Subject: Re: [dns-privacy] Start of WGLC for draft-ietf-dprive-dns-over-tls-01

From: Simon Josefsson <[email-masked]>
Date: Mon, 09 Nov 2015 20:32:08 +0100

"Mankin, Allison" <[email-masked]> writes:

> My two cents is that the authentication profile for TLS and DTLS
> should not be the same as a draft with flows.
>
> I reviewed the flows draft before it was submitted (and thank the
> authors for responding to initial comments).  Unsurprisingly, the
> flows draft is almost entirely made up of flows.  I estimate that many
> will have to change in response to DPRIVE WG review/discussion of the
> DTLS fragmentation scheme; also, some of them may need to change based
> on what is finalized for 1.3 in the TLS WG.  In keeping with other
> precedents at IETF, I’d see the flows draft as an informational
> document to help implementors/deployers.

I don't think this WG should wait for completion of TLS 1.3.  If you
write drafts the right way, I don't see anything that needs to be
changed moving from TLS 1.2 to TLS 1.3.  Or are you thinking of
mandating TLS >= 1.3 for dprive?

I believe the dprive documents are in reasonable shape, and the only
worrying concern is that the (D)TLS-considerations ought to be
synchronized between DoDTLS and DoTLS.  It appears there is already work
towards fixing that, and once that document is available, there could be
a WG last call on all three documents.  I don't see anything that would
prevent this from happening during the next 0-3 months process-wise.  I
believe that TLS 1.3 will not be finalized within that time-frame.

/Simon

>
> The authentication profile for TLS/DTLS is something we can pull
> together now, with some work by the WG, and I’d expect it to be
> standards track.  I would not want to delay it for finishing the
> detailed engineering on the DTLS draft.
>
> Bottom line: I very much support Sara’s offer to start a stand-alone
> document for the authentication profile.  Speaking for the TLS
> authors, we’ll be happy to add language pointing ahead to an
> authentication profile external to our draft.
>
> Allison
>
> .
>
>
>> On Oct 27, 2015, at 11:12 AM, Tirumaleswar Reddy (tireddy) <[email-masked]> wrote:
>> 
>>  
>>  
>> From: Sara Dickinson [mailto:[email-masked] <mailto:[email-masked]>] 
>> Sent: Tuesday, October 27, 2015 7:34 PM
>> To: Tirumaleswar Reddy (tireddy)
>> Cc: [email-masked] <mailto:[email-masked]>
>> Subject: Re: [dns-privacy] Start of WGLC for draft-ietf-dprive-dns-over-tls-01
>>  
>>  
>> On 27 Oct 2015, at 12:31, Tirumaleswar Reddy (tireddy)
>> <[email-masked] <mailto:[email-masked]>> wrote:
>> 
>> 
>> I’m saying I think creating a separate document that specifically
>> covers authentication for both TLS and DTLS makes most sense to me
>> and will be clearer for consumers of the documents.
>>  
>> [TR] We can move this Section to
>> https://tools.ietf.org/html/draft-wing-dprive-profile-and-msg-flows-00
>> <https://tools.ietf.org/html/draft-wing-dprive-profile-and-msg-flows-00>
>> and that will take care both (D)TLS profile for DNS privacy and
>> authenticating the server.
>>  
>> I guess this is a decision for the working group since the DTLS
>> draft is adopted, but the above document isn’t.
>>  
>> [TR] Yes, of course; will do that only after WG feedback and adoption of the draft.
>>  
>> -Tiru
>>  
>> Sara. 
>> _______________________________________________
>> dns-privacy mailing list
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/dns-privacy
>> <https://www.ietf.org/mailman/listinfo/dns-privacy>
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 10 Nov 2015 02:52:36 +0000

> -----Original Message-----
> From: Simon Josefsson [mailto:[email-masked]]
> Sent: Tuesday, November 10, 2015 1:02 AM
> To: Mankin, Allison
> Cc: Tirumaleswar Reddy (tireddy); Sara Dickinson; [email-masked]
> Subject: Re: Start of WGLC for draft-ietf-dprive-dns-over-tls-01
> 
> I don't think this WG should wait for completion of TLS 1.3.  If you write
> drafts the right way, I don't see anything that needs to be changed moving
> from TLS 1.2 to TLS 1.3.  Or are you thinking of mandating TLS >= 1.3 for
> dprive?

No. The proposal is to split draft-wing-dprive-profile-and-msg-flows-00, (D)TLS 1.2 profile for providing DNS privacy and authentication of the DNS server will be discussed in one draft. We plan to publish this draft in couple of weeks.
draft-wing-dprive-profile-and-msg-flows-00 will be made informational and only discuss message flows for DNS-over-(D)TLS and also include message flows with TLS 1.3, will keep updating draft-wing-dprive-profile-and-msg-flows draft as TLS 1.3 work progresses and it can be considered for publication after TLS 1.3 work is finalized. 

-Tiru

> worrying concern is that the (D)TLS-considerations ought to be synchronized
> between DoDTLS and DoTLS.  It appears there is already work towards fixing
> that, and once that document is available, there could be a WG last call on all
> three documents.  I don't see anything that would prevent this from
> happening during the next 0-3 months process-wise.  I believe that TLS 1.3
> will not be finalized within that time-frame.
> 
> /Simon
> 
> >
> >> <https://tools.ietf.org/html/draft-wing-dprive-profile-and-msg-flows-
> >> 00> and that will take care both (D)TLS profile for DNS privacy and
> >> I guess this is a decision for the working group since the DTLS draft
> >> is adopted, but the above document isn’t.
> >>

---

From: Tim Wicinski <[email-masked]>
Date: Thu, 12 Nov 2015 11:59:03 -0800

(as chair)

I don't see the point in holding up this document for the other DTLS 
document(s).   Using the "running code" practice, there is code out here 
which supports dns-over-tls.   The authors of dns-over-dtls do not have 
a plan to implement any solutions at this time.  However, as chair, I've 
reached out and I do believe some of the folks who have implemented the 
current dns-over-tls solution work on a proof of concept of dns-over-dtls.

I'll chat with Warren about this, but I don't see the reasons to hold 
this one for now.

tim

---

From: Tim Wicinski <[email-masked]>
Date: Fri, 13 Nov 2015 03:31:19 -0800

All,

The WGLC has finished, and it appears to be rough consensus on moving 
forward.  I want to touch base with my co-chair and AD on one issue, but 
I will work on the Shepherd write up over the next few days and submit 
it into the pipeline. I plan on mentioning the issues raised about 
waiting for other documents before moving forward in my shepherd notes.

tim

On 10/22/15 2:23 AM, Warren Kumari wrote:
> Dear DPRIVE WG,
>
> The authors of draft-ietf-dprive-dns-over-tls-01 have indicated that
> they believe that the document is ready, and have asked for Working
> Group Last Call.
>
> The draft is available here:
> https://datatracker.ietf.org/doc/draft-ietf-dprive-dns-over-tls-01/
>
> Please review this draft to see if you think it is ready for
> publication and send comments to the DPRIVE list, clearly stating your
> view.
>
> We have chosen to run this WGLC during the IETF meeting, and have it
> end after the meeting. This will allow us use meeting time to discuss
> contentious WGLC issues (if any).
> This will be a 3 week WGLC, and ends Thu 12-Nov-2015.
>
>
> To satisfy RFC 6702 ("Promoting Compliance with Intellectual Property
> Rights (IPR)"):
> Are you personally aware of any IPR that applies to
> draft-ietf-dprive-dns-over-tls-01?  If so, has this IPR been disclosed
> in compliance with IETF IPR rules? (See RFCs 3979, 4879, 3669, and
> 5378 for more details.)
>
> Thanks,
> Warren Kumari
> (as DPRIVE WG co-chair)
>
>

---

From: "Paul Hoffman" <[email-masked]>
Date: Fri, 13 Nov 2015 08:22:51 -0800

On 13 Nov 2015, at 3:31, Tim Wicinski wrote:

> forward.  I want to touch base with my co-chair and AD on one issue, 
> but I will work on the Shepherd write up over the next few days and 
> submit it into the pipeline. I plan on mentioning the issues raised 
> about waiting for other documents before moving forward in my shepherd 
> notes.

Just to be clear: do the chairs read the rough consensus to be that the 
draft needs to remove Sections 3.2 and all of Section 4, and move them 
to a new document?

--Paul Hoffman

---

From: Tim Wicinski <[email-masked]>
Date: Fri, 13 Nov 2015 08:28:46 -0800

> draft needs to remove Sections 3.2 and all of Section 4, and move them

Yes, I do (once I remembered).  I am circling back with the others,  but 
I believe this is the case.

I'm also waiting for the -02 before actioning.

tim

---

From: "Paul Hoffman" <[email-masked]>
Date: Fri, 13 Nov 2015 08:39:48 -0800

On 13 Nov 2015, at 8:28, Tim Wicinski wrote:

> Yes, I do (once I remembered).  I am circling back with the others,  
> but I believe this is the case.
>

I propose that you also wait for the companion document that has the 
material from those removed sections, plus stuff from the -over-DTLS 
document. That is, this document needs to have a normative reference to 
new one, not just a hole.

--Paul Hoffman

---

From: Sara Dickinson <[email-masked]>
Date: Fri, 13 Nov 2015 17:13:00 +0000

> On 13 Nov 2015, at 16:39, Paul Hoffman <[email-masked]> wrote:
> 
>> Yes, I do (once I remembered).  I am circling back with the others,  but I believe this is the case.

Ah, this isn’t my recollection. The proposed changes were much smaller, the order of a few sentences in section 4.2 just to update the authentication profile. The plan for the follow up document was to extend the authentication profiles not completely replace them (and the reference would not normative). 

Sara.

---

From: "Paul Hoffman" <[email-masked]>
Date: Fri, 13 Nov 2015 09:48:24 -0800

Whoops, Sara is right and I was wrong. What the WG agreed to was in the 
slides in Yokohama:

=====
Explicitly state that an upcoming document will define further 
authentication profiles
   Draft in development, will be submitted ASAP

This draft will document Opportunistic and briefly cite the risk-benefit 
for it

This draft will provide a brief sketch of authentication in the case 
where there is a two-way active relationship between the client and the 
server (e.g. enterprise)
=====

Unlike what I said a bit ago, we obviously can't pull out the current 
security requirements and point to a future document: that will never 
fly with the IESG (and nor should it).

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Sat, 14 Nov 2015 02:55:20 +0900

On Sat, Nov 14, 2015 at 1:39 AM, Paul Hoffman <[email-masked]> wrote:
> document. That is, this document needs to have a normative reference to new
> one, not just a hole.

The plan that we'd discussed was that this document would describe how
to do the DNSoTLS bit, and the new document would extend the auth
profiles.

This document would mention opportunistic and the case where there is
an existing trust relationship.

The refernce to the new document would not have to be normative, and
so we could go ahead and publish this - we've heard (anecdotally) that
a number of people would like to test this, but would like to see the
RFC label before spending cycles...

W

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Warren Kumari <[email-masked]>
Date: Sat, 14 Nov 2015 02:59:31 +0900

Doh. Messages passed in the ether.

W

On Sat, Nov 14, 2015 at 2:48 AM, Paul Hoffman <[email-masked]> wrote:
> This draft will document Opportunistic and briefly cite the risk-benefit for
> it
>
> This draft will provide a brief sketch of authentication in the case where
> there is a two-way active relationship between the client and the server
> (e.g. enterprise)
> =====
>
> security requirements and point to a future document: that will never fly
> with the IESG (and nor should it).
>
> --Paul Hoffman
>
>