Subject: Re: [DNSOP] I-D Action: draft-ietf-dnsop-maintain-ds-04.txt

From: Matthijs Mekking <[email-masked]>
Date: Tue, 10 Jan 2017 08:58:05 +0100

I see that IESG has approved this document, but I am still wondering this:

On 01-12-16 13:20, Matthijs Mekking wrote:
> Hi,
>
> I read this again. I still wonder if in the case of DNSSEC Delete
> Algorithm it wouldn't be easier to say: In case the DNSSEC algorithm is
> 0, the Digest/Public Key MUST be ignored.
>
> This way, you don't have to change the CDS/CDNSKEY format defined in RFC
> 7344, most likely causing less problems with deployed software.

Best regards,
   Matthijs

---

From: Paul Wouters <[email-masked]>
Date: Tue, 10 Jan 2017 11:50:37 -0500 (EST)

>>  7344, most likely causing less problems with deployed software.

I personally think the simplification of using all zero's is good. If
someone accidentally changes the wrong number in the DS record when
changing parameters, it will prevent a mistaken delete request. While,
the zone might still fail, at least it won't be forced to go through a
period of insecure while the parental DS gets repopulated.

Paul

---

From: Matthijs Mekking <[email-masked]>
Date: Tue, 10 Jan 2017 18:33:57 +0100

> period of insecure while the parental DS gets repopulated.

I am fine with using all zero's. I just don't think the change in
resource record format is a good idea, dropping the last RDATA field
from the CDS record.

Matthijs

> 
> Paul
> 
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

---

From: Paul Wouters <[email-masked]>
Date: Tue, 10 Jan 2017 12:53:30 -0500 (EST)

> resource record format is a good idea, dropping the last RDATA field

Ohh, I think Matthijs actually found a bug:

The CDS RDATA is identical to the DS RDATA format, which is
according to RFC 4034:

                         1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    |           Key Tag             |  Algorithm    |  Digest Type  |
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
    /                                                               /
    /                            Digest                             /
    /                                                               /
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The draft states:

 	The keying material payload is represented by a single 0.

So the CDS delete entry currently specified as:

    CDS 0 0 0

Should in fact be:

    CDS 0 0 0 0

And similarly, the CDNSKEY is currently specified as:

    CDNSKEY 0 3 0

and should be:

    CDNSKEY 0 3 0 0

Olafur, do you agree? Should we push a new draft version with this fix?

Paul

---

From: Ólafur Guðmundsson <[email-masked]>
Date: Tue, 10 Jan 2017 16:01:13 -0500

Yes I agree,
Push a new version if Tim agrees ?

Olafur

---

From: Paul Wouters <[email-masked]>
Date: Tue, 10 Jan 2017 19:02:33 -0500 (EST)

> Ohh, I think Matthijs actually found a bug:

Fixed in 06 (I forgot the text update in 05). Thanks to Matthijs
for being so persistent in bringing this up. My apologies that
I did not understand your concern before.

Chairs, it is up to you to decide on redoing a LC on this or not.

The diff between 04 and 06 that contains all changes since IETF LC:

https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintain-ds-06.txt&url1=draft-ietf-dnsop-maintain-ds-04.txt

Paul

---

From: tjw ietf <[email-masked]>
Date: Tue, 10 Jan 2017 21:47:50 -0500

Thanks Paul, and double thanks to Matthijs for his diligence in wisely
forcing this.

The new version is minor, but significant.  I don't feel that it needs a
new WGLC, but I want to put the diff between the two versions here so folks
may take a second look.

https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintai
n-ds-06.txt&url1=draft-ietf-dnsop-maintain-ds-04.txt

I'm going back over all the emails I have during the IETF LC process, just
to make sure everything has been addressed.

However, I think it's ready to move forward

thanks
tim

On Tue, Jan 10, 2017 at 7:02 PM, Paul Wouters <[email-masked]> wrote:

> https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintai
> n-ds-06.txt&url1=draft-ietf-dnsop-maintain-ds-04.txt
>
>
> Paul
>

---

From: Matthijs Mekking <[email-masked]>
Date: Wed, 11 Jan 2017 09:21:08 +0100

Thanks, and my apologies for failing to express myself clearer in an
earlier stage.

If next to the Key Tag, Algorithm, Digest Type, the Digest MUST also be
0, there is no longer a change in record *format* and this line
can/should be removed from the draft:

  This is a change in format from strict interpretation of [RFC7344]
  and may cause problems with some deployed software.

Best regards,
  Matthijs

On 11-01-17 03:47, tjw ietf wrote:
> new WGLC, but I want to put the diff between the two versions here so
> folks may take a second look. 
> 
> 
> <https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintain-ds-06.txt&url1=draft-ietf-dnsop-maintain-ds-04.txt>
> 
> I'm going back over all the emails I have during the IETF LC process,
> just to make sure everything has been addressed. 
> 
> On Tue, Jan 10, 2017 at 7:02 PM, Paul Wouters <[email-masked]
> <mailto:[email-masked]>> wrote:
> 
>     <https://tools.ietf.org/rfcdiff?url2=draft-ietf-dnsop-maintain-ds-06.txt&url1=draft-ietf-dnsop-maintain-ds-04.txt>
> 
> 
>     Paul
> 
> 
> 
>