking: >> >> 1. I don't recall SipHash being used as a MAC in any IETF standard >> before. We normally use HMAC, even if truncated. Why make this >> change and was that checked with e.g. CFRG? (And the URL given in >> the reference gets me a 404.) >> >> 2. Is it really a good idea to use a 32 bit seconds since >> 1970-01-01 in 2020? I'd have thought that e.g. a timestamp in hours >> since then or seconds since some date in 2020 would be better. >> >> Here's a couple of nits too: - section 1: what's a "strong >> cookie"? - "gallimaufry" - cute! but not sure it'll help readers to >> learn that word. >> >> >> >> > > _______________________________________________ DNSOP mailing list > DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop >
- [Last-Call] Secdir last call review of draft-ietf… Stephen Farrell via Datatracker
- Re: [Last-Call] Secdir last call review of draft-… Ondřej Surý
- Re: [Last-Call] [DNSOP] Secdir last call review o… Stephen Farrell
- Re: [Last-Call] [secdir] Secdir last call review … Eric Rescorla
- Re: [Last-Call] [DNSOP] Secdir last call review o… Willem Toorop
- Re: [Last-Call] [DNSOP] Secdir last call review o… Stephen Farrell
- Re: [Last-Call] [DNSOP] Secdir last call review o… Willem Toorop
- Re: [Last-Call] [secdir] Secdir last call review … Ondřej Surý
- Re: [Last-Call] [DNSOP] Secdir last call review o… Brian Dickson
- Re: [Last-Call] [DNSOP] Secdir last call review o… Stephen Farrell
- Re: [Last-Call] [DNSOP] Secdir last call review o… Willem Toorop
- Re: [Last-Call] [DNSOP] Secdir last call review o… Eric Rescorla
- Re: [Last-Call] [DNSOP] Secdir last call review o… Salz, Rich
- Re: [Last-Call] [DNSOP] Secdir last call review o… Eric Rescorla
- Re: [Last-Call] [secdir] Secdir last call review … Benjamin Kaduk
- Re: [Last-Call] [secdir] Secdir last call review … Ondřej Surý
- Re: [Last-Call] [DNSOP] [secdir] Secdir last call… Brian Dickson
- Re: [Last-Call] [DNSOP] [secdir] Secdir last call… Salz, Rich
- Re: [Last-Call] [secdir] Secdir last call review … Salz, Rich
- Re: [Last-Call] [DNSOP] [secdir] Secdir last call… Stephen Farrell
- Re: [Last-Call] [DNSOP] [secdir] Secdir last call… Eric Rescorla
- Re: [Last-Call] [secdir] Secdir last call review … Benjamin Kaduk
- Re: [Last-Call] [DNSOP] [secdir] Secdir last call… Stephen Farrell