Re: [dns-privacy] Working Group Last Call for draft-ietf-dprive-rfc7626-bis

[Rob Sayre <[e-mail]>]

On Wed, Aug 21, 2019 at 11:22 AM Hollenbeck, Scott <shollenbeck=
[e-mail]> wrote:

> > -----Original Message-----
> >
> > I now read through the whole document,
>

 I read the whole thing too, and I am confused about three issues.

1) What is the scale of the entire system? As the document states, the
system makes heavy use of caching. But, the queries are simple, so even a
cache miss should be cheap. The traffic to the root servers would seem to
be quite a bit smaller than just Twitter's RPC traffic, going by <
https://www.akamai.com/us/en/why-akamai/dns-trends-and-traffic.jsp>. To me,
this scale calls into question the extent to which queries need to be
cacheable across requests. I can understand why decisions around these
trade-offs might have been made 20-30 years ago, but it's not clear that
those decisions will remain valid forever.

2) The document states "Some encryption solutions are only designed for
TCP, not UDP." This statement seems a bit imprecise. For example, how does <
https://datatracker.ietf.org/doc/draft-ietf-quic-tls/> fit into this
description?

3) While it's clear the document is focused on the privacy (or,
confidentiality) properties of encrypted transports, and the privacy
implications of the data included in the queries themselves, there seems to
be missing text about the message integrity that encrypted transports
provide.

thanks,
Rob