Subject: [keyassure] Issue #3: Format of the record.

From: Warren Kumari <[email-masked]>
Date: Thu, 10 Feb 2011 21:28:31 -0500

Hello all,

We have "Issue #3: Format of the record" with the description:

--------------------
Format of the record:
a subtype of CERT (as was used in early drafts)
a new RRtype (used in draft-ietf-dane-protocol-00)
a TXT record with _prefix.

Hopefully this is just a representation issue and can be worked on after larger decisions have been made.

----------------------

I think that we have settled on using a new RRtype (as shown in draft-ietf-dane-protocol-00), but I realize that we haven't explicitly had a consensus call on this, so I am (with all reverence) donning the bells and ribbons, stepping over the clay pipes, smacking myself smartly with the stick and beginning the consensus call...

W

P.S: I have not consulted my co-chair on this, if I have completely misjudged the groups views, the fault is all mine...

---

From: Matt McCutchen <[email-masked]>
Date: Thu, 10 Feb 2011 22:29:52 -0500

On Thu, 2011-02-10 at 21:28 -0500, Warren Kumari wrote:
> I think that we have settled on using a new RRtype (as shown in
> draft-ietf-dane-protocol-00), but I realize that we haven't explicitly
> had a consensus call on this, so I am (with all reverence) donning the
> bells and ribbons, stepping over the clay pipes, smacking myself
> smartly with the stick and beginning the consensus call...

I prefer the new RRtype.

It would be OK to use a new CERT subtype, but I don't find there to be
much conceptual economy in doing so.  RFC 4398 section 7 suggests that
some clients might use DNSSEC-protected CERT records without traditional
validation, but there is nothing precise; in contrast, TLSA makes a
precise assertion.  Furthermore, TLSA clients aren't interested in the
other CERT subtypes, so it is cleaner not to fetch them and have to sort
through them.

TXT at a prefix would only make sense if the RR content is text.  I
prefer binary for the slightly better performance, unless interop issues
with new RRtypes are shown to still be real.  A key-value format like
DKIM or Kaminsky's KEY1 is extensible via new keys, but we don't care
about that assuming we are going to bite off TLSA and deal separately
with the myriad other hints we might want to give clients.

-- 
Matt

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 10 Feb 2011 23:16:23 -0500

Since there is no value in these records without DNSSEC and since this is a
standards track effort, I see no reason not to use a new RR.

Reuse of an existing RR will make the protocol more complex and harder to
use.

All infrastructure that will pass and handle DNSSEC will support new RRs.

Attempting to use a prefix to the TXT record will not bypass DNSEXT.

So it has to be at least one new RR.

On Thu, Feb 10, 2011 at 9:28 PM, Warren Kumari <[email-masked]> wrote:

> draft-ietf-dane-protocol-00), but I realize that we haven't explicitly had a
> consensus call on this, so I am (with all reverence) donning the bells and
> ribbons, stepping over the clay pipes, smacking myself smartly with the
> stick and beginning the consensus call...
>
> W
>
> P.S: I have not consulted my co-chair on this, if I have completely
> misjudged the groups views, the fault is all mine...
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure
>

-- 
Website: http://hallambaker.com/

---

From: Nicholas Weaver <[email-masked]>
Date: Thu, 10 Feb 2011 20:21:06 -0800

On Feb 10, 2011, at 8:16 PM, Phillip Hallam-Baker wrote:

> Since there is no value in these records without DNSSEC and since this is a standards track effort, I see no reason not to use a new RR.
> 
> Reuse of an existing RR will make the protocol more complex and harder to use.
> 

And attempting to use a TXT record instead of a new RR is effectively no more reliable in practice from a delivery perspective.

> So it has to be at least one new RR.

Agreed.

---

From: "Steingruebl, Andy" <[email-masked]>
Date: Thu, 10 Feb 2011 22:36:18 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Nicholas Weaver

> And attempting to use a TXT record instead of a new RR is effectively no
> more reliable in practice from a delivery perspective.

Can you clarify this?  I saw Adam Langley's data on lookups of new random RR types and the failure rates.  I hadn't seen data on lookup failures for other types of records, but I could have just overlooked it.

Thanks

- Andy

---

From: Paul Wouters <[email-masked]>
Date: Sun, 13 Feb 2011 14:47:52 -0500 (EST)

> We have "Issue #3: Format of the record" with the description:

Yes, a new RRTYPE.

Paul

---

From: Warren Kumari <[email-masked]>
Date: Sat, 19 Feb 2011 10:16:53 -0500

Okey dokey -- it seems that we are all happy with using "a new RR type  
(used in draft-ietf-dane-protocol-00)" and so I'm calling it....

W
On Feb 13, 2011, at 2:47 PM, Paul Wouters wrote:

>> draft-ietf-dane-protocol-00), but I realize that we haven't  
>> explicitly had a consensus call on this, so I am (with all  
>> reverence) donning the bells and ribbons, stepping over the clay  
>> pipes, smacking myself smartly with the stick and beginning the  
>> consensus call...
>
> Yes, a new RRTYPE.
>
> Paul
>