Re: [dns-privacy] [Step 2] More discussion needed: state your opinion

[Paul Wouters <[e-mail]>]

On Tue, 13 Dec 2016, Stephane Bortzmeyer wrote:

>> IIRC the idea of using IPsec was also discussed somewhere. IIRC,
>> IPsec may have problems traversing NAT. It is also usually
>> implemented by the kernel, which may cause deployment issues. I
>> *want* IPsec to be an option here, but realistically I don't think
>> it is.
>
> Eric Rescorla talked about it at the London BoF
> <https://www.ietf.org/proceedings/89/slides/slides-89-dnse-5.pdf>

"IPsec probably isn't going to work here" is a rather week conclusion.
It seems mostly based on "I think people still firewall that stuff".
Regardless of that, IKE over TCP is a draft that's currently going to
go into WGLC any time now. And it can be encapsulated in pseudo or real
TLS to break through misconfigured (or administratively blocking)
networks. Which gives TLS and IKE/IPsec the same penetration
capabilities.

Also, if/when TLS would be used for encrypted DNS, malicious code will
appear to use that as an exfiltration side-channel, so any middleware
inspector device will go and MITM those connections anyway or simply
block them. So I doubt this while "TLS will always get out the network
for free" will be true in the long term.

People might remember I did an IKE/IPsec presentation on that it can
be used to protect DNS traffic when all this talk about using TLS or
custom DNS encryption RRTYPE's came up, and when people talked about
dnscrypt, which is just a generic VPN with a policy to only allow DNS.
Which is why I wanted to remind people that we have existing technology
in IETF that would work fine as a solution without re-inventing the wheel:

https://www.ietf.org/proceedings/93/slides/slides-93-dprive-4.pdf

It surely can work fine. IKEv2 allows IPsec clients to remain anonymous
while authenticating the server, basically giving IKE a "TLS-like"
security with anonymity. You can find an example using LetsEncrypt
for IKE/IPsec at:

http://events.linuxfoundation.org/sites/events/files/slides/LinuxSecuritySummit-2016-OE-16x9.pdf

The only real differene between using IKE/IPsec and a "bolt on" crypto on
the DNS packets is the generic difference between TLS and a (IP base) VPN.
A VPN protects host-to-host traffic, and TLS protects a single stream.
That has both advantages and disadvantages. And note TLS can be used
both as a single stream of IP based VPN deployment:

Pro VPN:

- With IKE/IPsec (or generic VPN), multiple DNS (UDP and/or TCP)
   connections do not need to use their own separate crypto handshakes
- Encryption can be "long lived" (eg hours) so no need crypto
   negotiation needed when you don't send queries for 5 minutes and
   all your TCP/UDP sessions were terminated by the DNS server.
- IPsec/IKE or TLS can run on seperate hardware from the DNS server.
- No modifications needed for DNS software - re-usable technology.

Conn VPN:

- With IKE/IPsec (or generic VPN) it becomes harder for the DNS
   authoritative server to know if a connection is unencrypted or
   encrypted. While that might not matter for the privacy element,
   as we will assume the DNS server will respond to all DNS clients
   regardless of its privacy level, it might make a difference for
   DNS-COOKIEs and other anti-amplification counter meassures that
   the server might want to do.
- offloading crypto to seperate hardware introduces an unencrypted
   DNS stream between hardware and DNS servers.

>> AIUI the draft, if we want to use DNS the problem is that we want to
>> know how to encrypt a session to a name server, but we can't look up
>> anything about the name server in the DNS because we don't yet know
>> how to encrypt a session to the name server.
>
> I disagree. We can look up without keys. It just has to be without
> privacy.

Even better, since you are going to setup a secure connection to that name
server anyway, there is no privacy lost by querying for its public key
in DNS out in the open.

Anyway, just some more data points of IKE/IPsec vs TLS. It's like
margarine versus butter. I can't believe that's not butter versus
trans fats will actually kill you of faster.

Paul