Subject: [DNSOP] Call for Adoption: draft-hardaker-dnsop-nsec3-guidance

From: Benno Overeinder <[email-masked]>
Date: Mon, 10 May 2021 10:55:34 +0200

Hi all,

As a follow-up to the presentation by Wes Hardaker at the IETF 110 DNSOP 
meeting, we want to start a call for adoption of 
draft-hardaker-dnsop-nsec3-guidance on the mailing list.

With the presentation at the DNSOP meeting on IETF 110, there was a 
sufficient general support in the (virtual) room to adopt the draft as a 
working group document.

Now we will start a period of two weeks for the call for adoption of 
draft-hardaker-dnsop-nsec3-guidance on the mailing list.

The draft is available here: 
https://datatracker.ietf.org/doc/draft-hardaker-dnsop-nsec3-guidance/.

Please review this draft to see if you think it is suitable for adoption 
by DNSOP, and comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This call for adoption ends: 24 May 2021

Thanks,

-- Benno

DNSOP co-chair

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 10 May 2021 15:17:08 +0000

I support the adoption of this document as a starting point for NSEC3 guidance. It will be useful for people who help operators when those operators ask "why didn't you tell us what were good choices for the values?".

--Paul Hoffman

---

From: Tony Finch <[email-masked]>
Date: Mon, 10 May 2021 18:20:38 +0100

> https://datatracker.ietf.org/doc/draft-hardaker-dnsop-nsec3-guidance/.

Yes, this is a helpful document that should be adopted by dnsop. I'm happy
to review etc.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  https://dotat.at/
Biscay: Southwest 3 to 5 increasing 5 to 7. Rough, occasionally
moderate in east, becoming very rough in west. Thundery showers. Good,
occasionally poor.

---

From: Daniel Migault <[email-masked]>
Date: Mon, 10 May 2021 13:31:45 -0400

I support the adoption of the document.
Yours,
Daniel

On Mon, May 10, 2021 at 1:21 PM Tony Finch <[email-masked]> wrote:

> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

-- 
Daniel Migault
Ericsson

---

From: Vladimír Čunát <[email-masked]>
Date: Mon, 10 May 2021 19:45:57 +0200

I like the document, but the section on validators recommends not to 
follow requirements from RFC 5155, so I don't expect that best-practice 
track is sufficient.  And I do think we need a similar update to 5155, 
be it in this document or a separate one.

I'd also expect something on limits accepted by secondaries.  And some 
details are probably up to further discussion (e.g. particular numbers 
and SERVFAIL), but I don't think such details would block adoption.

--Vladimir | knot-resolver.cz

---

From: Peter van Dijk <[email-masked]>
Date: Mon, 10 May 2021 21:06:23 +0200

> Please also indicate if you are willing to contribute text, review, etc.

I support adoption of this draft, and am willing to review and
contribute text (in fact, I have already done so at small scale).

I think the draft really deserves some text on when not to use NSEC3 at
all (i.e. when to pick NSEC instead) and I would be happy to contribute
that too, if nobody beats me to it.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/

---

From: Olafur Gudmundsson <[email-masked]>
Date: Mon, 10 May 2021 15:13:12 -0400

I guess I support the document but would like it to say 
“Please do not use NSEC3 but if you have to use NSEC3 use it use these settings”

The document should point how trivial it is to expose most names in NSEC3 signed zone using Graphics cards and dictionaries. 

Olafur

> On May 10, 2021, at 1:20 PM, Tony Finch <[email-masked]> wrote:
>

---

From: Brian Dickson <[email-masked]>
Date: Mon, 10 May 2021 12:14:12 -0700

> that too, if nobody beats me to it.
I support adoption of this draft, and concur with what Peter says
(regarding NSEC).

I'm willing to review and as time permits, contribute text.

Brian

---

From: Paul Wouters <[email-masked]>
Date: Mon, 10 May 2021 15:58:08 -0400 (EDT)

> The document should point how trivial it is to expose most names in NSEC3 signed zone using Graphics cards and dictionaries.

But it should also then say something about opt-out, which might be
harder to agree on (imho: "really, we have the RAM/CPU/SSD/DISK now, you
should not use opt-out")

Paul

---

From: Paul Wouters <[email-masked]>
Date: Mon, 10 May 2021 21:15:31 -0400 (EDT)

> Please review this draft to see if you think it is suitable for adoption by 
> DNSOP, and comments to the list, clearly stating your view.

Please adopt. Willing to review and contribute text.

I think what is missing is a discussion of online signing with nsec3
white lies - it does make it harder to brute force since you can't
grab the full chain of hashed names.

Paul

---

From: Matthijs Mekking <[email-masked]>
Date: Tue, 11 May 2021 09:29:59 +0200

I support the document to become a working group document, and I am 
willing to review.

Best regards,

Matthijs

---

From: Roy Arends <[email-masked]>
Date: Tue, 11 May 2021 09:02:42 +0100

I will contribute text, review, etc. It is suitable for adoption by DNSOP. 

Roy

> On 10 May 2021, at 09:55, Benno Overeinder <[email-masked]> wrote:
> 
> Hi all,
> 
> As a follow-up to the presentation by Wes Hardaker at the IETF 110 DNSOP meeting, we want to start a call for adoption of draft-hardaker-dnsop-nsec3-guidance on the mailing list.
> 
> With the presentation at the DNSOP meeting on IETF 110, there was a sufficient general support in the (virtual) room to adopt the draft as a working group document.
> 
> Now we will start a period of two weeks for the call for adoption of draft-hardaker-dnsop-nsec3-guidance on the mailing list.
> 
> The draft is available here: https://datatracker.ietf.org/doc/draft-hardaker-dnsop-nsec3-guidance/.
> 
> Please review this draft to see if you think it is suitable for adoption by DNSOP, and comments to the list, clearly stating your view.
>

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 11 May 2021 09:15:07 -0700

> “Please do not use NSEC3 but if you have to use NSEC3 use it use these

Thanks Olafur.

I think we originally had some text in there like that, but took it out.
It looks like (currently) there may be consensus to put something like
that in we'll put that on a todo list for the next version.
-- 
Wes Hardaker
USC/ISI

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 11 May 2021 09:17:09 -0700

Vladimír Čunát <[email-masked]> writes:

Hi Vladimír,

Thanks for the comments.

> and SERVFAIL), but I don't think such details would block adoption.

That's certainly an interesting thing to think about, but it starts to
get in between the relationship of primaries and secondaries.  Is that
something that should be "standardized"?

-- 
Wes Hardaker
USC/ISI

---

From: Tony Finch <[email-masked]>
Date: Tue, 11 May 2021 22:33:44 +0100

> something that should be "standardized"?

The draft is operational advice, so I think the relevant advice here is
that if you are signing your zone with sloooow NSEC3 parameters, make sure
your secondaries are willing to serve such a zone first.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  https://dotat.at/
Fair Isle: Cyclonic becoming northeast, 4 to 6. Moderate or rough.
Rain, fog patches. Moderate or good, occasionally very poor.

---

From: Vladimír Čunát <[email-masked]>
Date: Thu, 13 May 2021 10:04:05 +0200

> something that should be "standardized"?

I'm not really a good person to ask about these relationships. Anyway, 
if some values were to get standardized to cause SERVFAIL in validators, 
I would expect also secondaries to refuse them, though perhaps that's 
more of an advice or setting expectations (contrary to the validator 
part which I consider an incompatible change in protocol).  Naturally, 
signers should be at least as strict, too, e.g. refuse to go in the 
range that gets standardized to cause a downgrade.

---

From: Wes Hardaker <[email-masked]>
Date: Fri, 21 May 2021 09:01:13 -0700

> your secondaries are willing to serve such a zone first.

[this is sort of unrelated to the call for adoption, is good discussion
about future text]

So, what guidance do we want to insert?

We have two potential guidance to include: guidance for primaries and
guidance for secondaries.  Maybe something like (better wordsmithing
needed still):

Operators of secondary services should advertise the parameter caps
their servers will support. Primaries need to ensure that secondaries
support the NSEC3 parameters they expect to use in their zones.
Primaries, after changing parameters, should query their secondaries
with appropriate known non-existent queries to verify the secondary
servers are responding as expected.

-- 
Wes Hardaker
USC/ISI

---

From: Puneet Sood <[email-masked]>
Date: Fri, 21 May 2021 19:05:41 -0400

I support adoption of this document to provide guidance for operators to
pick sensible NSEC3 parameters and for expected resolver behavior.

-Puneet

---

From: Loganaden Velvindron <[email-masked]>
Date: Sun, 23 May 2021 11:54:40 +0400

I also support adoption of this document.

On Sat, May 22, 2021 at 3:06 AM Puneet Sood
<puneets=[email-masked]> wrote:
>
> I support adoption of this document to provide guidance for operators to pick sensible NSEC3 parameters and for expected resolver behavior.
>
> -Puneet
>
>

---

From: Benno Overeinder <[email-masked]>
Date: Mon, 24 May 2021 22:52:25 +0200

Dear DNSOP WG,

Thank you for your feedback and willingness to contribute text or review 
the document in the working group.

The two weeks for the call for adoption has ended and with good support 
from the WG, the document is adopted as a WG Internet-Draft.

The chairs will ask the authors to resubmit the document with the name 
draft-ietf-dnsop-nsec3-guidance.

Thanks,

-- Benno

DNSOP co-chair

---

From: Tony Finch <[email-masked]>
Date: Tue, 25 May 2021 11:17:20 +0100

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  https://dotat.at/
South Fitzroy: Northerly 4 to 6 in southeast, otherwise variable 2 to
4. Rough, becoming moderate or rough. Fair. Good.

---

From: Wes Hardaker <[email-masked]>
Date: Tue, 25 May 2021 15:02:08 -0700

> draft-ietf-dnsop-nsec3-guidance.

Excellent,

I've submitted a draft and it's now awaiting your approval.

Thanks to everyone that has submitted comments so far.  We have a bit
more work to do in order to get consensus around a few points, but this
shouldn't be a long process I don't think to get out the door.

Please do drop comments to the list about any changes, or feel free to
submit PRs as well.
-- 
Wes Hardaker
USC/ISI