Re: [Dance] No privacy discussion in draft-wilson-dance-architecture

["Olle E. Johansson" <[e-mail]>]

> On 22 Nov 2021, at 15:24, Paul Wouters <[e-mail]> wrote:
> 
> On Mon, 22 Nov 2021, Olle E. Johansson wrote:
> 
> [ no hats on ]
> 
>> I think this has been discussed before when working with email addresses in DANE for email e2e
>> security. If I remember correctly the actual email address wasn’t what was stored but a hash. Maybe
>> Victor has a reference to that document as my google skills fail me.
>> Monday morning. After a cup of tea the skill level was raised :-)
>> RFC 7929 - experimental:
>> " For example, to request an OPENPGPKEY resource record for a user
>> 
>>   whose email address is "[e-mail]", an OPENPGPKEY query would
>>   be placed for the following QNAME: "c93f1e400f26708f98cb19d936620da35
>>   eec8f72e57f9eec01c1afd6._openpgpkey.example.com".  The corresponding
>>   RR in the example.com zone might look like (key shortened for
>>   formatting):
>> “
> 
> Yes, but the hash is not meant as a security/privacy feature. The whole
> poinr of OPENPGPKEY was so anyone could be able to find your key. Not to
> hide your identity :)
> 
>> read the security considerations in that RFC :-)
> 
> Yes, I wrote it :)
Great to know!

> 
>>                  We haven’t really discussed yet what to store in DNS, the name of the entries if it
>>                  is personal addresses. The original draft was about IoT device names, which has
>>                  limited privacy concerns.
>> Limited but real.
>> Oh, absolutely.
>> Btw, the pull request has been merged by Ash, so in the next revision we’ll
>> have a starting point for privacy considerations. Thank you for that feedback!
> 
> I do think this issue is very important. I have seen a number of use
> cases that want to level DNS and DNSSEC, but fail on the whole thing
> being a public database anyone can query.
Agree fully, that’s why I wanted to quickly add at least some notes about it in the 
architecture document.

> 
>>                        With UAS, there is already limited privacy in the public airspace.
> 
> Indeed. For something like this, where announcing identity is very much
> a requirement, I see no privacy issue. But we do need to take other
> uses cases into account where privacy is essential. For instance, I feel
> the whole ENUM thing failed because it was a public database keyed on
> the 1 piece of information I don't want to share publicly, my phone
> number.

In one version of my text (that was later removed) I used that example,
but then thought it was something to point at later. Thanks!

So we need to think about DANCE usages where the identifier needs to be 
found but not exposed. 

/O