[TLS] Comments on draft-ietf-tls-wkech-09

[Watson Ladd <[e-mail]>]

Dear TLS WG,

I've read the draft carefully, and I am afraid that I have a few
comments. These might be completely uninformed, but I hope they at
least point out places other people might have confusion,

The first comment is that while the draft talks a lot about HTTPS
records, it could also work for non-HTTP protocols via SVCB. The text
isn't entirely clear on this point one way or the other.

Secondly I'm not sure I understand the split mode example in the
draft. The zone being made is the backend.example.com zone, but the
data for that zone seems to come from the load balancer machine.
However, the load balancer machine has to know its own ECHConfig value
(after all the REAL backend took that data from there) plus all the
other relevant bits of the HTTPS record. Why does the REAL
backend.example.com need to compute any part of the HTTPS record? Once
that's computed, the zone builder talks to the client facing server to
put the DNS data on example.com. However it's talking to cf.lb.example
to get that DNS data.

I think it would make slightly more sense for the zone factory to talk
to the REAL backend and put that data in for example.com. This way
it's clear how the administrative ownership and flow of data are
aligned.

In Security Considerations I see "Similarly, a ZF that also has write
access to A/AAAA RRs for a backend, SHOULD NOT publish HTTPS RRs that
contain ipv4hints or ipv6hints that are in conflict with the correct
A/AAAA values unless those have been verified (via webPKI) as
belonging to the same backend". To my mind this is written
incorrectly: its not the backend that has the IP, but the hostname
we'd like to resolve consistently.

And that brings me to another point: the processing done by the
backend in creating this file in split mode is rather underspecified.
It should just be copying the correct configuration from
cf.lb.example. The CDN/load balancer/etc knows how to set up DNS for
it to work right, the only thing backend.example.com can do is mess it
up.

Lastly, and I'm not a DNS person by any means, I seem to remember that
CNAME is the only record allowed on a zone, and CNAME would resolve
the HTTPS record. So what exactly is the setup here that gets the
right A and AAAA records for the backend.example.com and uses the CDN?
If this only applies to cases where IPs are specified by customers, it
will be a very narrow situation. Or are we anticipating HTTPS only
CDNS (will never happen for install base/compatibility reasons)? I
know this got discussed in the adoption call but sadly my archive
searching skills are not finding the relevant emails.

Sincerely,
Watson
-- 
Astra mortemque praestare gradatim