Subject: [DNSOP] I-D Action: draft-ietf-dnsop-dnssec-dps-framework-10.txt

From: [email-masked]
Date: Sat, 29 Sep 2012 02:28:36 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

	Title           : A Framework for DNSSEC Policies and DNSSEC Practice Statements
	Author(s)       : Fredrik Ljunggren
                          Anne-Marie Eklund Lowinder
                          Tomofumi Okubo
	Filename        : draft-ietf-dnsop-dnssec-dps-framework-10.txt
	Pages           : 28
	Date            : 2012-09-29

Abstract:
   This document presents a framework to assist writers of DNSSEC
   Policies and DNSSEC Practice Statements, such as Domain Managers and
   Zone Operators on both the top-level and secondary level, who are
   managing and operating a DNS zone with Security Extensions (DNSSEC)
   implemented.

   In particular, the framework provides a comprehensive list of topics
   that should be considered for inclusion into a DNSSEC Policy
   definition and Practice Statement.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-dnssec-dps-framework

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-dnsop-dnssec-dps-framework-10

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-dnssec-dps-framework-10

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Fredrik Ljunggren <[email-masked]>
Date: Sat, 29 Sep 2012 11:34:03 +0200

WG Ladies and Gents,

A new version of the DPS framework draft was submitted adressing issues which was raised during the IESG review. During this review four ADs had positions on the draft - three DISCUSSes and one comment, which called for a few edits and a revised version of the draft.

Except editorial changes and additions to the definitions sections, the following changes are of a less insignificant nature:

- the last two paragraphs of section 1.1 (Background) has been deleted as
  those were the source of much of the discussion. These paragraphs were only
  there to provide context, and are not essential to the understanding of the
  document (Unfortunately, the -09 version only had one of the paragraphs
  deleted, which is why there was a submission of a -10 version directly
  afterwards).

- under 4.1.4 (Specification Administration) there has been a clarification
  added which exemplifies procedures for specification change management. This
  is from a comment raised that there are no policy indicator/pointer
  currently in DNS (as in a X.509 certificate, with the policy OID extention),
  and that it is difficult for a relying party to know under which DP or DPS a
  zone manager is currently operating. This situation is also clarified under
  "Security Considerations" in the draft.

- in section 4.5 (Technical security controls) product assurance was
  mistakenly mentioned twice, as text which was supposed to replace a
  paragraph instead was simply added. To adress this, the second to last
  paragraph has been deleted.

Please review as soon as practically feasible.

All the best,

- Fredrik Ljunggren

On 2012-09-29, at 11:28, [email-masked] wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: SM <[email-masked]>
Date: Sat, 29 Sep 2012 09:09:45 -0700

Hi Fredrik,

[i-d-announce@ removed]

At 02:34 29-09-2012, Fredrik Ljunggren wrote:
>A new version of the DPS framework draft was submitted adressing 
>issues which was raised during the IESG review. During this review 
>four ADs had positions on the draft - three DISCUSSes and one 
>comment, which called for a few edits and a revised version of the draft.

Quoting part of the DISCUSS from Russ Housley:

  "Please explain the value of the policy to the parties that rely on
   these signatures.  At a minimum this possibility [change in policy]
   needs to be explained in the Security Considerations."

Which text in draft-ietf-dnsop-dnssec-dps-framework-10 addresses that?

Is the DISCUSS from Sean Turner addressed in this revision?

As a nit on Section 4.8:

  "It may also be appropriate to inform of any identified implications
   on the protection of personally identifiable private information."

I suggest removing the word "private" as the term generally used is 
"personally identifiable information".

Regards,
-sm

---

From: Fredrik Ljunggren <[email-masked]>
Date: Sun, 30 Sep 2012 12:45:30 +0200

Hi SM,

> Which text in draft-ietf-dnsop-dnssec-dps-framework-10 addresses that?

It has been added under "Security Considerations":

 Secondly, there is no way of determining under what policy (if any)	
 DNS data has been signed.  Interested parties must stay informed	
 using the methods which should be described in section 1.4.3	
 (Specification change procedures) of the DPS.

And also exemplified under 4.1.4 of the framework.

> Is the DISCUSS from Sean Turner addressed in this revision?

Yes. Sean's DISCUSS was addressed by the deletion of the two last paragraph in the background section, and by having a dialogue regarding TA distribution and the context of "change of algorithms" in subcomponent 4.6.1.

> I suggest removing the word "private" as the term generally used is "personally identifiable information".

Ok, noted.

- Fredrik

---

From: SM <[email-masked]>
Date: Sun, 30 Sep 2012 09:09:25 -0700

Hi Fredrik,
>And also exemplified under 4.1.4 of the framework.

I found the following text from the Introduction Section more informative:

   'users who rely on signed responses from the DNS ("relying parties")
    to evaluate the strength and security of the DNSSEC chain of trust'

   'for scrutinizing the trustworthiness of the system'.

It doesn't make sense to say "Interested parties must stay informed" 
as the "advance notice of amendments" in Section 4.1.4 sounds like a 
minor detail.

I don't have any strong opinion about any of this.  The document is 
useful to me irrespective of what's in Section 7.

>Yes. Sean's DISCUSS was addressed by the deletion of the two last 
>paragraph in the background section, and by having a dialogue 
>regarding TA distribution and the context of "change of algorithms" 
>in subcomponent 4.6.1.

Thanks for clarifying that and for the work.

Regards,
-sm

---

From: Fredrik Ljunggren <[email-masked]>
Date: Sun, 30 Sep 2012 19:10:14 +0200

On 2012-09-30, at 18:09, SM <[email-masked]> wrote:

> It doesn't make sense to say "Interested parties must stay informed" as the "advance notice of amendments" in Section 4.1.4 sounds like a minor detail.
> 
> I don't have any strong opinion about any of this.  The document is useful to me irrespective of what's in Section 7.

I think it is a fair point to make from Russ, that there are (currently) no standardized in-band methods to determine under what policy a zone manager i currently operating. To find a DPS for a particular zone you may have too google it. I'm all for standardizing a DP/DPS pointer which can be published at the apex of the zone, but that's another RFC, in another WG, another day. First we need to build the concept of the DP/DPS.

Thanks for your support.

- Fredrik