Subject: RE: draft-eastlake-dnsext-cookies-00.txt

From: "Eastlake III Donald-LDE008" <[email-masked]>
Date: Mon, 26 Jun 2006 10:41:41 -0400

Thanks for the comments, see below at @@@ 

-----Original Message-----
From: Kenji Rikitake [mailto:[email-masked]] 
Sent: Monday, June 26, 2006 3:04 AM
To: Eastlake III Donald-LDE008
Cc: [email-masked]
Subject: Re: draft-eastlake-dnsext-cookies-00.txt

In the message
<[email-masked]>
dated Sun, Jun 25, 2006 at 11:08:05PM -0400, Eastlake III Donald-LDE008
<[email-masked]> writes:
> http://www.ietf.org/internet-drafts/draft-eastlake-dnsext-cookies-00.t
> xt

> 4.1 Resolver Cookies

[...]

>    A resolver MUST NOT use the same Resolver Cookie value for queries
to
>    all servers.

> 4.2 Resolver Cookies

[...]

>    A server MUST NOT use the same Server Cookie value for responses to
>    all requests.

The above "all requests" should "all resolvers" if the Section 4.1 says
"all servers".

@@@ Well, the current wording isn't wrong and the situation isn't
exactly parallel due to the inclusion of the Resolver Cookie in the
Server Cookie calculation. I'll think about it.

> 5.3 Implementation Requirements

>    DNS resolvers and servers MUST implement DNS cookies.

>    DNS resolvers SHOULD operate in and be shipped so as to default to
>    the Enabled or Enforced mode for all servers.

>    DNS servers SHOULD operate in and be shipped so as to default to
the
>    Enabled or Enforced mode for all resolvers they are willing to
>    service.

While I agree with the idea that the cookie should be enforced as
possible, I also think making it a MUST as the first paragraph in the
Section 5.3 could not be feasible, regarding the number of current
non-cookie (or just Disabled in Section 5.2) DNS programs.  Any
perspective on the deployment issues?

@@@ With something as widespread as DNS, there will always be old or
simplified new implementations that lack a feature. It's the job of the
IETF to say what is the standard. If a new feature is important enough
that the IETF feels it should be universally implemented, the mechanism
for doing that is to put a mandatory implementation requirement into the
standard. If the IETF decides it is not quite so important, you
presumably put a "SHOULD be implemented" into the standard and some
random amount of time later, partly based on uptake and experience,
upgrade that to a MUST. Or you could put in an even lesser
implementation requirement initially if you weren't sure at all.
Assuming it wanted to go forward with this work, this would initially be
a matter for the working group to decide.

Some questions come into my mind:

* How long (in time, e.g., seconds) or how many DNS packets is a server
or a resolver allowed to retain the same cookie to the other end (making
a pair of server-resolver relationship)?  I guess it depends on the
traffic which the server/resolver handles, though I think some minimum
values of cookie-rollover timing should be suggested.

@@@ If a minimum recommended rollover period was to be included, I'd say
a day.

* SHOULD/MUST a server/resolver change the cookie for each program on
the other end?

@@@ Not completely sure I understand what you mean but I would say no.
Arguably there is really only one logical DNS entity at a host.

Regards,
// Kenji Rikitake

@@@ Thanks,
@@@ Donald

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Kenji Rikitake <[email-masked]>
Date: Tue, 27 Jun 2006 09:41:33 +0900

In the message <[email-masked]>
dated Mon, Jun 26, 2006 at 10:41:18AM -0400,
> Server Cookie calculation. I'll think about it.

I accept, regarding the different requirements you mentioned for the
Resolver and Server Cookies.

> IETF to say what is the standard. [...]

I understand the background phylosophy and have no objection for the
described nature of your I-D.

> @@@ If a minimum recommended rollover period was to be included, I'd say

I have no objection so far, though I feel some more studies are needed.
It also depends on how many different resolvers a server has to
communicate with, for the simultaneous entropy (as in RFC4086)
requirement.

> Arguably there is really only one logical DNS entity at a host.

OK, so only one Cookie Secret bound for an IP address.  Am I right?

Regards,
// Kenji Rikitake