Re: [secdir] Secdir Review of draft-ietf-hip-rfc5205-bis-08

[Julien Laganier <[e-mail]>]

Tina,

Happy new year, and thank you for reviewing the draft. My apologies
for the belated reply. Please find my answers to your comments inlined
below:

On Mon, Jan 4, 2016 at 10:29 AM, Tina TSOU <[e-mail]> wrote:
>
[...]
> ** Technical **
>
> * Section 8:
>
> You refer to IPSECKEY RR [RFC4025] to note some of the possible threats
> for HIP RRs. I think you should spell these out, and discuss them
> explicitly.

The intent was to provide an informative statement regarding the broad
similarity between threats applying to the IPSECKEY RR and threats
applying to the HIP RR. The remainder of the section does explicitly
discuss the threats pertaining to the HIP RR. I have clarified the
text such that the intent is communicated more clearly:

   In a manner similar to the IPSECKEY RR [RFC4025], the HIP DNS
   Extension allows for the provision of two HIP nodes with the public
   keying material (HI) of their peer.  These HIs will be subsequently
   used in a key exchange between the peers.  Hence, the HIP DNS
   Extension is subject, as the IPSECKEY RR, to threats stemming from
   attacks against unsecured HIP RRs, as described in the remainder of
   this section.

> ** Editorial **
>
> * Section 3, page 4:
>>  In the following, we assume that the Initiator first queries for HIP
>>  resource records at the Responder FQDN.
>
> s/at/for/

The use of "at" is consistent with the language found in RFC1035, e.g.:

   The first step a resolver takes is to transform the client's request,
   stated in a format suitable to the local OS, into a search specification
   for RRs _at_ a specific name which match a specific QTYPE and QCLASS.

Thus I believe no change need to be made.
> * Section 3, page 4:
>> and further queries for the same owner name SHOULD NOT be
>>  made.
>
> What's an "owner name"? Maybe this should be "domain name", instead?

As per RFC1035, a DNS RR is defined as containing a NAME which is
defined as "an owner name, i.e., the name of the node to which this
resource record pertains.", thus I believe no change need to be made.

> * Section 3, page 5:
>>  Note that storing HIP RR information in the DNS at an FQDN that is
>>  assigned to a non-HIP node might have ill effects on its reachability
>>  by HIP nodes.
>
> s/a/an/

If you're referring to the "a" in "a non-HIP node", I believe that
this is the correct spelling since the "non" syllable begins with a
consonant onset "n".

> * Section 4.2, page 9:
>> The RVS
>>  information may be copied and aligned across multiple RRs, or may be
>>  different for each one; a host MUST check that the RVS used is
>>  associated with the HI being used, when multiple choices are
>>  present."
>
> There's no matching quote sign for this one.

Good catch. I fixed that.

Thanks again for the review, and best regards.

--julien