Subject: [DNSOP] DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 11 Mar 2020 18:19:24 +0000

(Sorry, this is a late response to a review request original sent to the dnsop list on 11 February)

Section 3.4 (DNS for Cloud Resources) includes these sentences:

"Globally unique names do prevent any possibility of collision at the present or in the future and they make DNSSEC trust manageable. It's not as if there is or even could be some sort of shortage in available names that can be used, especially when subdomains and the ability to delegate administrative boundaries are considered."

Could we make the last sentence stronger, perhaps with a statement like this from the US CERT WPAD Name Collision Vulnerability alert dated May 23, 2016?

"Globally unique names do prevent any possibility of collision at the present or in the future and they make DNSSEC trust manageable. Consider using a registered and fully qualified domain name (FQDN) from global DNS as the root for enterprise and other internal namespaces."

https://www.us-cert.gov/ncas/alerts/TA16-144A

The alert actually says "other internal namespace", but I think that's a typo.

Scott

---

From: Morizot Timothy S <[email-masked]>
Date: Wed, 11 Mar 2020 18:38:51 +0000

Yes, I believe that suggestion is much stronger and expresses the intent and meaning better.

Thanks,

Scott

---

From: Michael StJohns <[email-masked]>
Date: Wed, 11 Mar 2020 14:53:04 -0400

On 3/11/2020 2:19 PM, Hollenbeck, Scott wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop

Hi - I haven't read this document except for to scan it for context for 
the above.  What triggered me was the combination of "DNSSEC" and 
"unique names".

Either of these may not be accurate statements.   While DNS names can be 
globally unique, the glyph representations that we depend upon can map 
to multiple actual DNS names.  See 
https://en.wikipedia.org/wiki/IDN_homograph_attack

Please consider whether this is an issue here.  It may not be, but if 
not, probably worth a sentence in the security considerations section.

Later, Mike

---

From: Linda Dunbar <[email-masked]>
Date: Mon, 16 Mar 2020 17:00:39 +0000

Scott, 

Thank you very much for the suggestion. Have changed the text per your suggestion. Will upload the new version when the IETF submission opens up next Monday. 

Linda

-----Original Message-----
From: Hollenbeck, Scott <[email-masked]> 
Sent: Wednesday, March 11, 2020 1:19 PM
To: Linda Dunbar <[email-masked]>
Cc: [email-masked]
Subject: DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08

https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.us-cert.gov%2Fncas%2Falerts%2FTA16-144A&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cc4a7c2f2e85741d5b8a308d7c5e8eef1%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C1%7C637195476559397274&amp;sdata=vBnDcnkZ8Zsk7MT610GQOsRQVt7G%2BLscbvwiDWXX%2Fvc%3D&amp;reserved=0

Scott

---

From: Linda Dunbar <[email-masked]>
Date: Wed, 18 Mar 2020 22:53:43 +0000

Scott, 
Here is the revised version with your suggested changes incorporated: https://datatracker.ietf.org/doc/draft-ietf-rtgwg-net2cloud-problem-statement/

Thank you very much for the review and suggestion. 

Linda Dunbar

-----Original Message-----
From: Linda Dunbar 
Sent: Monday, March 16, 2020 12:01 PM
To: Hollenbeck, Scott <[email-masked]>
Cc: [email-masked]; [email-masked]
Subject: RE: DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08

Scott, 

Linda

-----Original Message-----
From: Hollenbeck, Scott <[email-masked]> 
Sent: Wednesday, March 11, 2020 1:19 PM
To: Linda Dunbar <[email-masked]>
Cc: [email-masked]
Subject: DNS for Cloud Resources in draft-ietf-rtgwg-net2cloud-problem-statement-08

Scott

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 19 Mar 2020 11:32:21 +0000

You're welcome, and thanks for accepting the suggestion.

Scott

> From: Linda Dunbar <[email-masked]>
> Sent: Wednesday, March 18, 2020 6:54 PM
> Subject: [EXTERNAL] RE: DNS for Cloud Resources in draft-ietf-rtgwg-
> net2cloud-problem-statement-08
>
> Scott,
> Here is the revised version with your suggested changes incorporated:
> https://datatracker.ietf.org/doc/draft-ietf-rtgwg-net2cloud-problem-
> statement/
>
>
> Thank you very much for the suggestion. Have changed the text per your
> suggestion. Will upload the new version when the IETF submission opens up
> next Monday.
>
> Linda
>
> "Globally unique names do prevent any possibility of collision at the present
> or in the future and they make DNSSEC trust manageable. It's not as if there
> is or even could be some sort of shortage in available names that can be
> used, especially when subdomains and the ability to delegate administrative
> boundaries are considered."
>
> Could we make the last sentence stronger, perhaps with a statement like this
> from the US CERT WPAD Name Collision Vulnerability alert dated May 23,
> 2016?
>
> "Globally unique names do prevent any possibility of collision at the present
> or in the future and they make DNSSEC trust manageable. Consider using a
> registered and fully qualified domain name (FQDN) from global DNS as the
> root for enterprise and other internal namespaces."
>
> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fww
> w.us-cert.gov%2Fncas%2Falerts%2FTA16-
> 144A&amp;data=02%7C01%7Clinda.dunbar%40futurewei.com%7Cc4a7c2f2e
> 85741d5b8a308d7c5e8eef1%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C
> 1%7C637195476559397274&amp;sdata=vBnDcnkZ8Zsk7MT610GQOsRQVt7G
> %2BLscbvwiDWXX%2Fvc%3D&amp;reserved=0
>