Draft: draft-ietf-homenet-front-end-naming-delegation

Commentary: this changes nothing technical , just moves words and fixes formatting
One possible way is that the vendor also provisions the HNA with a
private and public keys as well as a certificate.  Note that these
keys are not expected to be used for DNSSEC signing.  Instead these
keys are solely used by the HNA to proceed to the authentication.
Normally the keys should be necessary and sufficient to proceed to
the authentication.  The reason to combine the domain name and the
key is that DOI are likely handle names better than keys and that
domain names might be used as a login which enables the key to be
regenerated.
One possible way is that the vendor also provisions the HNA with a
private and public keys as well as a certificate.  Note that these
keys are not expected to be used for DNSSEC signing.  Instead these
keys are solely used by the HNA to proceed to the authentication.
Normally the keys should be necessary and sufficient to proceed to
the authentication.  The reason to combine the domain name and the
key is that the outsourcing infrastructure (DOI) are likely handle
names better than keys and that domain names might be used as a login
which enables the key to be regenerated.
Either the registrar is also providing the outsourcing
infrastructure or the home network needs to create a specific
account on the outsourcing infrastructure.
If the DOI is the registrar, it has by design a proof of ownership
of the domain name by the homenet owner.  In this case, it is
expected the DOI provides the necessary parameters to the home
network owner to configure the HNA.  A good way to provide the
parameters would be the home network be able to copy/paste a JSON
object - see info-model.  What matters at that point is the DOI
being able to generate authentication credentials for the HNA to
authenticate itself to the DOI.  This obviously requires the home
network to provide the public key generated by the HNA in a CSR.
the registrar may also be providing the outsourcing infrastructure
or the home network may need to create a specific account on the
outsourcing infrastructure.
If the DOI is the registrar, it has by design a proof of ownership
of the domain name by the homenet owner.  In this case, it is
expected the DOI provides the necessary parameters to the home
network owner to configure the HNA.  One good way to provide the
parameters would be the home network be able to copy/paste a JSON
object - such as described in info-model.  But, what matters here
for the DOI is that the HNA is able to authenticate itself to the
DOI.
The DM Synchronization Channel is used for communication between the
HNA and the DM for synchronizing the Public Homenet Zone.  Note that
the Control Channel and the Synchronization Channel are by
construction different channels even though there they may use the
same IP address.  Suppose the HNA and the DM are using a single IP
address and let designate by XX, YYYY and ZZZZ the various ports
involved in the communications.  In fact the Control Channel is set
between the HNA working as a client using port number YYYY (a high
range port) toward a service provided by the DM at port number XX
(well-known port such as 853 for DoT).
On the other hand, the Synchronization Channel is set between the DM
working as a client using port ZZZZ ( a high range port) toward a
service provided by the HNA at port XX.
The DM Synchronization Channel is used for communication between the
HNA and the DM for synchronizing the Public Homenet Zone.  Note that
the Control Channel and the Synchronization Channel are by
construction different channels even though there they may use the
same IP address.  Suppose the HNA and the DM are using a single IP
address and let designate by XX, YYYY and ZZZZ the various ports
involved in the communications.  The Control Channel is between the
HNA working as a client using port number YYYY (a high range port)
toward a service provided by the DM at port number XX (well-known
port such as 853 for DoT).
On the other hand, the Synchronization Channel is set between the DM
working as a client using port ZZZZ ( another high range port) toward
a service provided by the HNA at port XX.
Homenet Reverse Zone works similarly to the Public Homenet Zone.  The
main difference is that ISP that provides the IP connectivity is
likely also owning the corresponding reverse zone and act as a
default DOI for it.  If so, the configuration and the setting of the
Synchronization Channel and Control Channel can largely be automated.
Homenet Reverse Zone works similarly to the Public Homenet Zone.  The
main difference is that ISP that provides the IP connectivity is
likely also the owner of the corresponding reverse zone and act as a
default DOI for it.  If so, the configuration and the setting of the
Synchronization Channel and Control Channel can largely be automated.