Subject: Re: [dane] Call for Agenda items

From: Ondřej Surý <[email-masked]>
Date: Tue, 11 Jun 2013 11:09:24 +0200

Dear WG members,

we haven't heard from you and we still don't have any agenda items.

I would like to check, if there's any interest to meet in Berlin at all?  And if the answer is yes then we will still need agenda items in that case – meeting without agenda could be very calm and serene, but also a waste of time and time slot.

O.

On 31. 5. 2013, at 19:35, Warren Kumari <[email-masked]> wrote:

> 
> On May 25, 2013, at 1:09 PM, Warren Kumari <[email-masked]> wrote:
> 
>> Hi all,
>> 
>> It seems that we probably have enough new material / discussions to warrant meeting in Berlin.
>> 
>> So, please let us know, by the end of the month, if you'd like time on the agenda.
> 
> So far it seems we only have a request from Viktor to discuss his drafts / lessons learnt from implementing -- this is also a gentle nudge to read and comment on them.
> 
> It is not 100% clear yet that Viktor will be able to attend in person, but it seems like we may have a proxy if not.
> 
> I'm guessing that more folk have things to discuss? Like Tony's docs? Or is everything so happy that we don't need to meet?
> 
> W
> 
>> As always, we give preference to issues / documents that have had some discussion
>> on the mailing list, but need real-time, fact-to-face discussions to properly resolve.
>> Seeing as we now have some implementations (thanks!), we'd welcome discussions of those as well.
>> 
>> W
>> 
>> P.S: Apologies for this coming somewhat late -- I picked up (what I'm convinced is) bird flu at RIPE in Dublin the week before last...
>> 
>> 
>> --
>> I once absend-mindedly ordered Three Mile Island dressing in a restaurant and, with great presence of mind, they brought Thousand Island Dressing and a bottle of chili sauce.
>>   -- Terry Pratchett
>> 
>> 
> 
> --
> I once absend-mindedly ordered Three Mile Island dressing in a restaurant and, with great presence of mind, they brought Thousand Island Dressing and a bottle of chili sauce.
>    -- Terry Pratchett
> 
> 
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

--
 Ondřej Surý -- Chief Science Officer
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Viktor Dukhovni <[email-masked]>
Date: Tue, 11 Jun 2013 14:30:06 +0000

On Tue, Jun 11, 2013 at 11:09:24AM +0200, Ond?ej Sur? wrote:

> I would like to check, if there's any interest to meet in Berlin
> at all?  And if the answer is yes then we will still need agenda
> items in that case ? meeting without agenda could be very calm and
> serene, but also a waste of time and time slot.

I have two new drafts, operational guidance and the opportunistic
SMTP and a partner-in-crime to present them.  There will be at
least one (Postfix) and in the new future two (work will be in
progress on Exim) implementations of DANE for SMTP aligned with
those drafts.

    * Certificate usage     suppress PKIX, map 0 -> 2, 1 -> 3.
    * With usage 3, the certificate is not inspected beyond matching
      against a TLSA RR.  No name checks, no expiration checks, ...
      With "IN TLSA 3 1 1" we have a compact binding to just the public
      key.
    * "IN TLSA 0 x [12]" -> treated unusable
    * "IN TLSA 2 x [12]" -> assumed usable (configurable to unusable),
			    server operators expected to universally
			    include the TA cert in TLS handshake chain. 
    * Postfix will chase MX host CNAME RRs to obtain TLSA base domain.
      Don't know what Exim will do.
    * Postfix will ignore everything in a trust anchor certificate,
      except the public key.  PKIX rules apply only to the chain
      below the trust-anchor (a trust anchor is just a public key).
      Thus, in particular, "IN TLSA 2 1 0" is supported, even without
      a matching certificate in the chain.

One important question is whether to combine Tony's draft with
mine.  Or whether the group would prefer a more conservative SMTP
draft that applies DANE to SMTP "by the book" (and does not reflect
fielded implementations.  I would prefer to see a combined draft
more along the lines of mine that applies DANE in the context of
the practical realities (and actual implementations) of SMTP.

It would sure be nice to get some constructive feedback before
Berlin.

If there is interest, and Wes is willing to run it, there could be
an implementation BoF.  There is evidence that naive implementations
miss key security requirements, so if enough people who want to
write implementations there could be a session on that.

I will not be able to attend, but may be available via Skype or
other remote presence.

-- 
	Viktor.