Subject: Re: [dns-privacy] review of draft-ietf-dprive-dtls-and-tls-profiles-11: we should revert DNSSEC validation requirement

From: Sara Dickinson <[email-masked]>
Date: Wed, 1 Nov 2017 09:17:46 +0000

> On 31 Oct 2017, at 18:39, Stephen Farrell <[email-masked]> wrote:
> 
> 
> Hiya,
> 
> On 31/10/17 15:12, Paul Hoffman wrote:
>> On 31 Oct 2017, at 8:06, Sara Dickinson wrote:
>> 
>>> So maybe “A DNSSEC validating client SHOULD apply the same validation
>>> policy to the A/AAAA meta-query lookup as it does to other queries.”?
>> 
>> That could be misinterpreted to indicate that there has to be some
>> positive validation policy. How about:
>>    A DNSSEC validating client SHOULD apply the same validation policy
>>    to the A/AAAA meta-query lookup as it does to other queries.
>>    A client that does not validate DNSSEC SHOULD apply any policy it
>>    has to the A/AAAA meta-query lookup.
> 
> So I think either of the above could be ok.
> 
> The main thing for me is that we do not insist that a server
> has to get DNSSEC setup before they can do opportunistic DNS
> security. I think the above is ok in that respect.
> 
> Just checking: I think that means that with the opportunistic
> profile, only servers that have DNSSEC setup and where the
> client validates and gets a badly signed response would be
> affected, all other cases would still get DNS privacy of some
> sort. If that's right, I can live with it.

Correct. For opportunistic the use case where the client might get no DNS service is where the client is

 - configured with ONLY an authentication domain name (no IP address)
 - DNSSEC validating and configured to reject BOGUS records (all others accepted)
 - receives BOGUS answers for all configured name servers

Sara.

---

From: Sara Dickinson <[email-masked]>
Date: Tue, 14 Nov 2017 12:04:19 +0100

Hi All, 

This draft is now ready to progress once a -12 version is available. I just want to circle back round to summarise the fact that the only proposed difference that will be in the -12 version compared to -11 is the following (in section 7.2. Direct configuration of ADN only): 

Current text:

“It can then use Opportunistic DNS connections to an untrusted recursive
   DNS resolver to establish the IP address of the intended privacy-
   enabling DNS resolver by doing a lookup of A/AAAA records.  Such
   records SHOULD be DNSSEC validated when using a Strict Usage profile
   and MUST be validated when using Opportunistic Privacy."

New text:
“It can then use Opportunistic DNS connections to an untrusted recursive
   DNS resolver to establish the IP address of the intended privacy-
   enabling DNS resolver by doing a lookup of A/AAAA records. A 
   DNSSEC validating client SHOULD apply the same validation policy
  to the A/AAAA meta-query lookups as it does to other queries.
  A client that does not validate DNSSEC SHOULD apply the same policy (if any)
  to the A/AAAA meta-query lookups as it does to other queries."

I hope I captured the consensus correctly? Please let me know as I intend to put out the -12 (final) version next Monday (20th). 

Sara. 

> On 31 Oct 2017, at 16:12, Paul Hoffman <[email-masked]> wrote:
> 
>> So maybe “A DNSSEC validating client SHOULD apply the same validation policy to the A/AAAA meta-query lookup as it does to other queries.”?
> 
> That could be misinterpreted to indicate that there has to be some positive validation policy. How about:
> --Paul Hoffman

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 24 Nov 2017 14:47:09 +0000

Proposed text looks good to me.

-Tiru

> -----Original Message-----
> From: dns-privacy [mailto:[email-masked]] On Behalf Of Sara
> Dickinson
> Sent: Tuesday, November 14, 2017 4:34 PM
> To: [email-masked]
> Subject: Re: [dns-privacy] review of draft-ietf-dprive-dtls-and-tls-profiles-11:
> we should revert DNSSEC validation requirement
> 
> Hi All,
> 
> This draft is now ready to progress once a -12 version is available. I just want
> to circle back round to summarise the fact that the only proposed difference
> that will be in the -12 version compared to -11 is the following (in section 7.2.
> Direct configuration of ADN only):
> 
> Current text:
> 
> I hope I captured the consensus correctly? Please let me know as I intend to
> put out the -12 (final) version next Monday (20th).
> 
> Sara.
> 
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Tue, 28 Nov 2017 20:03:28 -0500

On Tue 2017-11-14 12:04:19 +0100, Sara Dickinson wrote:

> This draft is now ready to progress once a -12 version is available. I
> just want to circle back round to summarise the fact that the only
> proposed difference that will be in the -12 version compared to -11 is
> the following (in section 7.2. Direct configuration of ADN only):
>
> Current text:
>
> I hope I captured the consensus correctly? Please let me know as I
> intend to put out the -12 (final) version next Monday (20th).

The text looks good to me.  thanks for taking care of this, Sara.

    --dkg