IETF Logo Mail Archive

Re: [dns-privacy] Multiple DNS requests per packet, multiple packet responses

Joe Abley <jabley@hopcount.ca> Wed, 19 March 2014 19:25 UTC

Return-Path: <jabley@hopcount.ca>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BC5C1A07B3 for <dns-privacy@ietfa.amsl.com>; Wed, 19 Mar 2014 12:25:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.001
X-Spam-Level:
X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xtDXFwbG1hYg for <dns-privacy@ietfa.amsl.com>; Wed, 19 Mar 2014 12:25:54 -0700 (PDT)
Received: from mail-ob0-x22c.google.com (mail-ob0-x22c.google.com [IPv6:2607:f8b0:4003:c01::22c]) by ietfa.amsl.com (Postfix) with ESMTP id F06981A048C for <dns-privacy@ietf.org>; Wed, 19 Mar 2014 12:25:53 -0700 (PDT)
Received: by mail-ob0-f172.google.com with SMTP id wm4so8707670obc.31 for <dns-privacy@ietf.org>; Wed, 19 Mar 2014 12:25:45 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=XCHIFzHpXsFK5V1hJpXyh+T5gfaNdv71xE6yddpLjj0=; b=EUR++aw+NmhznZnK5TBldNKbbwugLzvYpmTp1P3RapMMK81/eXKGKvd3kg2UzrcvvT mzaUWzoSB0jVwWvWT7Iac3paEdm/rpDVmtWz/T8aoPRN0+VHa/WUjMyVseA0WcpLOCtU /IzgYgFn7EwYQg5C+vFnJK57i1xmn4s7GElXw=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=XCHIFzHpXsFK5V1hJpXyh+T5gfaNdv71xE6yddpLjj0=; b=QQ1s9jHDZc+6t5OnLEJesUvu17jcayOeJSmnKRqyX5gTRWKHROSubFK9d4xGQ7a5Ij PmtTrZOZyP0jQ6iQh0/CTfdQmcabRLMYn8AnNKLFE8mLhpdSWlQkNa3DMj9heVkumfSQ w3uzHmJKyat0GUPhHKbCJWPNf/10Soj1DL6ImJsA+jmx2jyepPlCQdVS/QNsnk0Hpk+J EHKvyYYdYRAWhzGUeYnjlrQJ106WGi0riznBA0LCMMRfCarFOaqpgHP12EuOhHfGJx8G lziy/urRifKnuhCfbJ/nWjcs/wX4FHQhF8vzJCZlYs6+dZMQdGf1TtpshRftc5tvcy4h vx9w==
X-Gm-Message-State: ALoCoQn7UcpgBIw5AvBiSg9ArOvwQWFxhi09A5RufhUGpMaTaK28/HVDQ9rgHV/zzAgxXMLU/n3t
X-Received: by 10.182.122.133 with SMTP id ls5mr3002559obb.52.1395257145022; Wed, 19 Mar 2014 12:25:45 -0700 (PDT)
Received: from ?IPv6:2001:4900:1042:1:fc77:c9ea:8cef:9f58? ([2001:4900:1042:1:fc77:c9ea:8cef:9f58]) by mx.google.com with ESMTPSA id fn10sm39005302obb.12.2014.03.19.12.25.43 for <multiple recipients> (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 19 Mar 2014 12:25:44 -0700 (PDT)
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
From: Joe Abley <jabley@hopcount.ca>
In-Reply-To: <CAMm+Lwhb7LMecCQCiJETfxJ-+UFfRxXJMrGs+R8UUGT8aKBHkw@mail.gmail.com>
Date: Wed, 19 Mar 2014 15:25:42 -0400
Content-Transfer-Encoding: quoted-printable
Message-Id: <E6004927-23C3-450C-A0EB-8E78611287B0@hopcount.ca>
References: <CAMm+LwgXExHH6YxpvQLEsgZ+C4uUjvv0E=+g0XBmWVBrQnG_-w@mail.gmail.com> <alpine.LFD.2.10.1403191435350.2170@bofh.nohats.ca> <CAMm+Lwhb7LMecCQCiJETfxJ-+UFfRxXJMrGs+R8UUGT8aKBHkw@mail.gmail.com>
To: Phillip Hallam-Baker <hallam@gmail.com>
X-Mailer: Apple Mail (2.1874)
Archived-At: http://mailarchive.ietf.org/arch/msg/dns-privacy/HeemQPlHpNt8ex0Qg7HvW1Yj1FM
Cc: dns-privacy@ietf.org, Paul Wouters <paul@nohats.ca>
Subject: Re: [dns-privacy] Multiple DNS requests per packet, multiple packet responses
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 Mar 2014 19:25:55 -0000

On 19 Mar 2014, at 15:18, Phillip Hallam-Baker <hallam@gmail.com> wrote:

> If you take DNS messages and encrypt them, the result is not DNS
> messages. There are hacks that can be used to tunnel non-DNS messages
> over DNS but that is a different issue.

Well, to the extent that you believe that DNS is not extensible for these purposes (e.g. via EDNS0 or EDNSn, n > 0).

> As I see it, port 53 is for DNS protocol messages as in DNSv1.0
> protocol without encryption.

This was a point we made (perhaps weakly) in draft-jabley-dnsop-dns-onion.

The bits of that idea that use port 53 are regular, unmolested DNS queries. All the other bits could be RESTful APIs over HTTPS pools, or whatever else you like. Whatever other weaknesses one might reasonably point out in that proposal, the facts that it (a) works with existing stub resolvers and authority servers without modification and (b) does not require deployment of DNSSEC, are strengths, I think.


Joe

v2.23.0 | Report a Bug | By Email