It occurs to me that I hit "publish" on this draft without updating the release notes, so I'll mention some of the many changes since -01 here instead:
- All changes to Alt-Svc have been removed. I would like to see some updates to Alt-Svc, but since this draft is now in DNSOP, and any changes to Alt-Svc are going to require a long discussion, we've removed them from this draft and will consider them separately in the future. - The examples have been expanded and reorganized. - Priority zero is now the definition of AliasForm, instead of being reserved for AliasForm. - Repeated SvcParamKeys are no longer allowed. - The "=" sign may be omitted in a key=value pair if the value is also empty. - In the wire format, SvcParamKeys must be in sorted order. - New text regarding how to handle resolution timeouts (clients must fail hard to avoid a downgrade attack) - Expanded description of recursive resolver behavior - Much more precise description of the intended ALPN behavior - Match the HSTS specification's language on HTTPS enforcement - Removed 'esniconfig=""' mechanism and simplified ESNI connection logic As always, please review and send comments. We also expect to do a presentation on this draft (remotely) in the DNSOP session. On Mon, Mar 9, 2020 at 4:12 PM <internet-dra...@ietf.org> wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Domain Name System Operations WG of the > IETF. > > Title : Service binding and parameter specification via > the DNS (DNS SVCB and HTTPSSVC) > Authors : Ben Schwartz > Mike Bishop > Erik Nygren > Filename : draft-ietf-dnsop-svcb-httpssvc-02.txt > Pages : 36 > Date : 2020-03-09 > > Abstract: > This document specifies the "SVCB" and "HTTPSSVC" DNS resource record > types to facilitate the lookup of information needed to make > connections for origin resources, such as for HTTPS URLs. SVCB > records allow an origin to be served from multiple network locations, > each with associated parameters (such as transport protocol > configuration and keying material for encrypting TLS SNI). They also > enable aliasing of apex domains, which is not possible with CNAME. > The HTTPSSVC DNS RR is a variation of SVCB for HTTPS and HTTP > origins. By providing more information to the client before it > attempts to establish a connection, these records offer potential > benefits to both performance and privacy. > > TO BE REMOVED: This proposal is inspired by and based on recent DNS > usage proposals such as ALTSVC, ANAME, and ESNIKEYS (as well as long > standing desires to have SRV or a functional equivalent implemented > for HTTP). These proposals each provide an important function but > are potentially incompatible with each other, such as when an origin > is load-balanced across multiple hosting providers (multi-CDN). > Furthermore, these each add potential cases for adding additional > record lookups in-addition to AAAA/A lookups. This design attempts > to provide a unified framework that encompasses the key functionality > of these proposals, as well as providing some extensibility for > addressing similar future challenges. > > TO BE REMOVED: The specific name for this RR type is an open topic > for discussion. "SVCB" and "HTTPSSVC" are meant as placeholders as > they are easy to replace. Other names might include "B", "SRV2", > "SVCHTTPS", "HTTPS", and "ALTSVC". > > TO BE REMOVED: This document is being collaborated on in Github at: > https://github.com/MikeBishop/dns-alt-svc [1]. The most recent > working version of the document, open issues, etc. should all be > available there. The authors (gratefully) accept pull requests. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-httpssvc/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-02 > https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-httpssvc-02 > > A diff from the previous version is available at: > https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-svcb-httpssvc-02 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop >
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ DNSOP mailing list DNSOP@ietf.org https://www.ietf.org/mailman/listinfo/dnsop
