IETF Logo Mail Archive

Re: [TLS] Consensus Call on draft-ietf-tls-dnssec-chain-extension

Shumon Huque <shuque@gmail.com> Wed, 18 April 2018 22:35 UTC

Return-Path: <shuque@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E6AE126CE8 for <tls@ietfa.amsl.com>; Wed, 18 Apr 2018 15:35:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jVFfsDQJ73Nw for <tls@ietfa.amsl.com>; Wed, 18 Apr 2018 15:35:45 -0700 (PDT)
Received: from mail-io0-x22d.google.com (mail-io0-x22d.google.com [IPv6:2607:f8b0:4001:c06::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E89D124D37 for <tls@ietf.org>; Wed, 18 Apr 2018 15:35:45 -0700 (PDT)
Received: by mail-io0-x22d.google.com with SMTP id f3-v6so4349201iob.13 for <tls@ietf.org>; Wed, 18 Apr 2018 15:35:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=DRjLe0kA58d2fFMplfNB6OPB2mjzt/TgSt1qHA/qt8U=; b=IyZyuYdgYSb/UH21GneQtqB9kSJx6YzIBnhWv3Gu1iFa3Fph1v661tplOxPub5VoKf 3M+BmRrnbumu73HAhRo5thmeb7LcnsBL4sa2Gt4yB2otOWv+ccgrWdqCkPulH4qaPAAO lpkh6VWCI5VcaE0tSTrRVZyN7lMwvTncY+MIU96VnPTsFcSN5sQr2gESRxddJV879pZN XeF6tq2v6dlOG5ud2I2WX2slhDv2ECD3GyLTyKoZXdHdY7D4DMtYBZqtYFwlxdqJxPwZ xhMXpBnb5mS5BFYZo2kafWdCtNrZAlqWvDKifEhjF8gauleI9yQdJQ5QPqzOKHf+NSO0 esKA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=DRjLe0kA58d2fFMplfNB6OPB2mjzt/TgSt1qHA/qt8U=; b=L0JrB2kYRT2rr287KmbjVaZ7EvdkA83HQu8crXQh1JD5dt3us9iKgTYIXRSI8UZKV2 4ZIFjG2/w0YwomOpdDEOEj6AWMgS3vYdwghkwP93j19/nzkhaOeIFQseCuCIzDxMSlId c7E4IgKoW0jssNbB4YViDDrwWipHQeKDEahsmwi/tuhQnYAJr1hdNHKk7eJDuTe2sQlT Hc/x3xjdYf88LEUIGhba5Luoj+HLENhOMpBEBSgIwFtekub1rwbssgnZs44usaF87sDg Go/y8OHZl/LxV0dv0KepN0zify/r62SpCphFdY2jiTS8AuBv8XzO2pqRrH3fp0kW9oyw n/dQ==
X-Gm-Message-State: ALQs6tBOYvV44rfFgn1mZKbMkIdOel8NJ+f8zcH8ZYipSSmpvFtVkNnP /fiP3DpiTjn3UpEJNTtn0eVsG7yAT0jKGXaWMvQ=
X-Google-Smtp-Source: AB8JxZpVdnyL9FFMKG1u3pWQU9sZIMMm8xrdmu7cczxG91IygzYDFLNIw3cVsApcrZDu79yNA3g1jnLwa3lXKOAnd0o=
X-Received: by 2002:a6b:9b15:: with SMTP id d21-v6mr4154660ioe.243.1524090944363; Wed, 18 Apr 2018 15:35:44 -0700 (PDT)
MIME-Version: 1.0
Received: by 2002:a4f:7c91:0:0:0:0:0 with HTTP; Wed, 18 Apr 2018 15:35:43 -0700 (PDT)
In-Reply-To: <alpine.LRH.2.21.1804181640480.29344@bofh.nohats.ca>
References: <CAOgPGoAhzEtxpW5mzmkf2kv3AcugNy0dAzhvpaqrTSuMSqWqfw@mail.gmail.com> <CAOgPGoCbHzuAZra5+i647gtLbR9ZV0-nEE+A7K6e8cUMNjNYtA@mail.gmail.com> <alpine.LRH.2.21.1804181640480.29344@bofh.nohats.ca>
From: Shumon Huque <shuque@gmail.com>
Date: Wed, 18 Apr 2018 18:35:43 -0400
Message-ID: <CAHPuVdVN1NVhZKg_qCsY+EeM_fxKMsHcCAdN4Jo6Nc9GHtJhfA@mail.gmail.com>
To: Paul Wouters <paul@nohats.ca>
Cc: Joseph Salowey <joe@salowey.net>, "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="0000000000005823bd056a27131d"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/kAAAy-fE1gKP_k8nYrBBHYo2BFs>
Subject: Re: [TLS] Consensus Call on draft-ietf-tls-dnssec-chain-extension
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Apr 2018 22:35:47 -0000

On Wed, Apr 18, 2018 at 4:42 PM, Paul Wouters <paul@nohats.ca> wrote:

>
>  2. Explicitly allow (but do not require) DoE be included
>>
>
> The document does not currently allow the extension to be empty. So if
> there is no TLSA record and the extension would be present, it therefore
> can only contain a DoE chain. So what do you mean with item 2? Possibly
> you mean to say "if there is no TLSA record, the extension can be omited
> or the extension can be included with a DoE chain" ? That would be okay
> with us.


Yes, my understanding is that's what it means.

Note that Section 8 ("Mandating Use") already did hint at the future
possibility of
this extension carrying a DoE chain that could be deployed in a TLS
application
ecosystem where all servers understood and were prepared to respond to this
extension. The plan is to now add text that allows DoE chains more
generally,
with details of use defined in subsequent documents.

Shumon.

v2.15.0 | Report a Bug | By Email