Re: [dns-privacy] ENDS0 Padding Profile: Rough first draft

Alexander Mayrhofer <alex.mayrhofer.ietf@gmail.com> Thu, 03 November 2016 07:32 UTC

Return-Path: <alex.mayrhofer.ietf@gmail.com>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 659B8129555 for <dns-privacy@ietfa.amsl.com>; Thu, 3 Nov 2016 00:32:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Level:
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1WwMjR0M8Hzr for <dns-privacy@ietfa.amsl.com>; Thu, 3 Nov 2016 00:32:50 -0700 (PDT)
Received: from mail-lf0-x22f.google.com (mail-lf0-x22f.google.com [IPv6:2a00:1450:4010:c07::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 16767126CD8 for <dns-privacy@ietf.org>; Thu, 3 Nov 2016 00:23:03 -0700 (PDT)
Received: by mail-lf0-x22f.google.com with SMTP id b81so30572170lfe.1 for <dns-privacy@ietf.org>; Thu, 03 Nov 2016 00:23:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=0wyXdn6jXd3zfhlO2B5L1oHEZp0/d7iqev+4+WC5Kjg=; b=ri82DoabxEqtUzL4vvWXz3N4Es0zpjeN3RtsbRSUJQQWzGfE3DIGsROj+mfh5MfeDm Q5+Yl2fw4fSnL7CZxyqvDSyvn2zFpvYlr4yV1bTsAg8PYVn4GwnE8GDG6pR08Hv0sQuP BsMgmkG91DTFE0rWyD7F8nxuK4eU/EJ1wOqiJT0VrL59YB7vExREFGpfnTg3HdHNlYwy 7lYNRY8jwOqwa2HvLkqHM1bi4Ki+/GRNP+ZR/Pp/iXKUcIEM4ugDlahioowrqTZrT3dU ixXPBgs34Zt2CjKsKh2uwk1n2bd7AGUl5L1WrqfNtt3d+lGKhnXOF4j30MpSnWr3qwu7 sPaw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=0wyXdn6jXd3zfhlO2B5L1oHEZp0/d7iqev+4+WC5Kjg=; b=JTIf2BgQ9ZezreDG1r76P7ShFTJEz4aaPiWP+VzIs5zi/FpufAczpDn8L5PTrI9wDx iQltI/jjGRc5/WEidD4EQXc05DUoXHu8aB6glUpAPCZZkuCjCZjNM3Pnf8MHoPs/SS9w jRIUSkoTkTo+syHP1wELOjcGXU0UlVuo7ih50zBf4d9tdvShh5DjgQbqYEzT++u2smaF yoJYd3Gf8yNq1pz5H57THLuC1odj40yL71a72q+7CypRxN+OKdNmSJ8h1lhLgTU4PLar 5UyGefMI1UjoL3wODKiIdWw+fcuSafdn9obyHPYWrbnAT5MRzpdtAY9ufsfAEMNqYOo8 khGQ==
X-Gm-Message-State: ABUngvfxpa/j+ZKL9NDHmZKzsT/GrVtgzzfRHulc8lQF1QBYx3+CrELmqGYpPFHYXO+b3CWW4icS8E9tLIldbQ==
X-Received: by 10.25.77.65 with SMTP id a62mr4671712lfb.118.1478157781154; Thu, 03 Nov 2016 00:23:01 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.114.97.9 with HTTP; Thu, 3 Nov 2016 00:23:00 -0700 (PDT)
In-Reply-To: <CA+nkc8Ai6fkOQGSiP-1GQHMWVhmFXeVEhptyNSDvJbS6B-rHEA@mail.gmail.com>
References: <CAHXf=0p+Afhs27SQraupwyF4DO9on4a3aJKJ_B7Gc+gHzBmqtQ@mail.gmail.com> <1477998568.4843.13.camel@env.dtu.dk> <CA+nkc8Ai6fkOQGSiP-1GQHMWVhmFXeVEhptyNSDvJbS6B-rHEA@mail.gmail.com>
From: Alexander Mayrhofer <alex.mayrhofer.ietf@gmail.com>
Date: Thu, 3 Nov 2016 08:23:00 +0100
Message-ID: <CAHXf=0rGsWr_mpGq2_e2QKtRuCwTzq8-n7Oj0W+0jXxk8nhBwg@mail.gmail.com>
To: Bob Harold <rharolde@umich.edu>
Content-Type: multipart/alternative; boundary=001a1141d7f677c1b60540606d86
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/4b49iUMrpJxLCN9C_Np_7ps2swg>
Cc: Hugo Connery <hmco@env.dtu.dk>, "dns-privacy@ietf.org" <dns-privacy@ietf.org>
Subject: Re: [dns-privacy] ENDS0 Padding Profile: Rough first draft
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Nov 2016 07:32:52 -0000

Bob,

thanks for that comment, i do agree it's misleading. I didn't have time to
flesh out that thought, but what i meant is that one strategy could be to
pad with a *random* percentage of the remaining space (with a new random
percentage on each message, of course). "Fixed length" Random Length
padding with eg. an upper limit of 128 octects of padding would still
reveal the maximum original message length, while padding with a random
percentage of the remaining space would not.

I will update the draft in the next revision accordingly, if there's
interest in continuing it.

best,
Alex


On Tue, Nov 1, 2016 at 8:05 PM, Bob Harold <rharolde@umich.edu> wrote:

>
> On Tue, Nov 1, 2016 at 7:09 AM, Hugo Connery <hmco@env.dtu.dk> wrote:
>
>> Hi,
>>
>> The document looks like a great start.
>>
>> You seem to be using 'strategy' (28 times) and 'profile' (8 times)
>> interchangeably. You may wish to prefer one over the other, or
>> clearly delineate the difference in meaning.
>>
>> The list of strategies looks great.  Perhaps you could mention
>> the "pad the message to the maximum possible message length"
>> explicitly as a sub-case of "Block Length Padding".
>>
>> I am not recommending it, but it has the maximum "confidentiality"
>> property (all EDNS messages look identical -- random noise of the same
>> size). Thus, it probably deserves an explicit mention, in the same
>> way that "no padding" deserves a mention as it has the minimum
>> "confidentiality" property.
>>
>> You spell length as lenght twice in the first paragraph of section 4.5
>>
>> Regards,  Hugo Connery
>>
>> On Mon, 2016-10-31 at 22:40 +0100, Alexander Mayrhofer wrote:
>> > Hi,
>> >
>> > I've posted a first rough cut of a "Padding Profile" draft,
>> > describing strategies regarding EDNS0 padding size (which we
>> > specifically did *not* address in RFC 7830):
>> >
>> > https://tools.ietf.org/html/draft-mayrhofer-dprive-padding-profile-00
>> >
>> > It's more like a "strawman proposal" rather than a polished document
>> > in the current version, but i'm more than happy to talk about it in
>> > Seoul if we have time. See the full I-D announcement below.
>> >
>> > best,
>> > Alex
>> >
>> >
>> > A New Internet-Draft is available from the on-line Internet-Drafts
>> > directories.
>> >
>> >
>> >         Title           : Padding Profiles for EDNS(0)
>> >         Author          : Alexander Mayrhofer
>> >       Filename        : draft-mayrhofer-dprive-padding-profile-00.txt
>> >       Pages           : 6
>> >       Date            : 2016-10-31
>> >
>> > Abstract:
>> >    RFC 7830 specifies the EDNS0 'Padding' option, but does not
>> > specify
>> >    the amount of padding to be used in specific applications.  This
>> > memo
>> >    lists the possible options ("Padding Profiles"), discusses the
>> >    implications of each of these options, and provides implementation
>> >    guidance.
>> >
>> >
>> > The IETF datatracker status page for this draft is:
>> > https://datatracker.ietf.org/doc/draft-mayrhofer-dprive-padding-profi
>> > le/
>>
>>
> Good start.
>
> 4.4.  Random Length Padding
> 'Alternatively, pad a certain percentage of "remaining space"?'
> -- This, like fixed length padding, is discoverable and thus of no help.
> You should specifically recommend against this, in case someone else
> thinks of it and does not realize the problem with it.
>
> --
> Bob Harold
>
>
>