< draft-zhang-trans-ct-dnssec-00.txt		draft-zhang-trans-ct-dnssec-01.txt >
	Network Working Group D. Zhang		Network Working Group D. Zhang
	Internet-Draft Huawei		Internet-Draft Huawei
	Intended status: Experimental October 25, 2014		Intended status: Experimental D. Gillmor
	Expires: April 28, 2015		Expires: June 26, 2015 CMRG
			D. He
			Huawei
			December 23, 2014
	Certificate Transparency for Domain Name System Security Extensions		Certificate Transparency for Domain Name System Security Extensions
	draft-zhang-trans-ct-dnssec-00		draft-zhang-trans-ct-dnssec-01
	Abstract		Abstract
	In draft-ietf-trans-rfc6962-bis, a solution is proposed for publicly		In draft-ietf-trans-rfc6962-bis, a solution is proposed for publicly
	logging the existence of Transport Layer Security (TLS) certificates		logging the existence of Transport Layer Security (TLS) certificates
	using Merkle Hash Trees. This document tries to use this idea in		using Merkle Hash Trees. This document tries to use this idea in
	DNSSEC and publicly logging the DS RRs in order to notice the		DNSSEC and publicly logging the DS RRs in order to notice the
	issuance of suspect key signing keys.		issuance of suspect key signing keys.
	Requirements Language		Requirements Language
	skipping to change at page 1, line 40 ¶		skipping to change at page 1, line 43 ¶
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at http://datatracker.ietf.org/drafts/current/.		Drafts is at http://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on April 28, 2015.		This Internet-Draft will expire on June 26, 2015.
	Copyright Notice		Copyright Notice
	Copyright (c) 2014 IETF Trust and the persons identified as the		Copyright (c) 2014 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(http://trustee.ietf.org/license-info) in effect on the date of		(http://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 39 ¶		skipping to change at page 2, line 43 ¶
	5.2. Operations . . . . . . . . . . . . . . . . . . . . . . . 10		5.2. Operations . . . . . . . . . . . . . . . . . . . . . . . 10
	6. Log Client Messages . . . . . . . . . . . . . . . . . . . . . 10		6. Log Client Messages . . . . . . . . . . . . . . . . . . . . . 10
	6.1. Add DNSSEC RR Chain to Log . . . . . . . . . . . . . . . 10		6.1. Add DNSSEC RR Chain to Log . . . . . . . . . . . . . . . 10
	6.2. Retrieve Accepted Root DNSKEY RRs . . . . . . . . . . . . 11		6.2. Retrieve Accepted Root DNSKEY RRs . . . . . . . . . . . . 11
	7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11		7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
	8. Security Considerations . . . . . . . . . . . . . . . . . . . 11		8. Security Considerations . . . . . . . . . . . . . . . . . . . 11
	8.1. Logging other types of RRs . . . . . . . . . . . . . . . 11		8.1. Logging other types of RRs . . . . . . . . . . . . . . . 11
	8.2. Scalability Concerns . . . . . . . . . . . . . . . . . . 12		8.2. Scalability Concerns . . . . . . . . . . . . . . . . . . 12
	9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 12		9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 12
	10. Normative References . . . . . . . . . . . . . . . . . . . . 12		10. Normative References . . . . . . . . . . . . . . . . . . . . 12
	Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 13		Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 13
	1. Introduction		1. Introduction
	[I-D.ietf-trans-rfc6962-bis] specifies a Certificate Transparency		[I-D.ietf-trans-rfc6962-bis] specifies a Certificate Transparency
	(CT) mechanism to disclosing TLS certificates into public logs so as		(CT) mechanism to disclosing TLS certificates into public logs so as
	to benefit the public to monitor the operations in issuing		to benefit the public to monitor the operations in issuing
	certificates to improper subscribers. The logs do not prevent mis-		certificates to improper subscribers. The logs do not prevent mis-
	issuing behavior directly, but the provided public audibility can		issuing behavior directly, but the provided public audibility can
	increase the possibility in detecting the improper behaviors of		increase the possibility in detecting the improper behaviors of
	issuers. The logs are constructed with Merkle Hash Trees to ensure		issuers. The logs are constructed with Merkle Hash Trees to ensure
	skipping to change at page 13, line 8 ¶		skipping to change at page 13, line 8 ¶
	Association and Key Management Protocol (ISAKMP)", RFC		Association and Key Management Protocol (ISAKMP)", RFC
	4304, December 2005.		4304, December 2005.
	[RFC4305] Eastlake, D., "Cryptographic Algorithm Implementation		[RFC4305] Eastlake, D., "Cryptographic Algorithm Implementation
	Requirements for Encapsulating Security Payload (ESP) and		Requirements for Encapsulating Security Payload (ESP) and
	Authentication Header (AH)", RFC 4305, December 2005.		Authentication Header (AH)", RFC 4305, December 2005.
	[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security		[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
	(TLS) Protocol Version 1.2", RFC 5246, August 2008.		(TLS) Protocol Version 1.2", RFC 5246, August 2008.
	Author's Address		Authors' Addresses
	Dacheng Zhang		Dacheng Zhang
	Huawei		Huawei
	Email: zhangdacheng@huawei.com		Email: zhangdacheng@huawei.com
			Daniel Kahn Gillmor
			CMRG
			Email: dkg@fifthhorseman.net
			Danping He
			Huawei
			Email: ana.hedanping@huawei.com
End of changes. 6 change blocks.
	6 lines changed or deleted		9 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/