IETF Logo Mail Archive

Re: [secdir] secdir review of draft-ietf-homenet-arch-10

Ray Bellis <Ray.Bellis@nominet.org.uk> Wed, 11 September 2013 08:33 UTC

Return-Path: <Ray.Bellis@nominet.org.uk>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C010A11E8162; Wed, 11 Sep 2013 01:33:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -10.599
X-Spam-Level:
X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ImcRr9hMR-Ic; Wed, 11 Sep 2013 01:33:13 -0700 (PDT)
Received: from mx1.nominet.org.uk (mail.nominet.org.uk [213.248.242.48]) by ietfa.amsl.com (Postfix) with ESMTP id 9C38C11E81EC; Wed, 11 Sep 2013 01:33:07 -0700 (PDT)
DomainKey-Signature: s=main.dk.nominet.selector; d=nominet.org.uk; c=nofws; q=dns; h=X-IronPort-AV:Received:Received:From:To:CC:Subject: Thread-Topic:Thread-Index:Date:Message-ID:References: In-Reply-To:Accept-Language:Content-Language: X-MS-Has-Attach:X-MS-TNEF-Correlator:x-originating-ip: Content-Type:Content-ID:Content-Transfer-Encoding: MIME-Version; b=p9yqRfxyM9tRzLPZqVSYnsp9ebIYCP1xh1mHFJ2hY/dwq7vM7Osl8ifY Ol1rrZiD0FPYmfynQ/BspLCCAzVmt+XuvdpazL4ICs1yfzd846BRCAxds sb0+Wa9hTUOAPCB;
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nominet.org.uk; i=@nominet.org.uk; q=dns/txt; s=main.dkim.nominet.selector; t=1378888388; x=1410424388; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=+16kQriOhfRcP5WoPA5GIs0f4sM0EC2WNeLK4K2UuNc=; b=k9SYyAAbYlbR6IXvvPzt/5aVehKaNJce4RDvEnG0wy8ELjBuZRVoMgGe +yBDANmgFrs51KNMX5dm3RlEdPBCADvTIUuZeVN2aaSu02NaxyR3JwWdW pUYyp+1A903qxgC;
X-IronPort-AV: E=Sophos;i="4.90,883,1371078000"; d="scan'208";a="3287016"
Received: from wds-exc2.okna.nominet.org.uk ([213.248.197.145]) by mx1.nominet.org.uk with ESMTP; 11 Sep 2013 09:33:02 +0100
Received: from WDS-EXC1.okna.nominet.org.uk ([fe80::1593:1394:a91f:8f5f]) by wds-exc2.okna.nominet.org.uk ([fe80::7577:eaca:5241:25d4%17]) with mapi id 14.02.0318.004; Wed, 11 Sep 2013 09:33:01 +0100
From: Ray Bellis <Ray.Bellis@nominet.org.uk>
To: Samuel Weiler <weiler@watson.org>
Thread-Topic: secdir review of draft-ietf-homenet-arch-10
Thread-Index: AQHOrpowneGtTVadlEOUAKAd3eCKbZnAG/gAgAAJHAA=
Date: Wed, 11 Sep 2013 08:33:00 +0000
Message-ID: <53F00E5CD8B2E34C81C0C89EB0B4FE732DE90676@wds-exc1.okna.nominet.org.uk>
References: <alpine.BSF.2.00.1309051037400.86627@fledge.watson.org> <F432C9E2-B19A-452B-89A7-5C47FD4C4EC4@townsley.net>
In-Reply-To: <F432C9E2-B19A-452B-89A7-5C47FD4C4EC4@townsley.net>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.168.2.1]
Content-Type: text/plain; charset="us-ascii"
Content-ID: <6599B12216C8E046909015FFDC7FC3A4@okna.nominet.org.uk>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailman-Approved-At: Wed, 11 Sep 2013 02:30:05 -0700
Cc: "iesg@ietf.org" <iesg@ietf.org>, "draft-ietf-homenet-arch.all@tools.ietf.org" <draft-ietf-homenet-arch.all@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] secdir review of draft-ietf-homenet-arch-10
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 11 Sep 2013 08:33:19 -0000

Sam,

Following on from Mark's comments:

> -- "When DNS is used as the homenet name service, it includes both a
>  resolving service and an authoritative service."  Does it
>  necessarily?

A Homenet that is not currently connected to the Internet still needs to be able to function, so (when DNS is used) authoritative local name service and a service for resolution of those local names are both needed.

> -- "The name space(s) should be served authoritatively by the
>  homenet..."   Why is that necessary?  (Indeed, there is text in
>  3.7.4 that seems to conflict with this.)

One reason is simply to prevent names only intended to be known internally from being shared with externally maintained authoritative servers.

The other is the "disconnected homenet" mentioned above.

Can you please indicate which text you believe is in conflict?

> -- There is a recommendation to support DNSSEC on the authoritative
>  server side (in 3.7.4).  Shouldn't there be a similar
>  recommendation on the resolver side?

That (short) paragraph is not specific to authoritative servers, it applies to the entire section.  The example of cache-poisoning further indicates its applicability to recursive resolution.

kind regards,

Ray

v2.23.0 | Report a Bug | By Email