IETF Logo Mail Archive

Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-dnssec-chain-extension-06

Alissa Cooper <alissa@cooperw.in> Wed, 07 February 2018 22:08 UTC

Return-Path: <alissa@cooperw.in>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D5B5124239; Wed, 7 Feb 2018 14:08:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.72
X-Spam-Level:
X-Spam-Status: No, score=-2.72 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cooperw.in header.b=X/0BoFpc; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=H1GjwjHp
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kBaYf22P1Okh; Wed, 7 Feb 2018 14:08:53 -0800 (PST)
Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 50AF91205F0; Wed, 7 Feb 2018 14:08:53 -0800 (PST)
Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.nyi.internal (Postfix) with ESMTP id AC6CA20B7A; Wed, 7 Feb 2018 17:08:52 -0500 (EST)
Received: from frontend2 ([10.202.2.161]) by compute7.internal (MEProxy); Wed, 07 Feb 2018 17:08:52 -0500
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cooperw.in; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to:x-me-sender:x-me-sender:x-sasl-enc; s= fm2; bh=8YggcmLmk57ZVCy7jwAasU8PNk5A4Nck0HBaDdbL2bA=; b=X/0BoFpc xAxnjG3XKqK1kd/TTZl4fAqk0nH2mnCfkeotWQNEsZE7x+WpAGsgkCKZ4uWTxu6N PgphCXS8T7F/XLYljlUBEy04SRNSrL0rktF1Ynmfe+/GRm5kJwR/U8Vy/8OfSIbP AGN22YKyR/ENcEfAtwyfoRi7KP4sO1d4pwk9xyV/4Zuui8NEvuaysI6bocQYSeAd aCNiDT/55Sp5wi81u5UEY19e0fEZ/ri9Ge0Nec+Li6QYXFMwYi+MflKrTy3Z7wZ0 0l4D8mFa/ZvT4VUdkiqfLltyikm1o2pMCQdIlVe8j8X8ASMhh9OoDq6hsNwJ+kbS YEk4RZikWDVFiA==
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=8YggcmLmk57ZVCy7jwAasU8PNk5A4 Nck0HBaDdbL2bA=; b=H1GjwjHpXU59tO/9HCwn0BdzkjgwgMFeYW7A8aJERUXZ2 sVQFA/tPcJ9pFbRF0gIKEVZAFCLS9Un3HOCjQh13ouhOC+zXtboYydSHNHZ0jFs3 BzVqN6pI8ie5FmjLFY7KfMt4TzTHPkXZfmnocmNuuCk/2FGfYzF3DI9Xk3Pf9smR Dy7Wi55Ufnat6fQfmg+rvJwOqg2yo7IrVlmmNGvxl+vRx2LyFWrTunpTRgeuS6UN qxfYvbuvojNqSBc7OqqjAdxbQ3f205rcv+KaMViv6Bu2u541jU8HzkxQZcgQrrxd T1tZB2Da/RJyLtvV7FhayqWT0jUZF239N3q3rPqhQ==
X-ME-Sender: <xms:9Hh7Wv7Emomd0jPO81b_adeYmUecZyQhC2nFooqlj2dS0qZ1dWdmTg>
Received: from rtp-vpn5-983.cisco.com (unknown [173.38.117.76]) by mail.messagingengine.com (Postfix) with ESMTPA id 154E424404; Wed, 7 Feb 2018 17:08:52 -0500 (EST)
Content-Type: multipart/alternative; boundary="Apple-Mail=_84AD1DCF-268E-4A7D-8267-FCD29EC2BB7B"
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
From: Alissa Cooper <alissa@cooperw.in>
In-Reply-To: <CAHPuVdWmSDoPQsO9z=Nw6yLSNC5c=oQjqrxOjc9ZP_W8cNq9Lw@mail.gmail.com>
Date: Wed, 07 Feb 2018 17:08:50 -0500
Cc: "gen-art@ietf.org Review Team" <gen-art@ietf.org>, draft-ietf-tls-dnssec-chain-extension.all@ietf.org, TLS WG <tls@ietf.org>
Message-Id: <6E7803A9-D78A-4078-BA09-4A48C7A0612E@cooperw.in>
References: <151796675979.25928.2038193051971303546@ietfa.amsl.com> <CAHPuVdWmSDoPQsO9z=Nw6yLSNC5c=oQjqrxOjc9ZP_W8cNq9Lw@mail.gmail.com>
To: Shumon Huque <shuque@gmail.com>, Matthew Miller <linuxwolf+ietf@outer-planes.net>
X-Mailer: Apple Mail (2.3124)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/mHQNDkoEjJLgSjrC2it8uYVB7mk>
Subject: Re: [TLS] [Gen-art] Genart telechat review of draft-ietf-tls-dnssec-chain-extension-06
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Feb 2018 22:08:55 -0000

Matt, thanks for your review. Shumon, thanks for your response. I have entered a No Objection ballot.

Alissa

> On Feb 6, 2018, at 11:31 PM, Shumon Huque <shuque@gmail.com> wrote:
> 
> On Tue, Feb 6, 2018 at 8:25 PM, Matthew Miller <linuxwolf+ietf@outer-planes.net <mailto:linuxwolf+ietf@outer-planes.net>> wrote:
> Reviewer: Matthew Miller
> Review result: Ready with Nits
> 
> I am the assigned Gen-ART reviewer for this draft. The General Area
> Review Team (Gen-ART) reviews all IETF documents being processed
> by the IESG for the IETF Chair. Please wait for direction from your
> document shepherd or AD before posting a new version of the draft.
> 
> For more information, please see the FAQ at
> 
> <https://trac.ietf.org/trac/gen/wiki/GenArtfaq <https://trac.ietf.org/trac/gen/wiki/GenArtfaq>>.
> 
> Document: draft-ietf-tls-dnssec-chain-extension-06
> Reviewer: Matthew A. Miller
> Review Date: 2018-02-06
> IETF LC End Date: 2018-02-07
> IESG Telechat date: 2018-02-08
> 
> Summary:
> 
> This document is ready, with one issue that I think could benefit
> from some clarification.
> 
> Major issues:
> 
> NONE
> 
> Minor issue:
> 
> This is more a question, that might warrant some clarification:
> In 7. Verification, the last paragraph discusses client-side
> caching of the RRsets. If a client has cached the full RRset chain
> from TLSA to root RRSIG (and that cache is still viable), is the
> client still expected to specify the "dnssec_chain" extension?
> 
> In my reading, that does not seem necessary, and I think it might
> be worth noting if that is true.
> 
> Yes, if the client has cached either the validated TLSA RRset or the 
> full chain, then it doesn't need to send the dnssec_chain for subsequent
> connections.
> 
> If it has only cached other portions of the chain, then it needs to. 
> 
> We can clarify this.
> 
> Shumon Huque
> 
> _______________________________________________
> Gen-art mailing list
> Gen-art@ietf.org
> https://www.ietf.org/mailman/listinfo/gen-art

v2.26.15 | Report a Bug | By Email | System Status