Subject: [lamps] Starting work to CAA and SHAKE

From: Russ Housley <[email-masked]>
Date: Fri, 15 Sep 2017 15:43:01 -0400

I have been discussing the recharter with EKR, and he agrees that we should get started on this work even though the LAMPS re-charter is blocked on a bit of process.

Having completed the S/MIME 4.0 specifications and updates to support i18n email addresses in PKIX certificates, the LAMPS WG is now ready to work on two additional topics:

1. Specify a discovery mechanism for CAA records to replace the one described in RFC 6844.

2. Specify the use of SHAKE128/256 and SHAKE256/512 for PKIX and S/MIME.

Other topics can be considered when these two are progressing.

CAA

RFC 6844 describes the mechanism by which CAA records relating to a domain are discovered.  Implementation experience has demonstrated an ambiguity in the current processing of CNAME and DNAME records during discovery.  Subsequent discussion has suggested that a different discovery approach would resolve limitations inherent in the current approach.  We have seen at least two individual drafts on this topic.  I would like to have the WG adopt a rfc6844bis as a starting point.

SHAKE

Unlike the previous hashing standards, the SHA-3 functions are the outcome of an open competition.  They have a clear design rationale and have received a lot of public analysis, resulting in great confidence that the SHA-3 family of functions are very secure.  Also, since the design of the SHA-3 functions use a very different construction from the SHA-2 functions, they offer an excellent alternative to the SHA-2 family
of functions.  In particular, SHAKE128/256 and SHAKE256/512 offer security and performance benefits.  We have not seen any individual drafts on this yet.  It seems to me that one draft is needed for PKIX and another draft is needed for CMS and S/MIME.  Is anyone willing to work on them?

Russ

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 16 Sep 2017 12:57:14 +0000

That looks fine to me.  Where you asking the WG for input or something?

---

From: "Dr. Pala" <[email-masked]>
Date: Sat, 16 Sep 2017 13:40:28 -0600

Hi Russ, all,

does this mean that the other two items that were proposed will not be 
worked on until the two items listed here? Have you considered also the 
other proposals for the charter that were sent sometime ago? I was under 
the impression that there was interest in both items...

Cheers,
Max

On 9/15/17 1:43 PM, Russ Housley wrote:
> _______________________________________________
> Spasm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spasm

---

From: Russ Housley <[email-masked]>
Date: Sun, 17 Sep 2017 12:08:52 -0400

Max:

>> Other topics can be considered when these two are progressing.

There was clear interest in this two, but it is not clear that the others have the same level of interest.  When we work on the charter text, people will have an opportunity to advocate for others topics to be included.

Russ

---

From: Russ Housley <[email-masked]>
Date: Sun, 17 Sep 2017 12:16:56 -0400

> That looks fine to me.  Where you asking the WG for input or something?

We have two documents on CAA:
	- https://www.rfc-editor.org/errata/eid5065
	- https://www.ietf.org/id/draft-hoffman-andrews-caa-simplification-01.txt

How does the mail list want to proceed?

My note got one person to raise their hand to work on the SHAKE document.  Once that is posted as an individual draft, we can see if the mail list wants to adopt it.

Russ

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 17 Sep 2017 14:17:07 -0400

I am willing to edit the CAA document.

I think the main thing there is to decide what we actually want to do with
the DNS discovery scheme.

So the first thing is to capture the issues from deployment last week.

On Sun, Sep 17, 2017 at 12:16 PM, Russ Housley <[email-masked]> wrote:

> My note got one person to raise their hand to work on the SHAKE document.
> Once that is posted as an individual draft, we can see if the mail list
> wants to adopt it.
>
> Russ
>

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 17 Sep 2017 21:57:25 +0000

I’m will get DNS folks to help with whatever we do on CAA.  I think a brand new doc might be better than still working the errata.  Phill would be a fine editor.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 17 Sep 2017 18:26:20 -0400

Thinking about the issue a bit more. What I think we probably need is a
substantial appendix or a separate section setting out all the curlicues
and complications of the discovery algorithm.

It is not just the CNAME issue that is causing problems, it is also the
DNSSEC part. And in particular it is the fact that DNSSEC causes DNAMEs to
appear on the wire as CNAMEs.

On Sun, Sep 17, 2017 at 5:57 PM, Salz, Rich <[email-masked]> wrote:

> I’m will get DNS folks to help with whatever we do on CAA.  I think a
> brand new doc might be better than still working the errata.  Phill would
> be a fine editor.
>
>
>

---

From: "Dang, Quynh (Fed)" <[email-masked]>
Date: Mon, 18 Sep 2017 11:04:36 +0000

Hi Russ and all,

Yes, I am willing to work on the item 2.

Regards,

Quynh.

________________________________
From: Spasm <[email-masked]> on behalf of Russ Housley <[email-masked]>
Sent: Friday, September 15, 2017 3:43:01 PM
To: [email-masked]
Subject: [lamps] Starting work to CAA and SHAKE

CAA

SHAKE

Russ

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Mon, 18 Sep 2017 14:36:08 +0000

+1
Happy to work with Quynh on the X.509 SHAKE draft as well.
Panos

From: Spasm [mailto:[email-masked]] On Behalf Of Dang, Quynh (Fed)
Sent: Monday, September 18, 2017 7:05 AM
To: Russ Housley <[email-masked]>; [email-masked]
Subject: Re: [lamps] Starting work to CAA and SHAKE

Hi Russ and all,

Regards,

Quynh.

________________________________
From: Spasm <[email-masked]<mailto:[email-masked]>> on behalf of Russ Housley <[email-masked]<mailto:[email-masked]>>
Sent: Friday, September 15, 2017 3:43:01 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [lamps] Starting work to CAA and SHAKE

CAA

SHAKE

Russ
_______________________________________________
Spasm mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/spasm