IETF Logo Mail Archive

Re: [dns-privacy] Joel Jaeggli's Discuss on draft-ietf-dprive-edns0-padding-02: (with DISCUSS)

Barry Leiba <barryleiba@computer.org> Mon, 29 February 2016 21:10 UTC

Return-Path: <barryleiba@gmail.com>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA8911B3C3E; Mon, 29 Feb 2016 13:10:44 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZyMafNbVtUVm; Mon, 29 Feb 2016 13:10:44 -0800 (PST)
Received: from mail-io0-x22a.google.com (mail-io0-x22a.google.com [IPv6:2607:f8b0:4001:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 150721B3C3D; Mon, 29 Feb 2016 13:10:43 -0800 (PST)
Received: by mail-io0-x22a.google.com with SMTP id z135so201763332iof.0; Mon, 29 Feb 2016 13:10:43 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc; bh=Ls7GNXaTbxAh3NIcty/v2ELaIi8R35OR5UE7epAy6Vw=; b=T2p9HWOcB0Oj1glny6/fRKhOjrsNA0O2BqTZMJ/wKDaAbpUToiT/imAMy8w/a7MYRl zf/g6lpRDEE/aHYDhS2a1f2ueT+gwu8S1NidlZPVAIuZHJ130WNg88RDGwOxwjx7SbKj QwLSuProRvgVmb7Lsq3Dk1JZktMFVALt6XQa5Kpu2nsK2fFCaDD/fpam6bCVrEjVNi1Y M7fnVv0VbGKiGJ6TjID1M3coiDIlZI90/1BVtxzoqGMVKCD6t9VvRwXHM0/0OKlOo6Wm Ovv88qYT6mwgVGjowQIZSm1iVXWhqlVlLQy5JOT6WuQeTyRjl2RV/+YFzjsXGcX5tuzV FQXg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:date :message-id:subject:from:to:cc; bh=Ls7GNXaTbxAh3NIcty/v2ELaIi8R35OR5UE7epAy6Vw=; b=WToUffmbsmEsPvpy7YSB0VOWSiir43lnc1iRhSYg9GHUlCtR948hkmftR61DWx69IA oE2IFK5j9I5d3m6+6Xp26LzkK+krj0jaqX3DQx569+9z+uW0cfyElsLrOUCCadueHPaj FpKZQzYCMwok7iU1nMNnN8TF6PB8G9kyfgEb8oxJ8Yk8pvjdH+OuUhDGpu9wZhWAVf9X uPLikH1DwFqWbuW+gRFB6OM/pXia3xLPJuYEz8kuSPAJf3TRnWVIMXIA/Y15mlPG3lXL XZbpGKpN5+RHdRmqd+qDFJYcGR3+HpVSGa5YSazKuyxhMKSCVkmDFi34/C+RuzHaJvK/ KOkA==
X-Gm-Message-State: AG10YOSdgjd7uNhFPUCV+q4ffXax/I35nKb0+trLKuIxmdgCcsjpMHUNDRrvy54orBJn0jvG3Jb1B76y26sWYA==
MIME-Version: 1.0
X-Received: by 10.107.131.206 with SMTP id n75mr20826970ioi.189.1456780242450; Mon, 29 Feb 2016 13:10:42 -0800 (PST)
Sender: barryleiba@gmail.com
Received: by 10.36.59.133 with HTTP; Mon, 29 Feb 2016 13:10:42 -0800 (PST)
In-Reply-To: <56D4B121.1020001@cs.tcd.ie>
References: <20160229195527.11806.46599.idtracker@ietfa.amsl.com> <56D4B121.1020001@cs.tcd.ie>
Date: Mon, 29 Feb 2016 16:10:42 -0500
X-Google-Sender-Auth: 8L0eeqKPJbJbwKBhvxfMWcjePyc
Message-ID: <CALaySJ+rfEm5GFvYdO_dKqangPiWdu_T9tBTqK6F5zNiiSRNjA@mail.gmail.com>
From: Barry Leiba <barryleiba@computer.org>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dns-privacy/Da8ivL4caPvCQ34e_YsX9M01ZSk>
Cc: tjw ietf <tjw.ietf@gmail.com>, draft-ietf-dprive-edns0-padding@ietf.org, Joel Jaeggli <joelja@bogus.com>, The IESG <iesg@ietf.org>, dprive-chairs@ietf.org, dns-privacy@ietf.org
Subject: Re: [dns-privacy] Joel Jaeggli's Discuss on draft-ietf-dprive-edns0-padding-02: (with DISCUSS)
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Feb 2016 21:10:45 -0000

>> At this point we say:
>>
>>    Implementations therefore
>>    SHOULD avoid using this option if the DNS transport is not encrypted.
>>
>> If you did allow this on unencrypted dns transport this seems like it
>> serves as a utility function for  DNS amplification.
>>
>> Wouldn't it be better to say MUST NOT?
>>
>> e.g. this is exclusively for use with TLS / DTLS supporting  sessions?
>
> If you're running your DNS over IPsec or an SSLVPN
> then using this might also be ok. So while a "MUST NOT
> use in clear" does seem like it might be correct, that's
> not the same as "MUST NOT except if using (D)TLS"

Is there a difference between what it says ("if the DNS transport is
not encrypted") and what you said ("in the clear")?  Would there be a
reason not to change "SHOULD" to "MUST" in the existing text?

b

v2.23.0 | Report a Bug | By Email