Subject: [dane] Adding a new appendix section A.1.4

From: "Jim Schaad" <[email-masked]>
Date: Mon, 15 Aug 2011 16:54:18 -0700

At present I do not have any suggested text for this section because I do
not know enough details about how this would work.  However I would like to
see the addition of a new section A.1.4 Delegation of Provisioning TLSA
Records.

This section would discuss the use of NS records to delegate an entire
subtree of an existing name space to a service provider.  This should
discuss the issues involved with coordination of key records.

Jim

---

From: "Jim Schaad" <[email-masked]>
Date: Tue, 16 Aug 2011 12:34:10 -0700

The use of NS records is one way to delegate all information about a single
server to an outsource provider and allow it to do all of the necessary
record maintenance as well as populate the TLSA records as needed for that
server.   This provides one method that can be used to support the use case
of Alice delegating to Oscar the support for a single server in the tree,
while allowing for minimal work by Alice.  If this method of delegation is
used, then Oscar and Alice need to coordinate the rollover of the DNSSEC
keys in order to keep the information properly signed.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]
> Sent: Tuesday, August 16, 2011 6:35 AM
> To: Jim Schaad
> Cc: [email-masked]
> Subject: Re: [dane] Adding a new appendix section A.1.4
> 
> On Mon, Aug 15, 2011 at 04:54:18PM -0700, Jim Schaad wrote:
> > At present I do not have any suggested text for this section because I
> > do not know enough details about how this would work.  However I would
> > like to see the addition of a new section A.1.4 Delegation of
> > Provisioning TLSA Records.
> >
> 	what would that look like?
> 
> /bill

---

From: [email-masked]
Date: Tue, 16 Aug 2011 22:58:51 +0000

NS rr's are used to define a cut point in the DNS namespace in conjunction 
with the SOA rr.

I'm not sure I can code what you are attempting to describe below with existant
DNS rr types.

can you show some DNS configuration fragments that clearly articulate your 
claim that Alice can delegte to Oscar a single entry in the dns namespace?

or are you suggesting something like this::

example.net.  in soa  ( );

	in ns  foo
	in ns  bar
;
bill	in a 127.0.53.12
	in tlsa [bill-goop]
;
jim	in soa ( );
jim.example.com. in ns tick
		 in ns tock
	in tlsa [jim-goop]
;
$ORIGIN example.net.
paul	in a 127.0.53.13

---

From: [email-masked]
Date: Tue, 16 Aug 2011 13:34:58 +0000

/bill

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 17 Aug 2011 13:55:59 -0700

I do not know enough about DNS to be able to give you the correct items.
Note however that I am not trying to delegate a single entry but an entire
subtree.  This should make it easier.

Jim

> Sent: Tuesday, August 16, 2011 3:59 PM
> To: Jim Schaad
> Cc: [email-masked]; [email-masked]
> I'm not sure I can code what you are attempting to describe below with
> existant DNS rr types.
> 
> > The use of NS records is one way to delegate all information about a
> > single server to an outsource provider and allow it to do all of the
> > necessary record maintenance as well as populate the TLSA records as
> needed for that
> > of Alice delegating to Oscar the support for a single server in the
> > tree, while allowing for minimal work by Alice.  If this method of
> > delegation is used, then Oscar and Alice need to coordinate the
> > rollover of the DNSSEC keys in order to keep the information properly
> signed.
> >
> > > > At present I do not have any suggested text for this section
> > > > because I do not know enough details about how this would work.
> > > > However I would like to see the addition of a new section A.1.4
> > > > Delegation of Provisioning TLSA Records.
> > > >
> > > > This section would discuss the use of NS records to delegate an
> > > > entire subtree of an existing name space to a service provider.
> > > > This should discuss the issues involved with coordination of key
records.

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 22 Aug 2011 17:53:51 -0400

> jim.example.com. in ns tick

My reading of the thread is that the above is exactly what's being
suggested.  That is, it causes a delegation of jim.example.com away
(although I think the .com is a typo, right?  Shouldn't it be .net?)

The confusion here is the "subtree" thing.  You'll need glue on the
parent side of this cut too, I expect, but then you'll be able to put
the records you want on the child side, I should think, since the
child is authoritative for the data.

A

-- 
Andrew Sullivan
[email-masked]