Re: [dns-privacy] [[e-mail]: I-D Action: draft-bortzmeyer-dns-qname-minimisation-00.txt]

[Stephane Bortzmeyer <[e-mail]>]

On Thu, Mar 20, 2014 at 03:06:48PM +0000,
 Tony Finch <[e-mail]> wrote 
 a message of 110 lines which said:

> ;; AUTHORITY SECTION:
> ac.uk.                  172800  IN      NS      auth03.ns.uu.net.

OK, I get it, sorry. Paragraph deleted from my local copy of the
draft.

> > Following the general principle of DNS RFCs, I do not think it would
> > be wise to specify an algorithm for resolution with qname
> > minimisation, since there is none for traditional resolution.
> 
> RFC 1034 section 4.3.2.

OK, but it won't help since it is for authoritative name
servers. Resolvers are at section 5.3.3 and the algorithm is so
sketchy that it does not even mention the content of the query sent to
authoritative name servers.

Also, qname minimisation is _not_ a change in the protocol, it's more
an unilateral best practice ("privacy optimization"), and therefore
does not need to be specified by an algorithm. If several resolvers
implement it slightly differently, it is not a problem.

> No, I mean, if I go to http://google.com in my browser, I will make A and
> AAAA queries for google.com, but if I send mail to a Google employee I
> will make MX queries for google.com.
> 
> So if you skip the NS query for google.com (because it is the whole of the
> QNAME in this case) you will leak the A vs MX difference to the .com
> servers.

Said otherwise, if you skip the NS query step, and send "A google.com"
to the .com name servers, Verisign's name servers will send you back a
referral and then you'll learn the zone cut (this is what every
resolver already does today). So, there will be a leak only for the
first request (a simple heuristic to avoid this would be to always
send the NS query for the first two labels).

Anyway, I have no problem with saying that you should always send the
NS query to be sure, and too bad for the broken name servers like
those of www.ratp.fr. I even think Mark Andrews will agree with me
here :-)