IETF Logo Mail Archive

Re: [dane] CT for DNSSEC

Wei Chuang <weihaw@google.com> Mon, 20 March 2017 22:38 UTC

Return-Path: <weihaw@google.com>
X-Original-To: dane@ietfa.amsl.com
Delivered-To: dane@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A4A11293FF for <dane@ietfa.amsl.com>; Mon, 20 Mar 2017 15:38:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l8bARRxXuB7D for <dane@ietfa.amsl.com>; Mon, 20 Mar 2017 15:38:50 -0700 (PDT)
Received: from mail-ot0-x230.google.com (mail-ot0-x230.google.com [IPv6:2607:f8b0:4003:c0f::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 88449124B0A for <dane@ietf.org>; Mon, 20 Mar 2017 15:38:50 -0700 (PDT)
Received: by mail-ot0-x230.google.com with SMTP id x37so141945865ota.2 for <dane@ietf.org>; Mon, 20 Mar 2017 15:38:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=okc7vQZGEZRHVLdxCBXF8dXyZ3JA67luP0SWOS4u2YQ=; b=UKNlnE3mI9S1r6z0kDQeQLWjaxxM9lCaorLwh1auLhfuiUztrEU1AT5sFdFwmyx25v jfl6qkVOTcpBe3dcaZ0VyVtY4d6iaryXGgQ44kXC01UZ6yzOYE5Vp3AeHedvaj73fcnK jbSphw2dspw4mQi0Lg/9XcgaYza16AVh1etznINZAvWqrp6L/+MH0pehFWke/PTk+jkA nN8ZkV/rLnOB6t7aep8hxGMgotnfx/wTtn1/bzkxqfsiMF1cqo86w45FnHz0hQWF7SZH j25wGy9DqQP5jqxaooC2dtuFOlyIbt1QsJxeUjJ94F4IriVO91G31v5POVI/TG/fmSRY 3D8w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=okc7vQZGEZRHVLdxCBXF8dXyZ3JA67luP0SWOS4u2YQ=; b=KDxMo2HqZheCi7gmnjx9GN7YBLgrpecXFji21BjlngxsRx+WjmNWOTXIa23xd4LXy/ ccto16NhTCnJZ7uJKPbU6kiEVCFpNCITXsHPseCv7kcKsqvvtzq74lb0lJ8JcISDtc3d VVvx9aMPTxXbKoJFEhfAG+VHdPxsqnaqPPH3wZ3pfWSxs3j3k5qdxP66LU1yQVvfzlxU km4RC8xILa6Rd1L98bdJDCQqcqNHzitS6J2ZbeoqhpLfaYX2lKLf4qx5fw68HGpQVhQU ZzdE02RwkVYGPVaaWJeVj/WOwkjH9fVWUxZZbtu6L00jukM0WsXa5fomokDf0xJ4F4HF qhSw==
X-Gm-Message-State: AFeK/H16iGvRYftpHaY8yP/hBvT4T3EquPWZGpyDKJx0NZxF7NDCPhEruetHPtvyg46b8NVM3Ki5+Eez12UK5Zgx
X-Received: by 10.157.56.61 with SMTP id i58mr14948959otc.247.1490049529815; Mon, 20 Mar 2017 15:38:49 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.41.226 with HTTP; Mon, 20 Mar 2017 15:38:49 -0700 (PDT)
In-Reply-To: <C54BF614-378D-4A0A-964F-AE372E064D42@vpnc.org>
References: <CAAFsWK0bCDZmg0csCfXAJ1=jqbOBc7sUUvSg-6ZKjxuAQKmQPA@mail.gmail.com> <455EC3FC-9140-40D3-88F8-77990B7C7DD0@vpnc.org> <CAAFsWK2z1AR6RZToQvw7s_t_u+333Jyk6pUQ5KznbsrQGxkvgQ@mail.gmail.com> <C54BF614-378D-4A0A-964F-AE372E064D42@vpnc.org>
From: Wei Chuang <weihaw@google.com>
Date: Mon, 20 Mar 2017 15:38:49 -0700
Message-ID: <CAAFsWK3NSLNnFzA4U=EtB4rdg-i1fpEA7OO9koavjaRLBzQCag@mail.gmail.com>
To: Paul Hoffman <paul.hoffman@vpnc.org>
Cc: trans@ietf.org, dane@ietf.org
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="001a113be8f6f0882c054b313016"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dane/ubAdr8Q_TUIt65ZUFRmvsmj3tnE>
Subject: Re: [dane] CT for DNSSEC
X-BeenThere: dane@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DNS-based Authentication of Named Entities <dane.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dane>, <mailto:dane-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dane/>
List-Post: <mailto:dane@ietf.org>
List-Help: <mailto:dane-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dane>, <mailto:dane-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Mar 2017 22:38:53 -0000

On Fri, Mar 17, 2017 at 11:20 AM, Paul Hoffman <paul.hoffman@vpnc.org>
wrote:

> On 17 Mar 2017, at 9:31, Wei Chuang wrote:
>
One issue with logging all records seen is if webmail providers publish
>> SMIMEA there will be a potentially overwhelming number of records logged,
>> and a very large change rate.
>>
>
> Don't log what you can't log due to scale.


Just a note of caution: Sometimes that might be hard to determine a priori
deployment, and then the cause of cessation of logging might be
inadvertently interpreted as malicious.  It might be best to statically
define which records are expected to be logged.


>
> Another issue is privacy of such records.
>>
>
> Sure, but there are unpredictable privacy issues with lots of DNS record
> data. It's not possible for us to predict what will and will not be
> considered private information now or in the future for anyone other than
> ourselves.


Logging may defeat the privacy mechanism that SMIMEA and OPENPGPKEY naming
scheme uses to prevent bulk disclosure of keys i.e. sec 7.4 in RFC7929.
Much depends on the log implementation though.

-Wei

v2.23.0 | Report a Bug | By Email