Document: draft-ietf-tls-svcb-ech Title: Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings Reviewer: Linda Dunbar Review result: Not Ready
I have reviewed this document as part of the Ops area directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Ops area directors. Document editors and WG chairs should treat these comments just like any other last-call comments. The draft introduces valuable privacy enhancements but also raises several deployment challenges. Mixed SVCB RRSets with and without the “ech” parameter are vulnerable to downgrade attacks, yet may occur in multi-provider environments or during staged rollouts. Clear operational guidance is needed to mitigate these risks, such as prioritizing ECH-capable endpoints using SvcPriority. Deployments involving CDNs or multi-CDN setups add complexity around coordination of ECH keys and consistent DNS records, and would benefit from best practice recommendations. Additionally, diagnosing ECH failures can be difficult due to the lack of fallback and visibility. The draft should recommend logging and monitoring strategies to help operators detect misconfigurations. Key rotation, TTL management, and rollback procedures are also important but not addressed. The draft should add an “Operational Considerations” section summarizing these aspects to improve deployability and manageability. Best Regards, Linda Dunbar _______________________________________________ TLS mailing list -- tls@ietf.org To unsubscribe send an email to tls-le...@ietf.org
