IETF Logo Mail Archive

Re: [dns-privacy] ODoH RFC SetupBaseS clarification

Tommy Pauly <tpauly@apple.com> Fri, 12 August 2022 15:12 UTC

Return-Path: <tpauly@apple.com>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0198C15C518; Fri, 12 Aug 2022 08:12:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.687
X-Spam-Level:
X-Spam-Status: No, score=-7.687 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.582, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b21BQCU7uNAF; Fri, 12 Aug 2022 08:12:12 -0700 (PDT)
Received: from rn-mailsvcp-ppex-lapp24.apple.com (rn-mailsvcp-ppex-lapp24.rno.apple.com [17.179.253.38]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9B625C15C516; Fri, 12 Aug 2022 08:12:12 -0700 (PDT)
Received: from pps.filterd (rn-mailsvcp-ppex-lapp24.rno.apple.com [127.0.0.1]) by rn-mailsvcp-ppex-lapp24.rno.apple.com (8.16.1.2/8.16.1.2) with SMTP id 27CF2sgx007216; Fri, 12 Aug 2022 08:12:12 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=from : message-id : content-type : mime-version : subject : date : in-reply-to : cc : to : references; s=20180706; bh=Qyj2Qcap4hUzAEKsUV3q2oA77hMPQ8y7+iNXMZP5mkc=; b=QQ7NxZRaME7uNFhfl3CO2nvLbjKtQlgbGtnbwBK3qLavVI2X7rJaKDoybugdkJ4if/At j6amOO2a7q34QyTflKl8oOFxbDJmdxHl+Hq323lfe+kBp3cYVpvZ5C+oNUF4SrV/9zOD 6RPcgCWVXOedhdQbwU7YFrdD/1ksH7881R7IWVi1q0280syVEXpwBLHHqLcaDakTEacI 4dGXMV7zrLWQt+idzWh8DZyYhBRgnFJ1VuhEyfKWut0l+v3zIR61mOg29wUlMvXQLMHa HU5WSvwCqDUrZpZFl9D/3AZB0HBlgjV3krEu1UcOixz61XSvGhe5rUHYfNRyJ/Dz1aSS LQ==
Received: from rn-mailsvcp-mta-lapp01.rno.apple.com (rn-mailsvcp-mta-lapp01.rno.apple.com [10.225.203.149]) by rn-mailsvcp-ppex-lapp24.rno.apple.com with ESMTP id 3huwtj1u8x-7 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 12 Aug 2022 08:12:12 -0700
Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp01.rno.apple.com (Oracle Communications Messaging Server 8.1.0.18.20220407 64bit (built Apr 7 2022)) with ESMTPS id <0RGI00OPACW6GZ60@rn-mailsvcp-mta-lapp01.rno.apple.com>; Fri, 12 Aug 2022 08:12:08 -0700 (PDT)
Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.18.20220407 64bit (built Apr 7 2022)) id <0RGI00Q00CPI8500@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 12 Aug 2022 08:12:06 -0700 (PDT)
X-Va-A:
X-Va-T-CD: 7897d4e560683e0d7cb6bb70e3eec876
X-Va-E-CD: 9a0329ea6db8d1a8477ba0aabadb979a
X-Va-R-CD: 742c77fe0d4dfb2acbc182d166a9c146
X-Va-CD: 0
X-Va-ID: a77bb6cb-f133-4e7c-9a17-35135abbdd10
X-V-A:
X-V-T-CD: 7897d4e560683e0d7cb6bb70e3eec876
X-V-E-CD: 9a0329ea6db8d1a8477ba0aabadb979a
X-V-R-CD: 742c77fe0d4dfb2acbc182d166a9c146
X-V-CD: 0
X-V-ID: 2f1eb800-6607-4200-9198-b68dbba34562
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517, 18.0.883 definitions=2022-08-12_10:2022-08-11, 2022-08-12 signatures=0
Received: from smtpclient.apple (unknown [17.234.121.171]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.18.20220407 64bit (built Apr 7 2022)) with ESMTPSA id <0RGI0110LCW5BP00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Fri, 12 Aug 2022 08:12:06 -0700 (PDT)
From: Tommy Pauly <tpauly@apple.com>
Message-id: <83AA11EE-B8E2-411C-8622-D5E9D0E524FB@apple.com>
Content-type: multipart/alternative; boundary="Apple-Mail=_C94F12EE-398B-4E6C-AAAA-8FA554649366"
MIME-version: 1.0 (Mac OS X Mail 16.0 \(3730.0.21\))
Date: Fri, 12 Aug 2022 08:11:54 -0700
In-reply-to: <BL0PR01MB438718D20FCC518DFEDA5BF1A5659@BL0PR01MB4387.prod.exchangelabs.com>
Cc: "dns-privacy@ietf.org" <dns-privacy@ietf.org>
To: Ravi sankar MANTHA <r.mantha=40f5.com@dmarc.ietf.org>
References: <BL0PR01MB438718D20FCC518DFEDA5BF1A5659@BL0PR01MB4387.prod.exchangelabs.com>
X-Mailer: Apple Mail (2.3730.0.21)
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.517, 18.0.883 definitions=2022-08-12_10:2022-08-11, 2022-08-12 signatures=0
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/pOjliOk7aYNfAddb97bcXyTmOpw>
Subject: Re: [dns-privacy] ODoH RFC SetupBaseS clarification
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Addition of privacy to the DNS protocol <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 12 Aug 2022 15:12:15 -0000

Hi Ravi,

Seems like this was stuck in your outbox and sent a duplicate email to the one from August 10?

Tommy

> On Aug 10, 2022, at 1:40 AM, Ravi sankar MANTHA <r.mantha=40f5.com@dmarc.ietf.org> wrote:
> 
> Hi,
>  
> In Section 6.2 of RFC 9230, its mentioned that SetupBaseS takes only 2 parameters  (pkR, "odoh query")
> 
> However, reference implementations are indeed using a randomiser from client side.
> 
> enc, ctxI, err := hpke.SetupBaseS(suite, rand.Reader, pkR, []byte(ODOH_LABEL_QUERY))
> (https://github.com/cloudflare/odoh-go/blob/7c6d9ff448c53e0e546f2afe915ad9608e11f7bd/odoh.go#L471)
> 
> This has an implication on target implementations,
> 
> If Targets assume the randomizer is not present in shared secret derivation, then Context is unique for Target Public Key and they may choose not to store/derive it per message per Public Key. 
> 
> If random seed is present, then contexts are unique only per message (DSN Query).
> 
> So, this has an interoperability impact as Encrypt/Decrypt fails for Query Responses if wrong shared key/Context is used on Target side.
> 
>  IMHO, we might need to clarify this in RFC either by updating pseudocode for SetupBaseS or add a note that Target should derive shared secret/Context with every oblivious DNS query. Or its implicit somewhere in the RFC ?
> 
> Regards,
> 
> Ravi Mantha
> 
>  
> 
>  
> _______________________________________________
> dns-privacy mailing list
> dns-privacy@ietf.org <mailto:dns-privacy@ietf.org>
> https://www.ietf.org/mailman/listinfo/dns-privacy

v2.23.0 | Report a Bug | By Email