Subject: [dns-privacy] IETF 102 Agenda topics

From: Brian Haberman <[email-masked]>
Date: Mon, 11 Jun 2018 10:00:07 -0400

All,
     Tim & I have requested a 90-minute slot for DPRIVE at IETF 102 in
Montreal. This email is the first solicitation for agenda topics for
that meeting. If you would like to present in Montreal, please send the
chairs ([email-masked]) your request with the following information:

* Topic or draft name
* Presenter name
* Amount of time requested
* Whether it will be a local or remote presentation

The chairs will prioritize the requests based on:

1. WG document/topic
2. Active discussion on mailing list
3. New topics

Regards,
Brian & Tim

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 11 Jun 2018 07:06:07 -0700

Given the large number of responses to the thread about DNS-over-TLS for 
recursive-to-authoritative, I would hope that this topic would have a 
significant part of the meeting. The biggest open topic is 
authentication of the server.

--Paul Hoffman

---

From: Russ Housley <[email-masked]>
Date: Mon, 11 Jun 2018 12:24:51 -0400

> Given the large number of responses to the thread about DNS-over-TLS for recursive-to-authoritative, I would hope that this topic would have a significant part of the meeting. The biggest open topic is authentication of the server.

Should there be something in the server certificate that makes it clear that the server is an authoritative DNS server?  I do not think that an arbitrary Web PKI certificate is sufficient.  At a minimum, I think there should be an extended key usage in the certificate.

Russ

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 11 Jun 2018 11:45:06 -0700

On 11 Jun 2018, at 9:24, Russ Housley wrote:

>> Given the large number of responses to the thread about DNS-over-TLS 
>> for recursive-to-authoritative, I would hope that this topic would 
>> have a significant part of the meeting. The biggest open topic is 
> Should there be something in the server certificate that makes it 
> clear that the server is an authoritative DNS server?  I do not think 
> that an arbitrary Web PKI certificate is sufficient.  At a minimum, I 
> think there should be an extended key usage in the certificate.

This would be a good discussion to have on a thread about the draft, not 
a thread about the agenda topics. :-)

--Paul Hoffman