Subject: [BEHAVE] [Technical Errata Reported] RFC7050 (5152)

From: RFC Errata System <[email-masked]>
Date: Tue, 10 Oct 2017 21:45:48 -0700 (PDT)

The following errata report has been submitted for RFC7050,
"Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5152

--------------------------------------
Type: Technical
Reported by: Mark Andrews <[email-masked]>

Section: IANA Conside

Original Text
-------------
N/A 

Corrected Text
--------------
8.x DNSSEC

    ipv4only.arpa MUST be insecurely delegated.  This allows ISP's to
    modify / generate AAAA responses for ipv4only.arpa AAAA queries that
    will pass through unmodified caching servers as required by 8.1 (4).

Notes
-----
The protocol as described does not work when there is a validating caching server in the resolution path.  

IANA should have been instructed to insecurely delegate ipv4only.arpa.  This allows ISP's to modify the
AAAA response without running foul of DNSSEC  validation.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7050 (draft-ietf-behave-nat64-discovery-heuristic-17)
--------------------------------------
Title               : Discovery of the IPv6 Prefix Used for IPv6 Address Synthesis
Publication Date    : November 2013
Author(s)           : T. Savolainen, J. Korhonen, D. Wing
Category            : PROPOSED STANDARD
Source              : Behavior Engineering for Hindrance Avoidance
Area                : Transport
Stream              : IETF
Verifying Party     : IESG

---

From: Dan Wing <[email-masked]>
Date: Fri, 13 Oct 2017 16:16:15 -0700

Verified.

The proposed text is one approach.  Another approach is that used by DNS RPZ (https://tools.ietf.org/html/draft-ietf-dnsop-dns-rpz) so that ipv4only.arpa can be signed and the client queries with DO=0 to get synthesized response, and can query with DO=1 to get the DNSSEC-signed response, but that can incur problems with caches.  I think Mark's suggestion is best, but it's worth discussing with a wider audience.

-d

> On Oct 10, 2017, at 9:45 PM, RFC Errata System <[email-masked]> wrote:
>