Re: [mif] New Charter Items - NTP in RA for DNSSEC

[Alexandre Petrescu <[e-mail]>]

Le 02/03/2016 13:24, Margaret Cullen a écrit :
>
> At the last IETF meeting, and later on the mailing list, we reached consensus that we would use a two-step approach for the configuration of explicit PVDs.  RAs would be used to provide the information to do a second-step look up, including the PVD name.  Then a second step would be used to look up further information about the PVD.
>
> The only proposal we currently have on the table for a second-step look-up is a DNS look-up, and no one seems to proposing any other second step, so I believe there are three things that we need to define in order for this to work:
>
> - An NTP server option for RAs, so that DNSSEC can be used for the lookup.

Sounds like a good idea.

I guess DNSSEC operation needs the querier to have the right time 
otherwise it's insecure?  Hence the need for NTP?

I could find 2 earlier drafts on this, maybe there are others.
draft-chen-ntps-ra-opt-00
draft-bcd-6man-ntp-server-ra-opt-00

If extending RA then it's good to use the RA "flags option" RFC5075.

Alex


> - A PVD Name option for RAs, so that we can tell hosts what PVD to look up.
> - What PVD information can be stored in the DNS and how it will be retrieved.
>
> Those things would need to be added to our charter, so that we can accept corresponding work items.
>
> Does anyone have any objection to adding these three things to the MIF charter?  If not, the chairs and the AD will put together a propos
>
> _______________________________________________
> mif mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mif
>