[dane] Alissa Cooper's No Objection on draft-ietf-dane-openpgpkey-10: (with COMMENT)

["Alissa Cooper" <[e-mail]>]

Alissa Cooper has entered the following ballot position for
draft-ietf-dane-openpgpkey-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dane-openpgpkey/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I know there has been a lot of list discussion of this draft so I
apologize if these issues have already been discussed before.

I think if this sees any sizable deployment, it will be trivial for
attackers to use it to harvest email addresses from the DNS. Section 7.4
therefore seems to be quite misleading. I don't see why a zone walk is
necessary to do this kind of harvesting when an attacker could just send
one query per entry in its dictionary. I think it would be more accurate
to say that by using this mechanism, people are effectively making their
email addresses public.

I also think the mechanism could facilitate pervasive monitoring as
described in RFC 7258, as it potentially makes a whole class of entities
(resolvers) into repositories of detailed data about who has communicated
with whom via email. To the extent that large DNS providers keep logs
about individual queries, it seems like those logs could become prime
attack targets. The mechanism specified here can obviously help mitigate
pervasive monitoring in other ways, but I think the draft needs to be up
front about the trade-offs between potentially exposing metadata to a
wider pool of entities and attackers in exchange for more easily being
able to protect content.