From ondrej.sury@nic.cz Tue Jul 10 01:10:22 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E28A921F85C9 for ; Tue, 10 Jul 2012 01:10:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vpfn7wz87kRC for ; Tue, 10 Jul 2012 01:10:21 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) by ietfa.amsl.com (Postfix) with ESMTP id 2F95C21F860B for ; Tue, 10 Jul 2012 01:10:10 -0700 (PDT) Received: from [192.168.80.34] (unknown [193.239.202.213]) by mail.nic.cz (Postfix) with ESMTPSA id 0B2E7141115; Tue, 10 Jul 2012 10:10:37 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.cz; s=default; t=1341907837; bh=QRvx9TgyloVtd/Z7/ChY+ffQw3U/hDTVY4NaPQ2YBF4=; h=From:Content-Type:Subject:Date:Message-Id:To:Mime-Version; b=Zte5law3h+Ckq7k6UiIrfFrRIeazKprCl530tbWm8QJY5lkxP3istM9uZ3pR6+aQf uyPymq8ut1Vk+tX49C3BG+S7t4RiYjhZQsMloTHZqITm2OFCZDOz06gvDRYPm7PKsH 8B+5yf5RIfRVZaSfIXn8YIeL/Nm8484PCAvqTR7M= From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= Content-Type: multipart/mixed; boundary="Apple-Mail=_AEADA954-5F01-4290-BF2C-211A179C306C" Date: Tue, 10 Jul 2012 10:10:35 +0200 Message-Id: To: dane-chairs@tools.ietf.org, dane WG list Mime-Version: 1.0 (Apple Message framework v1278) X-Mailer: Apple Mail (2.1278) X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Subject: [dane] Preliminary agenda for IETF 84 X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2012 08:10:22 -0000 --Apple-Mail=_AEADA954-5F01-4290-BF2C-211A179C306C Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii Hi, I have created draft agenda from what I have heard on/off-list. Please see attached file and object if you want to change anything. --Apple-Mail=_AEADA954-5F01-4290-BF2C-211A179C306C Content-Disposition: attachment; filename=draft-dane-agenda-ietf84.txt Content-Type: text/plain; name="draft-dane-agenda-ietf84.txt" Content-Transfer-Encoding: 7bit DNS-based Authentication of Named Entities (DANE) WG MONDAY, July 30 2012 1300-1500 Regency F ===================================================== CHAIR(s): Warren Kumari Ondrej Sury o Administrivia 15 minutes Chairs - Note Well - Scribe / Minutes - Blue Sheets == New work == o draft-fanf-dane-smtp 15 minutes Secure inter-domain SMTP with TLS, DNSSEC and TLSA records Paul Hoffman o draft-hoffman-dane-smime 15 minutes Using Secure DNS to Associate Certificates with Domain Names For S/MIME Paul Hoffman or Jakob Schlyter o draft-miller-xmpp-dnssec-prooftype 15 minutes Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations Peter Saint-Andre o The future of DANE? Rechartering 30 minutes + The protocol doc is done. What has to be done next? Do we: - recharter and take new work - go to hiatus - close the WG + What to do with existing drafts in case we close? Individual drafts? Ondrej / Warren. o Any other business Time-left Open mic / performance art. Everyone. --Apple-Mail=_AEADA954-5F01-4290-BF2C-211A179C306C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 O. -- Ond=C5=99ej Sur=C3=BD -- Chief Science Officer ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=C5=99e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- --Apple-Mail=_AEADA954-5F01-4290-BF2C-211A179C306C-- From warren@kumari.net Tue Jul 10 17:43:51 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6DA611E80A1 for ; Tue, 10 Jul 2012 17:43:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.049 X-Spam-Level: X-Spam-Status: No, score=-106.049 tagged_above=-999 required=5 tests=[AWL=-0.350, BAYES_00=-2.599, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8hwYpOliw7yD for ; Tue, 10 Jul 2012 17:43:50 -0700 (PDT) Received: from vimes.kumari.net (vimes.kumari.net [198.186.192.250]) by ietfa.amsl.com (Postfix) with ESMTP id BBD0311E8104 for ; Tue, 10 Jul 2012 17:43:50 -0700 (PDT) Received: from [192.168.0.12] (unknown [64.13.52.115]) by vimes.kumari.net (Postfix) with ESMTPSA id 404091B40B83; Tue, 10 Jul 2012 20:44:19 -0400 (EDT) Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=utf-8 From: Warren Kumari In-Reply-To: Date: Tue, 10 Jul 2012 20:44:27 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= X-Mailer: Apple Mail (2.1278) Cc: dane-chairs@tools.ietf.org, dane WG list Subject: Re: [dane] Preliminary agenda for IETF 84 X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2012 00:43:51 -0000 On Jul 10, 2012, at 4:10 AM, Ond=C5=99ej Sur=C3=BD wrote: > Hi, >=20 > I have created draft agenda from what I have heard on/off-list. >=20 > Please see attached file and object if you want to change anything. No objections from me, but thanks to Ondrej for organizing this, I've = been asleep at the wheel=E2=80=A6 W >=20 > >=20 > O. > -- > Ond=C5=99ej Sur=C3=BD -- Chief Science Officer > ------------------------------------------- > CZ.NIC, z.s.p.o. -- Laborato=C5=99e CZ.NIC > Americka 23, 120 00 Praha 2, Czech Republic > mailto:ondrej.sury@nic.cz http://nic.cz/ > tel:+420.222745110 fax:+420.222745112 > ------------------------------------------- >=20 -- It's a mistake trying to cheer up camels. You might as well drop = meringues into a black hole. -- Terry Prachett From stpeter@stpeter.im Tue Jul 10 17:59:42 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA30E11E8107 for ; Tue, 10 Jul 2012 17:59:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.343 X-Spam-Level: X-Spam-Status: No, score=-102.343 tagged_above=-999 required=5 tests=[AWL=-0.044, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MQ4iLbxFCzis for ; Tue, 10 Jul 2012 17:59:42 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 4D04511E80F9 for ; Tue, 10 Jul 2012 17:59:42 -0700 (PDT) Received: from [192.168.0.9] (unknown [216.17.179.227]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 710474005A; Tue, 10 Jul 2012 19:18:50 -0600 (MDT) Message-ID: <4FFCD01A.9000505@stpeter.im> Date: Tue, 10 Jul 2012 19:00:10 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= References: In-Reply-To: X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: dane-chairs@tools.ietf.org, dane WG list Subject: Re: [dane] Preliminary agenda for IETF 84 X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Jul 2012 00:59:43 -0000 On 7/10/12 2:10 AM, Ondřej Surý wrote: > Hi, > > I have created draft agenda from what I have heard on/off-list. > > Please see attached file and object if you want to change anything. Seems fine. Unfortunately I won't be able to travel to Vancouver, so Matt Miller might present about the XMPP work he and I have been doing. Peter -- Peter Saint-Andre https://stpeter.im/ From fanf2@hermes.cam.ac.uk Fri Jul 13 15:57:44 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F62611E8136 for ; Fri, 13 Jul 2012 15:57:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.091 X-Spam-Level: X-Spam-Status: No, score=-6.091 tagged_above=-999 required=5 tests=[AWL=0.208, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QHugbKVnfK4D for ; Fri, 13 Jul 2012 15:57:42 -0700 (PDT) Received: from ppsw-50.csi.cam.ac.uk (ppsw-50.csi.cam.ac.uk [131.111.8.150]) by ietfa.amsl.com (Postfix) with ESMTP id 971C911E80CB for ; Fri, 13 Jul 2012 15:57:42 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-SpamDetails: not scanned X-Cam-ScannerInfo: http://www.cam.ac.uk/cs/email/scanner/ Received: from hermes-2.csi.cam.ac.uk ([131.111.8.54]:38557) by ppsw-50.csi.cam.ac.uk (smtp.hermes.cam.ac.uk [131.111.8.157]:25) with esmtpa (EXTERNAL:fanf2) id 1SpooQ-0002T7-q4 (Exim 4.72) (return-path ); Fri, 13 Jul 2012 23:58:14 +0100 Received: from fanf2 (helo=localhost) by hermes-2.csi.cam.ac.uk (hermes.cam.ac.uk) with local-esmtp id 1SpooQ-0004GI-3W (Exim 4.67) (return-path ); Fri, 13 Jul 2012 23:58:14 +0100 Date: Fri, 13 Jul 2012 23:58:14 +0100 From: Tony Finch X-X-Sender: fanf2@hermes-2.csi.cam.ac.uk To: =?ISO-8859-2?Q?Ond=F8ej_Sur=FD?= In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (LSU 1167 2008-08-23) MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="1870870024-1949766973-1342219937=:12344" Content-ID: Sender: Tony Finch Cc: dane-chairs@tools.ietf.org, dane WG list Subject: Re: [dane] Preliminary agenda for IETF 84 X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Jul 2012 22:57:44 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1870870024-1949766973-1342219937=:12344 Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-2 Content-Transfer-Encoding: QUOTED-PRINTABLE Content-ID: Ond=F8ej Sur=FD wrote: > > I have created draft agenda from what I have heard on/off-list. > Please see attached file and object if you want to change anything. Could you please add draft-fanf-dane-mua as well? Paul Hoffman has agreed to present and I intend to be joining in remotely. Might be worth re-jigging the order since the -mua draft is all about SRV records so needs careful comparison with Peter & Matt's XMPP draft. Tony. --=20 f.anthony.n.finch http://dotat.at/ Hebrides, Bailey: North backing northwest 4 or 5, increasing 6 at times. Moderate, but mainly slight in east Malin. Showers. Good. --1870870024-1949766973-1342219937=:12344-- From ondrej.sury@nic.cz Mon Jul 16 01:06:05 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 797DA21F8613 for ; Mon, 16 Jul 2012 01:06:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.211 X-Spam-Level: X-Spam-Status: No, score=-0.211 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nWOaPkdNvPhr for ; Mon, 16 Jul 2012 01:06:04 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) by ietfa.amsl.com (Postfix) with ESMTP id 39DF521F8606 for ; Mon, 16 Jul 2012 01:05:59 -0700 (PDT) Received: from [IPv6:2001:1488:ac14:1400:44a8:ae10:56d8:fb3d] (unknown [IPv6:2001:1488:ac14:1400:44a8:ae10:56d8:fb3d]) by mail.nic.cz (Postfix) with ESMTPSA id 8B82113FA1F; Mon, 16 Jul 2012 10:06:42 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.cz; s=default; t=1342426002; bh=74t93DS/VgUN0N0sAtUP5aUnfxczlbfUCegquef1CMI=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=oF+aVSBaiXtsDKKPtu+266C0H/umc1g/gc+9NoolkUT7GNZx6SfsNsWXreFJo55oX Idp32VfhoYt6CBHLvSBRQ1k9IsLSYpMGpiEbVc1/bGqGUHlBAkayfm8NLN0U43uG1P Igup5U5WIBBKZvInn+wrAqYpR7bnoP7cf5J4gP4A= Content-Type: multipart/mixed; boundary="Apple-Mail=_049A0A1E-85CC-4ED3-8EEB-85848D83628B" Mime-Version: 1.0 (Mac OS X Mail 6.0 \(1485\)) From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= In-Reply-To: Date: Mon, 16 Jul 2012 10:06:42 +0200 Message-Id: References: To: Tony Finch X-Mailer: Apple Mail (2.1485) X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Cc: dane-chairs@tools.ietf.org, Paul Hoffman , dane WG list Subject: Re: [dane] Preliminary agenda for IETF 84 X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Jul 2012 08:06:05 -0000 --Apple-Mail=_049A0A1E-85CC-4ED3-8EEB-85848D83628B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-2 On 14. 7. 2012, at 0:58, Tony Finch wrote: > Ond=F8ej Sur=FD wrote: >>=20 >> I have created draft agenda from what I have heard on/off-list. >> Please see attached file and object if you want to change anything. >=20 > Could you please add draft-fanf-dane-mua as well? Paul Hoffman has = agreed > to present and I intend to be joining in remotely. Might be worth > re-jigging the order since the -mua draft is all about SRV records so > needs careful comparison with Peter & Matt's XMPP draft. Thanks for the feedback and one more presentation. Would this updated = agenda work for everybody? Unless I hear objections I am going to = upload it tomorrow. --Apple-Mail=_049A0A1E-85CC-4ED3-8EEB-85848D83628B Content-Disposition: attachment; filename=dane-agenda-ietf84-v0.2.txt Content-Type: text/plain; name="dane-agenda-ietf84-v0.2.txt" Content-Transfer-Encoding: 7bit DNS-based Authentication of Named Entities (DANE) WG MONDAY, July 30 2012 1300-1500 Regency F ===================================================== CHAIR(s): Warren Kumari Ondrej Sury o Administrivia 10 minutes Chairs - Note Well - Scribe / Minutes - Blue Sheets == New work == o draft-hoffman-dane-smime 15 minutes Using Secure DNS to Associate Certificates with Domain Names For S/MIME Paul Hoffman or Jakob Schlyter o draft-fanf-dane-smtp 15 minutes Secure inter-domain SMTP with TLS, DNSSEC and TLSA records Paul Hoffman o draft-fanf-dane-mua 15 minutes DNSSEC and TLSA records for IMAP, POP3, and message submission Paul Hoffman o draft-miller-xmpp-dnssec-prooftype 15 minutes Using DNS Security Extensions (DNSSEC) and DNS-based Authentication of Named Entities (DANE) as a Prooftype for XMPP Domain Name Associations Matt Miller o The future of DANE? Rechartering 20 minutes + The protocol doc is done. What has to be done next? Do we: - recharter and take new work - go to hiatus - close the WG + What to do with existing drafts in case we close? Individual drafts? Ondrej / Warren. o Any other business Time-left Open mic / performance art. Everyone. --Apple-Mail=_049A0A1E-85CC-4ED3-8EEB-85848D83628B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-2 -- Ond=F8ej Sur=FD -- Chief Science Officer ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=F8e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- --Apple-Mail=_049A0A1E-85CC-4ED3-8EEB-85848D83628B-- From paul@cypherpunks.ca Tue Jul 31 08:31:21 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4AD521F86BA; Tue, 31 Jul 2012 08:31:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.236 X-Spam-Level: X-Spam-Status: No, score=-1.236 tagged_above=-999 required=5 tests=[AWL=-1.313, BAYES_00=-2.599, J_CHICKENPOX_33=0.6, SUBJ_ALL_CAPS=2.077] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y1N2FLjPKYRg; Tue, 31 Jul 2012 08:31:21 -0700 (PDT) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by ietfa.amsl.com (Postfix) with ESMTP id 53E4D21F86C2; Tue, 31 Jul 2012 08:31:20 -0700 (PDT) Received: by bofh.nohats.ca (Postfix, from userid 500) id 324B582574; Tue, 31 Jul 2012 11:31:00 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 22CD18043D; Tue, 31 Jul 2012 11:31:00 -0400 (EDT) Date: Tue, 31 Jul 2012 11:31:00 -0400 (EDT) From: Paul Wouters X-X-Sender: paul@bofh.nohats.ca To: dane WG list , "ipsec@ietf.org WG" Message-ID: User-Agent: Alpine 2.02 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Subject: [dane] IPSEC & DANE (RFC4025) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2012 15:31:22 -0000 The IPSECKEY issue came up a few times today in the dane meeting without being explained. This is the issue (see https://tools.ietf.org/html/rfc4025 ) 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | precedence | gateway type | algorithm | gateway | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-------------+ + ~ gateway ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | / / public key / / / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-| You can specify a gateway. So one could have: www.google.com. IN IPSECKEY 10 1 2 1.2.3.4 This would instruct ipsec clients supporting IPSECKEY to initiate IKE with RSA and said public key to 1.2.3.4 for all traffic to www.google.com. This allows one to specify a dedicated IPsec machine. I can put in: paul.example.com. IN IPSECKEY 10 1 2 1.2.3.4 Of course, I don't control 1.2.3.4 (google does), which has IKE using keyblob and not otherkeyblob. So it will fail to establish a working IPsec tunnel. But my kernel SPD/SAD can only have one src:dst policy. In the case of failure to do IKE, this would be a block to prevent plaintext leaks. So if i can trick a client into connecting to paul.example.com, I can ensure that user will not be able to talk to www.google.com. Clearly, a lot of this will depend on local policy/implementation that is not specified in any RFC. And depending on soft vs hard fail this would be a DoS or a downgrade attack. The core problem is that anyone can make a claim about someone elses' IP address with respect to the public key. We have no way of knowing who is telling the truth here. We could if we placed the key in the reverse, but that's exactly what freeswan/openswan tried to do, and in reality no one really controls their reverse to add records to it. The difference with TLS is that the client has a concept of the terminal name it connected to, and has its own src-dst transport, whereas for IPsec we only have one src-dst for the entire host. Paul From david.waltermire@nist.gov Tue Jul 31 08:59:06 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0CB921F870F for ; Tue, 31 Jul 2012 08:59:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.316 X-Spam-Level: X-Spam-Status: No, score=-7.316 tagged_above=-999 required=5 tests=[AWL=1.283, BAYES_00=-2.599, GB_I_INVITATION=-2, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ulYuZDSBGESA for ; Tue, 31 Jul 2012 08:59:05 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 6E27621F870E for ; Tue, 31 Jul 2012 08:59:05 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.1.355.2; Tue, 31 Jul 2012 11:59:00 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Tue, 31 Jul 2012 11:59:03 -0400 From: "Waltermire, David A." To: "dane@ietf.org" Date: Tue, 31 Jul 2012 11:58:08 -0400 Thread-Topic: Agenda and Remote Participation Info for the SACM Side Meeting Thread-Index: AQHNbzVHl+Yt/9lBHk+d+SUIJcqGfg== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [dane] FW: Agenda and Remote Participation Info for the SACM Side Meeting X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2012 15:59:07 -0000 I attended the DANE working group meeting this week and quickly saw the app= licability of your work to another effort in the IETF which could be anothe= r use case for DANE. We are hosting a side meeting on Thursday (details be= low) to discuss ideas around forming a working group to address security au= tomation standards. Security automation is focused on the exchange of conf= iguration, vulnerability, digital event, and relevant supporting informatio= n that can be used to make security processes more efficient and responsive= to current and emerging threats. Dane could provide a means to establish = secure communications between organizations sharing security automation inf= ormation. If this topic sounds interesting to you, we would be glad to have you atten= d the side meeting on Thursday at 6:30p in Plaza C. Sincerely, Dave Waltermire ________________________________________ From: Waltermire, David A. Sent: Tuesday, July 31, 2012 3:15 AM To: sacm@ietf.org Subject: Agenda and Remote Participation Info for the SACM Side Meeting As a reminder, the Security Automation and Continuous Monitoring (SACM) eff= ort is going to have a side meeting at the IETF 84 meeting in Vancouver lat= er this week. A description of the meeting, the date/time, web meeting det= ails, and the agenda for the meeting follow. SACM Side Meeting IETF 84 Security Automation and Continuous Monitoring =96 SACM (pronounced as Sack-= em) Description: A side meeting to continue the discussions around security aut= omation and continuous monitoring working group development efforts. In thi= s meeting we will be reviewing the Use Case document and then focusing on a= draft charter for the potential working group. Here are the meeting specifics: Date: Thursday, August 2, 2012 Time: 18:30 =96 20:00 PDT Room: Plaza C Thanks to Nancy Cam-Winget for organizing the webex. See conference call an= d web meeting details below. Agenda: * Agenda Bashing * Status of work since last IETF meeting * Internet Draft Discussions to: - support the charter/use cases - other potential future drafts * Discuss draft WG Charter Current Drafts: - http://www.ietf.org/id/draft-waltermire-sacm-use-cases-01.txt - draft-wa= ltermire-sacm-use-cases-01 - Analysis of Security Automation and Continuous= Monitoring (SACM) Use Cases - http://www.ietf.org/id/draft-waltermire-content-repository-00.txt - draf= t-waltermire-content-repository-00 - Automated XML Content Data Exchange an= d Management ________________________________________ From: Nancy Cam-Winget (ncamwing) [ncamwing@cisco.com] Sent: Monday, July 30, 2012 8:05 PM To: Moriarty, Kathleen Subject: FW: (Forward to attendees) Meeting invitation: SACM Side Meeting From: Nancy Cam-Winget > Reply-To: "ncamwing@cisco.com" > Date: Monday, July 30, 2012 5:04 PM To: "ncamwing@cisco.com" > Subject: (Forward to attendees) Meeting invitation: SACM Side Meeting **** You can forward this email invitation to attendees **** Hello , Nancy Cam-Winget invites you to attend this online meeting. Topic: SACM BOF Date: Thursday, August 2, 2012 Time: 6:30 pm, Pacific Daylight Time (San Francisco, GMT-07:00) Meeting Number: 205 870 492 Meeting Password: sacm ------------------------------------------------------- To join the online meeting (Now from mobile devices!) ------------------------------------------------------- 1. Go to https://cisco.webex.com/ciscosales/j.php?ED=3D201187757&UID=3D0&PW= =3DNZWYyNWU2YWY3&RT=3DMiM0 2. Enter your name and email address. 3. Enter the meeting password: sacm 4. Click "Join Now". To view in other time zones or languages, please click the link: https://cisco.webex.com/ciscosales/j.php?ED=3D201187757&UID=3D0&PW=3DNZWYyN= WU2YWY3&ORT=3DMiM0 ---------------------------------------------------------------- ALERT:Toll-Free Dial Restrictions for (408) and (919) Area Codes ---------------------------------------------------------------- The affected toll free numbers are: (866) 432-9903 for the San Jose/Milpita= s area and (866) 349-3520 for the RTP area. Please dial the local access number for your area from the list below: - San Jose/Milpitas (408) area: 525-6800 - RTP (919) area: 392-3330 ------------------------------------------------------- To join the teleconference only ------------------------------------------------------- 1. Dial into Cisco WebEx (view all Global Access Numbers at http://cisco.com/en/US/about/doing_business/conferencing/index.html 2. Follow the prompts to enter the Meeting Number (listed above) or Access = Code followed by the # sign. San Jose, CA: +1.408.525.6800 RTP: +1.919.392.3330 US/Canada: +1.866.432.9903 United Kingdom: +44.20.8824.0117 India: +91.80.4350.1111 Germany: +49.619.6773.9002 Japan: +81.3.5763.9394 China: +86.10.8515.5666 ------------------------------------------------------- For assistance ------------------------------------------------------- 1. Go to https://cisco.webex.com/ciscosales/mc 2. On the left navigation bar, click "Support". You can contact me at: ncamwing@cisco.com 1-408-853 0532 To add this meeting to your calendar program (for example Microsoft Outlook= ), click this link: https://cisco.webex.com/ciscosales/j.php?ED=3D201187757&UID=3D0&ICS=3DMI&LD= =3D1&RD=3D2&ST=3D1&SHA2=3DTkz-bhelFlmrhUuPkK7v2d/0gsYehkMU1WW8szSvQnM=3D&RT= =3DMiM0 The playback of UCF (Universal Communications Format) rich media files requ= ires appropriate players. To view this type of rich media files in the meet= ing, please check whether you have the players installed on your computer b= y going to https://cisco.webex.com/ciscosales/systemdiagnosis.php. http://www.webex.com CCP:+14085256800x205870492# IMPORTANT NOTICE: This WebEx service includes a feature that allows audio a= nd any documents and other materials exchanged or viewed during the session= to be recorded. By joining this session, you automatically consent to such= recordings. If you do not consent to the recording, discuss your concerns = with the meeting host prior to the start of the recording or do not join th= e session. Please note that any such recordings may be subject to discovery= in the event of litigation.= From mcr+ietf@sandelman.ca Tue Jul 31 11:03:16 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 336CD21F8899; Tue, 31 Jul 2012 11:03:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.772 X-Spam-Level: X-Spam-Status: No, score=-1.772 tagged_above=-999 required=5 tests=[AWL=0.227, BAYES_00=-2.599, J_CHICKENPOX_33=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GncFQb2Jma8I; Tue, 31 Jul 2012 11:03:15 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.252.184]) by ietfa.amsl.com (Postfix) with ESMTP id AB8D821F8552; Tue, 31 Jul 2012 11:03:15 -0700 (PDT) Received: from obiwan.sandelman.ca (unknown [IPv6:2607:f0b0:f:2:3a60:77ff:fe38:e647]) by tuna.sandelman.ca (Postfix) with ESMTP id 6EE732016A; Tue, 31 Jul 2012 14:15:35 -0400 (EDT) From: Michael Richardson To: Paul Wouters In-Reply-To: References: X-Mailer: MH-E 8.3; nmh 1.5; XEmacs 21.4 (patch 22) X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Cc: "ipsec@ietf.org WG" , dane WG list Subject: Re: [dane] IPSEC & DANE (RFC4025) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2012 18:03:16 -0000 --=-=-= Content-Transfer-Encoding: quoted-printable >>>>> "Paul" =3D=3D Paul Wouters writes: Paul> But my kernel SPD/SAD can only have one src:dst policy. In the ca= se of Paul> failure to do IKE, this would be a block to prevent plaintext lea= ks. Paul> So if i can trick a client into connecting to paul.example.com, I= can Paul> ensure that user will not be able to talk to www.google.com. This "attack" and the usage you gave for IPSECKEY is not consistent with RF= C4322. By the time that IPSECKEY RR was approved, RFC4322 was already approved (don't be confused by the order of the document numbers...). RFC4322 spec= ifies TXT RR. An RFC4322-bis that specified IPSECKEY, and IKEv2 was envisioned, but never compelted. Paul> Clearly, a lot of this will depend on local policy/implementation= that Paul> is not specified in any RFC. And depending on soft vs hard fail t= his Paul> would be a DoS or a downgrade attack. RFC4322 specifies it. Section 3.2 discussed "OE-permissive" (fail-to-clear) and "OE-paranoid" (fail-to-drop) versions. Openswan by default put the 0.0.0.0/0 into OE-permissive policy bucket, so if IKE failed, then the "%hold" should get replaced with a %pass. Paul> The core problem is that anyone can make a claim about someone el= ses' Paul> IP address with respect to the public key. We have no way of know= ing "claim", yes, but not enforce. OE failed initially because of lack of control over reverse, and later, due to there being no reverse for systems on the NATwork. Paul> The difference with TLS is that the client has a concept of the Paul> terminal name it connected to, and has its own src-dst transport, Paul> whereas for IPsec we only have one src-dst for the entire host. Agreed. =2D-=20 Michael Richardson , Sandelman Software Works=20 --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQCVAwUAUBgd34qHRg3pndX9AQLPjgQAuw6q7c1NmCoWemgU1AVpk2iX0WP4DGip TexO3Fk+U+Wn5/dCJ6UeVdPStYsxDTzMqOJOD0I9O8XdYjeh7eqasp12N46MYNPM zm/RABtSdfoJHsgd1jv0JZnue/d7nvZU3CGA15ACPBq1l7zEmHvlz7raG3RG9TtC LcMQNDqJFo8= =XnzV -----END PGP SIGNATURE----- --=-=-=-- From paul@cypherpunks.ca Tue Jul 31 13:59:17 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51F3E21F88C0; Tue, 31 Jul 2012 13:59:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.086 X-Spam-Level: X-Spam-Status: No, score=-2.086 tagged_above=-999 required=5 tests=[AWL=-0.087, BAYES_00=-2.599, J_CHICKENPOX_33=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4NAOB6rsFXRm; Tue, 31 Jul 2012 13:59:16 -0700 (PDT) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) by ietfa.amsl.com (Postfix) with ESMTP id CE12021F869E; Tue, 31 Jul 2012 13:59:16 -0700 (PDT) Received: by bofh.nohats.ca (Postfix, from userid 500) id 4A4C18256F; Tue, 31 Jul 2012 16:58:56 -0400 (EDT) Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 420288050D; Tue, 31 Jul 2012 16:58:56 -0400 (EDT) Date: Tue, 31 Jul 2012 16:58:56 -0400 (EDT) From: Paul Wouters X-X-Sender: paul@bofh.nohats.ca To: Michael Richardson In-Reply-To: <4896.1343757791@obiwan.sandelman.ca> Message-ID: References: <4896.1343757791@obiwan.sandelman.ca> User-Agent: Alpine 2.02 (LFD 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Cc: "ipsec@ietf.org WG" , dane WG list Subject: Re: [dane] [IPsec] IPSEC & DANE (RFC4025) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2012 20:59:17 -0000 On Tue, 31 Jul 2012, Michael Richardson wrote: > Paul> But my kernel SPD/SAD can only have one src:dst policy. In the case of > Paul> failure to do IKE, this would be a block to prevent plaintext leaks. > > Paul> So if i can trick a client into connecting to paul.example.com, I can > Paul> ensure that user will not be able to talk to www.google.com. > > This "attack" and the usage you gave for IPSECKEY is not consistent with RFC4322. Isn't it stating the same with different syntactic sugar? 4.3.2.1.in-addr.arpa. IN TXT X-IPsec-Server(P)=A.B.C.D public-key So if I control the reverse 4.3.2.1 and trick you into a lookup for OE, and put google's A.B.C.D with "boguspublic-key" in there, wouldn't I have the exact same issue? And as per 4322, I could have my records DNSSEC signed. It doesn't help google. > RFC4322 specifies it. > Section 3.2 discussed "OE-permissive" (fail-to-clear) and "OE-paranoid" > (fail-to-drop) versions. Openswan by default put the 0.0.0.0/0 into > OE-permissive policy bucket, so if IKE failed, then the "%hold" should > get replaced with a %pass. So what happens in my case? Either google is blocked, or google is downgraded to plaintext. Or the application could distinguish between my suggested boguspublic-key versus the real google public-key. But again, the only authoritave way for who controls A.B.C.D can be found that reverse tree, which we deem unusable at large. > Paul> The core problem is that anyone can make a claim about someone elses' > Paul> IP address with respect to the public key. We have no way of knowing > > "claim", yes, but not enforce. > OE failed initially because of lack of control over reverse, and later, > due to there being no reverse for systems on the NATwork. Yes, and what I'm saying is that current methods for tying DANE to IPSEC fail, because there is no binding to the legitimacy of the proclaimed gateway. The simple case where a server is doing OE for itself is not an issue. That works, but I don't think that would move out of the hobby space. Paul From mcr+ietf@sandelman.ca Tue Jul 31 16:00:58 2012 Return-Path: X-Original-To: dane@ietfa.amsl.com Delivered-To: dane@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 980CA21F8920; Tue, 31 Jul 2012 16:00:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.133 X-Spam-Level: X-Spam-Status: No, score=-2.133 tagged_above=-999 required=5 tests=[AWL=0.466, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1YBLhvHxBDtb; Tue, 31 Jul 2012 16:00:55 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.252.184]) by ietfa.amsl.com (Postfix) with ESMTP id 2C8EA21F8713; Tue, 31 Jul 2012 16:00:55 -0700 (PDT) Received: from obiwan.sandelman.ca (unknown [IPv6:2607:f0b0:f:2:3a60:77ff:fe38:e647]) by tuna.sandelman.ca (Postfix) with ESMTP id 839932016A; Tue, 31 Jul 2012 19:13:13 -0400 (EDT) From: Michael Richardson To: Paul Wouters In-Reply-To: References: <4896.1343757791@obiwan.sandelman.ca> X-Mailer: MH-E 8.3; nmh 1.5; XEmacs 21.4 (patch 22) X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Cc: "ipsec@ietf.org WG" , dane WG list Subject: Re: [dane] [IPsec] IPSEC & DANE (RFC4025) X-BeenThere: dane@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: DNS-based Authentication of Named Entities List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 Jul 2012 23:00:58 -0000 --=-=-= Content-Transfer-Encoding: quoted-printable >>>>> "Paul" =3D=3D Paul Wouters writes: Paul> So what happens in my case? Either google is blocked, or google is Paul> downgraded to plaintext. Or the application could distinguish bet= ween Paul> my suggested boguspublic-key versus the real google Google is plaintext, you never had the right to speak for it. Paul> Yes, and what I'm saying is that current methods for tying DANE t= o IPSEC Paul> fail, because there is no binding to the legitimacy of the procla= imed Paul> gateway. I assume by "current methods", you mean RFC4322?=20 Or is there another proposal that I've missed?=20 =2D-=20 Michael Richardson , Sandelman Software Works=20 --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQCVAwUAUBhjoYqHRg3pndX9AQKvpwP/Z83aLbvtS2TOjRBRGo34PTk6DW0494GR /y8VfBEVYJHIithu170bUIj+djxhjZLkt0WCXXbrelbZcO9A4rhCdclTm0sLPea4 1qftmVz3RKrvdzJ2Q0m1jlK24aTnJlfKVq+q9fan5eu3h7U2Cy6oHrITPVMf3WZs +lHrWk250lI= =lVqh -----END PGP SIGNATURE----- --=-=-=--