Re: [dns-privacy] Possible use case: Opportunistic encryption for recursive to authoritative

Rob Sayre <sayrer@gmail.com> Sat, 08 August 2020 02:12 UTC

MIME-Version: 1.0
References: <CAChr6SwGjo889gkMK0aE-76NTSrP799jMm8RBQaDRKo+XvWQ-w@mail.gmail.com> <20200808020442.127E71E60494@ary.qy>
In-Reply-To: <20200808020442.127E71E60494@ary.qy>
From: Rob Sayre <sayrer@gmail.com>
Date: Fri, 07 Aug 2020 19:12:28 -0700
Message-ID: <CAChr6SzAxy6AFUb0BDm2VgcrG=pxNqx6b5Ex+S4mLNAT26A_jA@mail.gmail.com>
To: John Levine <johnl@taugh.com>
Cc: DNS Privacy Working Group <dns-privacy@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000084bb3105ac544135"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/3UHRBkI2ZzkmWEBTyr_kOjvaZx0>
Subject: Re: [dns-privacy] Possible use case: Opportunistic encryption for recursive to authoritative
Precedence: list

On Fri, Aug 7, 2020 at 7:04 PM John Levine <johnl@taugh.com> wrote:

> In article <
> CAChr6SwGjo889gkMK0aE-76NTSrP799jMm8RBQaDRKo+XvWQ-w@mail.gmail.com> you
> write:
> >Assuming this traffic is encrypted, which I am in favor of, the CPU load
> on
> >the authoritative server will increase after an outage or network problem.
> >
> >Is this already factored in?
>
> How is that diffferent from now? If a DNS server is offline and comes
> back online, it will see a bunch of queries.
>

The issue is that connection establishment will be expensive, which is
something separate from getting a bunch of queries. As others have pointed
out, this cost will be amortized to almost nothing most of the time. After
an outage, this connection establishment cost will have to be dealt with in
parallel.

I don't have an opinion on whether this should be implementation guidance,
or even in the spec.

thanks,
Rob

[dns-privacy] Possible use case: Opportunistic en… Paul Hoffman
Re: [dns-privacy] Possible use case: Opportunisti… Ben Schwartz
Re: [dns-privacy] [Ext] Possible use case: Opport… Paul Hoffman
Re: [dns-privacy] Possible use case: Opportunisti… John R. Levine
Re: [dns-privacy] Possible use case: Opportunisti… Tim Wicinski
Re: [dns-privacy] Possible use case: Opportunisti… Puneet Sood
Re: [dns-privacy] Possible use case: Opportunisti… Rob Sayre
Re: [dns-privacy] Possible use case: Opportunisti… Puneet Sood
Re: [dns-privacy] Possible use case: Opportunisti… Rob Sayre
Re: [dns-privacy] Possible use case: Opportunisti… Manu Bretelle
Re: [dns-privacy] Possible use case: Opportunisti… John Levine
Re: [dns-privacy] Possible use case: Opportunisti… Rob Sayre
Re: [dns-privacy] Possible use case: Opportunisti… Paul Wouters
Re: [dns-privacy] Possible use case: Opportunisti… Brian Haberman
Re: [dns-privacy] Possible use case: Opportunisti… Ask Bjørn Hansen
Re: [dns-privacy] Possible use case: Opportunisti… Paul Ebersman
Re: [dns-privacy] [Ext] Possible use case: Opport… Paul Hoffman
Re: [dns-privacy] Possible use case: Opportunisti… Peter van Dijk
Re: [dns-privacy] Possible use case: Opportunisti… Peter van Dijk
Re: [dns-privacy] [Ext] Possible use case: Opport… Brian Haberman
Re: [dns-privacy] Possible use case: Opportunisti… Tony Finch
Re: [dns-privacy] Possible use case: Opportunisti… Paul Wouters
[dns-privacy] TLSA for secure resolver-auth trans… Peter van Dijk
Re: [dns-privacy] Possible use case: Opportunisti… Vladimír Čunát
Re: [dns-privacy] [Ext] Possible use case: Opport… Paul Hoffman
Re: [dns-privacy] TLSA for secure resolver-auth t… Ilari Liusvaara
Re: [dns-privacy] TLSA for secure resolver-auth t… Paul Wouters
Re: [dns-privacy] [Ext] TLSA for secure resolver-… Paul Hoffman
Re: [dns-privacy] TLSA for secure resolver-auth t… Vladimír Čunát
Re: [dns-privacy] TLSA for secure resolver-auth t… Paul Wouters
Re: [dns-privacy] Possible use case: Opportunisti… Viktor Dukhovni
Re: [dns-privacy] TLSA for secure resolver-auth t… Peter van Dijk