Re: [dns-privacy] DNS + 0-RTT

[Shane Kerr <[e-mail]>]

Colm,

At 2016-04-09 14:58:43 -0700
Colm MacCárthaigh <[e-mail]> wrote:
> > >  This requires only a copy of the target 0RTT section, and access
> > >  to query the resolver, so a typical wifi scenario would do. Multi-RR
> > >  responses are very common these days too.  
> >
> > It strikes me that we should discourage privacy-sensitive resolvers from
> > employing this pattern. though i'm not sure where that documentation
> > would go or how to write it.  Is there a term for this kind of stateful
> > response history leakage?
> >  
> 
> Bind9 calls it "cyclic" rrset-order:
> 
> https://www.safaribooksonline.com/library/view/dns-bind/0596004109/ch03s19.html
> 
> but I'm not sure if it comes from a recommendation in any RFC - I couldn't
> find one from a quick search.

People who know more can correct me if I'm wrong, but my understanding
is that this sort of RRset rotation is intended to work around clients
that would always pick use first RR from an RRset. Back in the day,
that meant that one gopher server would take all the load. ;)

Obviously a DNS server would prefer not to have to do the work of
ordering queries. If you use cyclic order, then you have to maintain
state about the last answer. If you randomize it, then you need some
source of entropy.

I haven't done a full search, but here's a quick look at support.

On the authoritative side, BIND 9 of course offers any option (fixed
order, round-robin, or ranomized), whereas NSD and I believe Knot are
fixed.

On the recursive side, BIND 9 again offers any response, whereas
Unbound is fixed (PowerDNS has a feature request for round-robin, but
is currently also fixed (*)).

Like most of DNS, privacy was not considered when developing this
capability.

My own recommendation would be that a fixed order be used in all
on-the-wire communication, and that we rely on client-side libraries to
either understand that multiple answers may appear to a question or at
alternatively to randomize the one answer they use. (Note that this is
independent of the privacy concerns, as it results in simpler code and
more deterministic behavior all around.) :)

Cheers,

--
Shane

(*) https://github.com/PowerDNS/pdns/issues/2521