Subject: [dane] Brian Haberman's No Objection on draft-ietf-dane-srv-13: (with COMMENT)

From: "Brian Haberman" <[email-masked]>
Date: Mon, 20 Apr 2015 07:50:51 -0700

Brian Haberman has entered the following ballot position for
draft-ietf-dane-srv-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
http://datatracker.ietf.org/doc/draft-ietf-dane-srv/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

* The reference to Section 4 of draft-ietf-dane-smtp-with-dane in the
Note within section 3.1 seems out-of-date.

* The intro to Section 3.2 says "A and/or AAAA", but the first two
bullets in the list seems to assume that both A and AAAA lookups are
performed.

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 20 Apr 2015 15:29:52 +0000

Don't know how that became section 4, this was a reference to
section 2.1 in version 12 (previous) of the draft, which was
correct.

> bullets in the list seems to assume that both A and AAAA lookups are

Some clients only have IPv4 connectivity, and will only make A
queries.  Other clients only have IPv6 connectivity and will only
make AAAA queries, some will perform both.

The client avoids TLSA queries when none of the address records it
found were secure.  In practice since the A and AAAA records belong
to the same "owner", it would be very surprising if they had a
different security status.  

The only way that happens is if the cached DS RRset (or negative
entry) expires from the cache between the two queries, and the
zone's DNSSEC status changed since last queried.

-- 
	Viktor.

---

From: Brian Haberman <[email-masked]>
Date: Mon, 20 Apr 2015 11:50:06 -0400

Hi Viktor,

> make AAAA queries, some will perform both.

Agreed on the actions of the client based on availability of v4 and v6
service.  The wording in the first two bullets could be made clearer.
Would this substitution capture the intent?

OLD:
   o  If either the A or AAAA RRSets are "secure", the client ...

   o  If both RRsets are "insecure", the client ...

NEW:
   o  If a returned RRSet is "secure", the client ...

   o  If no returned RRsets are "secure", the client ...

Regards,
Brian

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 20 Apr 2015 15:58:25 +0000

>    o  If no returned RRsets are "secure", the client ...

I think so, with luck the authors and others will also agree.

-- 
	Viktor.

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Mon, 20 Apr 2015 10:07:41 -0600

> I think so, with luck the authors and others will also agree.

That seems fine to me.

And I'm not sure how we got that section pointer wrong in §3.1, will fix.

Peter

-- 
Peter Saint-Andre
https://andyet.com/