Subject: Re: [dane] Reopening issue #22 for discussion....

From: Peter Koch <[email-masked]>
Date: Wed, 28 Sep 2011 18:35:18 +0200

{we've probably left #22 already}

On Mon, Sep 26, 2011 at 06:50:46AM -0700, Paul Hoffman wrote:

> >> Current wording in the spec:
> >>   DNS systems conforming to this specification MUST be able to create
> >>   TLSA records using matching type 0 (no hash used) and matching type 1
> >>   (SHA-256), and SHOULD be able to create TLSA records using matching
> >>   type 2 (SHA-512).
> >
> > this text is misleading. The draft doesn't say what it considers a "DNS system",
>
> Good point.
>
> > but to avoid ambiguity it should be clarified that there's no "conformance"
> > issue for the DNS name server but rather what one had in mind here is
> > some provisioning entity that will (be used to) feed data into the DNS zone.
>
> Correct: that's is the entity where the conformance requirement applies.
>
> > The RRSet content, signed or unsigned, is transparent to the name server as
> > per RFC 3597.
>
> Yep.
>
> Does "A system creating TLSA records that conforms to ... " work? Is there some clearer wording we can use?

avoiding 'DNS system' helps clarifying the issue.  Whether the "system" or the
data should be the target of the MUST depends on what you intend to achieve.
Clearly, TLSA records could be crafted manually and would have to meet the
syntax requirement.  If there's some guidance or preference to be expressed
for the actual use of one or the other format or some expectation regarding
automated support for creating TLSA records, that may need more prose and
i'm not sure the formal criteria for a MUST are met here.

Summary: your proposed wording is an improvement IMHO, but the text as a whole
  needs another pass.

-Peter

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 28 Sep 2011 09:47:05 -0700

On Sep 28, 2011, at 9:35 AM, Peter Koch wrote:

> avoiding 'DNS system' helps clarifying the issue.  

Good. We can do that in the next draft.

> Whether the "system" or the

It is the system. The intention is "if you say that X does TLSA, X must be able to do A, B, and C".

> i'm not sure the formal criteria for a MUST are met here.

The intention is that X must do A, B, and C, not that there are preferences.

> Summary: your proposed wording is an improvement IMHO, but the text as a whole

I've marshaled new wording for the next draft, and am happy to work on it more.

--Paul Hoffman