Subject: [dane] I-D Action: draft-ietf-dane-ops-10.txt

From: [email-masked]
Date: Fri, 29 May 2015 05:48:05 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the DNS-based Authentication of Named Entities Working Group of the IETF.

        Title           : Updates to and Operational Guidance for the DANE Protocol
        Authors         : Viktor Dukhovni
                          Wes Hardaker
	Filename        : draft-ietf-dane-ops-10.txt
	Pages           : 29
	Date            : 2015-05-29

Abstract:
   This document clarifies and updates the DNS-Based Authentication of
   Named Entities (DANE) TLSA specification (RFC6698) based on
   subsequent implementation experience.  It also contains guidance for
   implementers, operators and protocol developers who want to make use
   of DANE records.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dane-ops/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dane-ops-10

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dane-ops-10

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: nudge <[email-masked]>
Date: Fri, 29 May 2015 17:36:24 +0200

Tiny nits:

Section 5.1 -  Paragraph 4:

(i.e., the[y] may ignore
   the client's SNI message)

Section 8.2 -  Paragraph 1:

A more complex [?] involves switching to a trust-anchor or PKIX usage
   from a chain that is either self-signed, or issued by a private CA
   and thus not compatible with PKIX.

Section 8.4:

o  Extend the TLSA RRset with a new combination of parameters (usage,
      selector and matching type) that [is] used to generate matching
      associations for all certificate chains that are published with
      some other parameter combination.

---

From: Viktor Dukhovni <[email-masked]>
Date: Fri, 29 May 2015 23:10:33 +0000

>    and thus not compatible with PKIX.

Thanks fixed in -11.  This example also needed to be simplified a bit.

-- 
	Viktor.