Subject: Re: [v6ops] WGLC draft-ietf-v6ops-v6-aaaa-whitelisting-implications-02

From: Tina Tsou <[email-masked]>
Date: Thu, 03 Mar 2011 13:17:11 -0800

As I said, I think the Section 10.1 text Jason has further below is OK. I
suggested a few words to add *if* someone complains that it should be more
specific.

We keep our promises with one another - no matter what!

Best Regards,
Tina TSOU
http://tinatsou.weebly.com/contact.html

-----Original Message-----
From: Joel Jaeggli [mailto:[email-masked]] 
Sent: Thursday, February 24, 2011 2:18 PM
To: Tina Tsou
Cc: 'Livingood, Jason'; 'IPv6 Ops WG'
Subject: Re: [v6ops] WGLC
draft-ietf-v6ops-v6-aaaa-whitelisting-implications-02

I don't think we need to be that specific about how people sort out the
issue of signing their zones. if 4470 is required for a particular
deployment it's probably because you have some condition or desire other
than two differing views of the same zone.

On 2/24/11 11:41 AM, Tina Tsou wrote:
> Hi Jason,
> 
> I think the wording below is OK. I would see if anyone complains about
> the wording. It could be a bit more specific. For example, you could add
> a few words right at the end so instead of
> 
>  
> 
>                 ... may present incremental operational and/or technical
> challenges.
> 
>  
> 
> itsaid
> 
>  
> 
>                 ... may present incremental operational and/or technical
> challenges such as a requirement for on-line signing.
> 
>  
> 
>  < /span>We keep our promises with one another - no matter what!
> 
>  
> 
> Best Regards,
> 
> Tina TSOU
> 
> http://tinatsou.weebly.com/contact.html
> 
>  
> 
> *From:*Livingood, Jason [mailto:[email-masked]]
> *Sent:* Tuesday, February 22, 2011 8:24 PM
> *To:* Tina Tsou
> *Cc:* 'IPv6 Ops WG'
> *Subject:* Re: [v6ops] WGLC
> draft-ietf-v6ops-v6-aaaa-whitelisting-implications-02
> 
>  
> 
> < al>Hi Tina - Thank you for your review and specific feedback below.
> These changes will be in the -03 update soon. See my specific responses
> inline below.
> 
>  
> 
> Thanks!
> 
> Jason
> 
>  
> 
> On 2/21/11 5:13 PM, "Tina Tsou" <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>  
> 
>     Hi,
> 
>     I generally support this document as attempt on real operational
>     issues involved in the deployment of IPv6.
> 
> < p class=
> nt-family:"Calibri","sans-serif";mso-fareast-font-family:"Times New
> Roman";color:black'> 
> 
> [JL] Thanks! :-)
> 
>  
> 
>     Comments on section 10.1 "DNSSEC Considerations" are below.
> 
>     It says e sent to different querying hosts. If those are all known
>     in advance, and the server has the DNS zone signing key, it can
>     separately sign the various alternative answer data sets however you
>     want. If they are not known in advance, then you have to have the
>     keys on-line so you can sign answer data in real time.
> 
>  
> 
> [JL] Good point. I have attempted to make this more clear. Here is how
> that section now appears. If you think this needs further modification,
> just say so.
> 
> /DNS security extensions defined in /*/[RFC4033]/*
> <#RFC4033>/, /*/[RFC4034]/* <#RFC4034>/, and /*/[RFC4035]/*
> <#RFC4035>/ use cryptographic digital signatures to provide origin
> authentication and integrity assurance for DNS data. This is done by
> creating signatures for DNS data on a Security-Aware Authoritative Name
> Server that can be used by Secu rity-Awa e answers. //Since DNS
> whitelisting is implemented on an authoritative server, which provides
> different answers depending upon which resolver server has sent a query,
> the DNSSEC chain of trust is not altered. Even though the authoritative
> server will not always return a AAAA resource record when one exists,
> respective A resource records and AAAA resource records can and should
> both be signed.  Therefore there are no DNSSEC implications per se.
> However, any implementer of DNS whitelisting should be careful if they
> implement both DNSSEC signing of their domain and also DNS whitelisting
> of that same domain. Specifically, those domains should ensure that
> resource records are being appropriately and reliably signed, which may
> present incremental operational and/or technical challenges./
> 
>  
> 
>  
> 
> Thank you again, 
> 
> Jason
> 
>  
> 
>      
> 
>      
> 
>     We keep our promises with one another - no matter what!
> 
>      
> 
>     Best Regards,
> 
>     Tina TSOU <
> 
>     http://tinatsou.weebly.com/contact.html
> 
>      
> 
>     *From:[email-masked] <mailto:[email-masked]>
>     [mailto:[email-masked]] *On Behalf Of *Livingood, Jason
>     *Sent:* Monday, February 21, 2011 1:57 PM
>     *To:* Joel Jaeggli; Doug Barton
>     *Cc:* t: Re: [v6ops] WGLC
>     draft-ietf-v6ops-v6-aaaa-whitelisting-implications-02
> 
>      
> 
> 
>         I proposed a series of edits (sent to jason first due to their
>         length)
> 
>         that neutralize the tone a bit but without I think altering the
>         content.
> 
>         I think that the characterization of the problems with a
>         whitelistingapproach is useful and important. It's going to
>         (has) happened anyway
> 
>         and it's not a "we told you so" it's "these are the issues you
>         have to
> 
>         contend with."
> 
>      
> 
>     [JL] I am mid-way through those edits (will take another day or so
>     to factor them all in). These suggestions will be ad opted in g with
>     the other specific feedback received in the past few days of WGLC.
> 
>      
> 
>     Regards
> 
>     Jason
> 
> 
> 
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops