Subject: [dns-privacy] Addressing the DISCUSS points raised by the IESG on draft-ietf-dprive-xfr-over-tls-11

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 5 May 2021 06:15:23 +0000

[Message sent to authors, WG, and the DISCUSS-holding area directors]

As you have seen by now[1], this document has raised at least two blocking DISCUSS points and those points will be discussed during Thursday 6th of May telechat (i.e., tomorrow in my timezone).

My own reading of those DISCUSS ballots (perhaps more ballots to come):
- not using ALPN code
- text about the comparison between IP ACL and crypto authentications

If possible, then I would appreciate some replies before the telechat by the authors on the recent Ben Kaduk’s points as Allison Mankin’s reply [2] (as well as Sara Dickinson’s ones) has already addressed Martin Duke’s concern about ALPN.

The WG view on using ALPN is also important to move forward as it is an important technical change.

As usual, everyone is welcome to join the telechat [3] as observer, it should be a short one.

Thank you in advance for your replies (again if possible),

Regards

-éric

[1] https://datatracker.ietf.org/doc/draft-ietf-dprive-xfr-over-tls/ballot/
[2] https://mailarchive.ietf.org/arch/msg/dns-privacy/HaQ7SO8Ma9TW3v0Wrh18LD6BNy8/
[3] https://mailarchive.ietf.org/arch/msg/ietf-announce/X7t76SwcK1fjMQsGb2Wy11R-cnw/

---

From: Ben Schwartz <[email-masked]>
Date: Wed, 5 May 2021 06:59:55 -0700

ALPN: I think we should say that the ALPN is "dot", and use of ALPN is
OPTIONAL.

ACLs: IP ACLs, if present, should be applied before the TLS handshake, for
DoS defense.  Operators who want to maintain secret zone contents SHOULD
use cryptographic authentication instead.

On Tue, May 4, 2021 at 11:15 PM Eric Vyncke (evyncke) <evyncke=
[email-masked]> wrote:

> As you have seen by now[1], this document has raised at least two blocking
> DISCUSS points and those points will be discussed during Thursday 6th of
> May telechat (i.e., tomorrow in my timezone).
>
>
>
> If possible, then I would appreciate some replies before the telechat by
> the authors on the recent Ben Kaduk’s points as Allison Mankin’s reply [2]
> (as well as Sara Dickinson’s ones) has already addressed Martin Duke’s
> concern about ALPN.
>
>
>
> [1]
> https://datatracker.ietf.org/doc/draft-ietf-dprive-xfr-over-tls/ballot/
>
> [2]
> https://mailarchive.ietf.org/arch/msg/dns-privacy/HaQ7SO8Ma9TW3v0Wrh18LD6BNy8/
>
> [3]
> https://mailarchive.ietf.org/arch/msg/ietf-announce/X7t76SwcK1fjMQsGb2Wy11R-cnw/
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>