Subject: Re: [dane] I-D Action: draft-ietf-dane-smime-12.txt

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 01 Aug 2016 07:42:28 -0700

Jakob and I think this addresses all the actionable comments we got in 
WG Last Call.

--Paul Hoffman

On 31 Jul 2016, at 23:14, [email-masked] wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts 
> directories.
> This draft is a work item of the DNS-based Authentication of Named 
> Entities of the IETF.
>
>         Title           : Using Secure DNS to Associate Certificates 
> with Domain Names For S/MIME
>         Authors         : Paul Hoffman
>                           Jakob Schlyter
> 	Filename        : draft-ietf-dane-smime-12.txt
> 	Pages           : 11
> 	Date            : 2016-07-31
>
> Abstract:
>    This document describes how to use secure DNS to associate an 
> S/MIME
>    user's certificate with the intended domain name, similar to the 
> way
>    that DANE (RFC 6698) does for TLS.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-dane-smime/
>
> There's also a htmlized version available at:
> https://tools.ietf.org/html/draft-ietf-dane-smime-12
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-dane-smime-12
>
>
> Please note that it may take a couple of minutes from the time of 
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Paul Wouters <[email-masked]>
Date: Mon, 1 Aug 2016 12:17:31 -0400 (EDT)

On Mon, 1 Aug 2016, Paul Hoffman wrote:

> Jakob and I think this addresses all the actionable comments we got in WG 
> Last Call.

You added:

 	9.1.  Response Size

 		 	   To prevent amplification attacks, an Authoritative DNS server MAY
 		 	   wish to prevent returning SMIMEA records over UDP unless the source
 		 	   IP address has been confirmed with [RFC7873].  Such servers MUST NOT
 		 	   return REFUSED, but answer the query with an empty answer section and
 		 	   the truncation flag set ("TC=1").

I do not find this text very clear. I propose:

 		 	   To prevent amplification attacks, an Authoritative DNS server MAY
 		 	   wish to prevent returning SMIMEA records over UDP unless the source
 		 	   IP address has been confirmed with [RFC7873].  If a query is received
                            via UDP without source IP address verification, the server MUST NOT
 		 	   return REFUSED, but answer the query with an empty answer section and
 		 	   the truncation flag set ("TC=1").

All other issues I raised were resolved with this updated draft.

Paul

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 01 Aug 2016 11:17:07 -0700

On 1 Aug 2016, at 9:17, Paul Wouters wrote:

>> Jakob and I think this addresses all the actionable comments we got 
>> in WG Last Call.
>
> You added:
>
> 	9.1.  Response Size
>

This seems fine; I'll queue it for the next draft after IETF Last Call.

> All other issues I raised were resolved with this updated draft.

Great, thanks.

--Paul Hoffman