Re: [dns-privacy] Secdir last call review of draft-ietf-dprive-rfc7626-bis-03

[Stephen Farrell <[e-mail]>]

Hiya,

On 18/12/2019 13:45, Sara Dickinson wrote:
> 
> 
>> On 29 Nov 2019, at 15:39, Stephen Farrell via Datatracker <[e-mail]> wrote:
>>
>> Reviewer: Stephen Farrell
>> Review result: Ready
> 
> Hi Stephen, 
> 
> Thanks for reviewing (again)!
> 
>>
>> I might not be the best reviewer for this one as I've read it a few times
>> before. But anyway, I scanned the diff [1] with RFC7626 and figure it
>> seems fine. 
>>
>> The only thing that occurred to me that seemed missing was to note
>> that while the new privacy analysis in 3.5.1.1 is already complex, many
>> systems are mobile and hence an analysis that ignores that won't be 
>> sufficient. For a mobile device one really needs to analyse all of the 
>> possible setups, and hence it's even harder to get to a good answer. 
>> (It could be that that's elsewhere in the document but since I only 
>> read the diff, I didn't see it:-)
> 
> There was a bit of discussion about this and the following text in 3.4.1 was added:
> 
> “ It is also noted that typically a device connected _only_ to a modern
>    cellular network is
> 
>    o  directly configured with only the recursive resolvers of the IAP
>       and
> 
>    o  all traffic (including DNS) between the device and the cellular
>       network is encrypted following an encryption profile edited by the
>       Third Generation Partnership Project (3GPP [2]).
> 
>    The attack surface for this specific scenario is not considered here."
> 
> Which hopefully covers this?

Not really, no. My point is that the analysis in 3.5.1.1
doesn't encompass the fact that hosts are often (or even
mostly) mobile and hence connect to many networks, and that
the results of a privacy analysis related to DoT/DoH will
likely differ for each of those networks, from the POV
of the user or device owner, and even those two may not
agree in some cases.

I don't believe that point is made in the document. But
I'm ok that you and the ADs figure out if its needed or
not.

Cheers,
S.

> 
> Sara
> 
> _______________________________________________
> dns-privacy mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>