IETF Logo Mail Archive

Re: [dns-privacy] [Ext] I-D Action: draft-ietf-dprive-phase2-requirements-02.txt

Peter van Dijk <peter.van.dijk@powerdns.com> Sun, 15 November 2020 13:52 UTC

Return-Path: <peter.van.dijk@powerdns.com>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C4363A128E for <dns-privacy@ietfa.amsl.com>; Sun, 15 Nov 2020 05:52:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.621
X-Spam-Level:
X-Spam-Status: No, score=-1.621 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.276, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KQ81YBL65_lt for <dns-privacy@ietfa.amsl.com>; Sun, 15 Nov 2020 05:52:42 -0800 (PST)
Received: from mx3.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B8EA3A1288 for <dns-privacy@ietf.org>; Sun, 15 Nov 2020 05:52:41 -0800 (PST)
Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx3.open-xchange.com (Postfix) with ESMTPS id 1D5206A25C; Sun, 15 Nov 2020 14:52:40 +0100 (CET)
Received: from plato (84-81-54-175.fixed.kpn.net [84.81.54.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id DAB253C0306; Sun, 15 Nov 2020 14:52:39 +0100 (CET)
Message-ID: <7c068dc33dc78072162b2c4d90326b31fe4f51ef.camel@powerdns.com>
From: Peter van Dijk <peter.van.dijk@powerdns.com>
To: "dns-privacy@ietf.org" <dns-privacy@ietf.org>
Date: Sun, 15 Nov 2020 14:52:38 +0100
In-Reply-To: <D6440136-D6DF-48EE-BD12-BBFCBA63D68F@icann.org>
References: <160435765311.18774.16063151114758509438@ietfa.amsl.com> <20201104082924.GA6824@sources.org> <D6440136-D6DF-48EE-BD12-BBFCBA63D68F@icann.org>
Organization: PowerDNS.COM B.V.
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.30.5-1.1
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/3C4_AI_kbX9F8zoqID8DPBFcUjE>
Subject: Re: [dns-privacy] [Ext] I-D Action: draft-ietf-dprive-phase2-requirements-02.txt
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 15 Nov 2020 13:52:43 -0000

On Wed, 2020-11-04 at 15:04 +0000, Paul Hoffman wrote:
> It would be useful if a resolver could tell in advance, and at a cost less than port-checking. There could be a new protocols developed to do that. I don't see this as a requirement, though, given the low cost of port-checking.

The cost of port checking is not low.

Variant 1: try 853 and 53 in parallel. High code complexity and a high likelihood that the first query to a 'new' auth (where 'new' might be measured in minutes) will be plain text anyway.

Variant 2: try 853 first. How long do we wait for a timeout? In DNS, 500ms is a long time.

This is not happy eyeballs where both transports (v4 and v6) tend to have identical security properties. 

DNS Flag Day 2019 (no more EDNS fallbacks) was designed to reduce probing and guessing in the resolver process. I'd love for us to not add probing and guessing in other parts of that process.

Kind regards,
-- 
Peter van Dijk
PowerDNS.COM BV - https://www.powerdns.com/

v2.23.0 | Report a Bug | By Email