MIME-Version: 1.0
In-Reply-To: <CAHPuVdUmPPFY2rxq0cdtwGaoDJ0Bkdt1PFsQmVm3Et5n9cU_Uw@mail.gmail.com>
References: <151802776446.4849.12008167318274714913.idtracker@ietfa.amsl.com>
 <CAHPuVdUmPPFY2rxq0cdtwGaoDJ0Bkdt1PFsQmVm3Et5n9cU_Uw@mail.gmail.com>
From: Shumon Huque <shuque@gmail.com>
Date: Wed, 21 Feb 2018 11:06:49 -0500
Message-ID: <CAHPuVdXF1j83r_4zRWc6pR7jB8LO9BWgj6KZv9FS52Fb+jj+8w@mail.gmail.com>
To: Alexey Melnikov <aamelnikov@fastmail.fm>
Cc: The IESG <iesg@ietf.org>, draft-ietf-tls-dnssec-chain-extension@ietf.org, 
 Joseph Salowey <joe@salowey.net>, tls-chairs <tls-chairs@ietf.org>,
 TLS WG <tls@ietf.org>
Content-Type: multipart/alternative; boundary="001a1140a7445f6a860565bb1d3a"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/4FYSR54xIifeENt8wPiqcx0blPQ>
Subject: Re: [TLS] Alexey Melnikov's Discuss on
 draft-ietf-tls-dnssec-chain-extension-06: (with DISCUSS and COMMENT)
Precedence: list

--001a1140a7445f6a860565bb1d3a
Content-Type: text/plain; charset="UTF-8"

On Wed, Feb 7, 2018 at 9:05 PM, Shumon Huque <shuque@gmail.com> wrote:

> On Wed, Feb 7, 2018 at 1:22 PM, Alexey Melnikov <aamelnikov@fastmail.fm>
> wrote:
>
>> Alexey Melnikov has entered the following ballot position for
>> draft-ietf-tls-dnssec-chain-extension-06: Discuss
>>
>> ----------------------------------------------------------------------
>> DISCUSS:
>> ----------------------------------------------------------------------
>>
>> I think this is a useful document and I will ballot Yes once my small
>> issues are resolved:
>>
>> 1) In 3.4:
>>
>>    The first RRset in the chain MUST contain the TLSA record set being
>>    presented.  However, if the owner name of the TLSA record set is an
>>    alias (CNAME or DNAME), then it MUST be preceded by the chain of
>>    alias records needed to resolve it.  DNAME chains should omit
>>
>> SHOULD? What are the implications if this is not followed?
>>
>
> Ok. I guess we need the upper case word here, yes.
>
> Implication: If the synthesized CNAME records are included in the chain
> then the client will have to ignore them (they aren't signed and thus
> can't be
> validated) - the signed DNAME record is sufficient for the client to
> securely
> validate the mapping and continue processing.
>
> It might make things simpler to just make this a MUST. I would guess this
> would not raise any objections from the working group.
>

A quick follow-up on this. I think we just keep this as a SHOULD. I looked
at what an existing DNS library implementation does, and it includes the
synthesized CNAME. It's easy enough for the client to just ignore it when
validating the chain.

Shumon.

--001a1140a7445f6a860565bb1d3a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On W=
ed, Feb 7, 2018 at 9:05 PM, Shumon Huque <span dir=3D"ltr">&lt;<a href=3D"m=
ailto:shuque@gmail.com" target=3D"_blank">shuque@gmail.com</a>&gt;</span> w=
rote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;borde=
r-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmai=
l_extra"><div class=3D"gmail_quote"><span class=3D"">On Wed, Feb 7, 2018 at=
 1:22 PM, Alexey Melnikov <span dir=3D"ltr">&lt;<a href=3D"mailto:aamelniko=
v@fastmail.fm" target=3D"_blank">aamelnikov@fastmail.fm</a>&gt;</span> wrot=
e:<br></span><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex"><span class=3D"">Alexey Melniko=
v has entered the following ballot position for<br>
draft-ietf-tls-dnssec-chain-ex<wbr>tension-06: Discuss<br><br></span><span =
class=3D"">
------------------------------<wbr>------------------------------<wbr>-----=
-----<br>
DISCUSS:<br>
------------------------------<wbr>------------------------------<wbr>-----=
-----<br>
<br>
I think this is a useful document and I will ballot Yes once my small issue=
s are resolved:<br>
<br>
1) In 3.4:<br>
<br>
=C2=A0 =C2=A0The first RRset in the chain MUST contain the TLSA record set =
being<br>
=C2=A0 =C2=A0presented.=C2=A0 However, if the owner name of the TLSA record=
 set is an<br>
=C2=A0 =C2=A0alias (CNAME or DNAME), then it MUST be preceded by the chain =
of<br>
=C2=A0 =C2=A0alias records needed to resolve it.=C2=A0 DNAME chains should =
omit<br>
<br>
SHOULD? What are the implications if this is not followed?<br></span></bloc=
kquote><div><br></div><div>Ok. I guess we need the upper case word here, ye=
s.</div><div><br></div><div>Implication: If the synthesized CNAME records a=
re included in the chain</div><div>then the client will have to ignore them=
 (they aren&#39;t signed and thus can&#39;t be=C2=A0</div><div>validated) -=
 the signed DNAME record is sufficient for the client to securely=C2=A0</di=
v><div>validate the mapping and continue processing.</div><div><br></div><d=
iv>It might make things simpler to just make this a MUST. I would guess thi=
s</div><div>would not raise any objections from the working group.</div></d=
iv></div></div></blockquote><div><br></div><div>A quick follow-up on this. =
I think we just keep this as a SHOULD. I looked</div><div>at what an existi=
ng DNS library implementation does, and it includes the</div><div>synthesiz=
ed CNAME. It&#39;s easy enough for the client to just ignore it when</div><=
div>validating the chain.</div><div><br></div><div>Shumon.</div><div><br></=
div></div></div></div>

--001a1140a7445f6a860565bb1d3a--