Re: [dns-privacy] Warren Kumari's Discuss on draft-ietf-dprive-rfc7626-bis-06: (with DISCUSS and COMMENT)

Brian Haberman <brian@innovationslab.net> Wed, 07 October 2020 19:29 UTC

Return-Path: <brian@innovationslab.net>
X-Original-To: dns-privacy@ietfa.amsl.com
Delivered-To: dns-privacy@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 081803A0112 for <dns-privacy@ietfa.amsl.com>; Wed, 7 Oct 2020 12:29:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.01
X-Spam-Level:
X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.213, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001, URI_HEX=0.1] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zxtDUZxsp9Lv for <dns-privacy@ietfa.amsl.com>; Wed, 7 Oct 2020 12:29:52 -0700 (PDT)
Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E0163A0829 for <dns-privacy@ietf.org>; Wed, 7 Oct 2020 12:29:52 -0700 (PDT)
Received: by mail-qt1-x831.google.com with SMTP id r8so2961852qtp.13 for <dns-privacy@ietf.org>; Wed, 07 Oct 2020 12:29:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to; bh=RJvWs0K717cFhZV1kNouqhJvor1kIu1BmtsJ2wJQOR8=; b=BXEr7cYwBug5081I/11yS+56ZIyfzaaf76D722zmrU5AO74365Tkgg62ivHddAeV2l /G7jUF/Fliz+QgkLVR0GzEeD3SoZWWkgRUv2sSDG3tu7QKmR4GnTn19ZnhUrSmLtVFXG 7/8f0ElpWSlFeA3jQoXdiVbVcoSYYjXU+6KJxXbyHwOFRPvt3M7/8UDD4IC7+y4YoO/V 4QhVDMmmVTtOOSNAvytGWMOhxY+ZBR8tiNLdICQSaEAJOO0qWuv9z0k+KRb9TcVS+zO4 rPRIgOmOnyamoxhVxoJqYj0cOZNpFHSLQC1j4RMhMFtkL3wezDzagkNWsPlofS257Ukg KpEA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=RJvWs0K717cFhZV1kNouqhJvor1kIu1BmtsJ2wJQOR8=; b=QZ+ny2aNPRkNirSuW4CciaJ0YgwNq8s03MyIEo3B8UJHIK5GrrUGMR9I60yr58vaON roYQaHCIMBQHzQlpUGFGLonNASJUgvhh7UvVD7wjoig0E3qRr4RsBTDCscDYABPO9e7a ccWPtlM9/zua+zH6bkD4OjONN4urrvZeRFdcAAb+QyQ74oYsrblZmbdLpmElSQ/pMYiR 9+6MeViU7WPzw1f8qoeB8Np8BCy/ohNCmNGYEigNPS6wOAHUEoPu1QJhtVXUeEUdeJPT CXlfd9D7t4f/8WHT/hUYZ02y7UPLLlGymdqjuYxF+zknLY8AZPsBKjhBzVFIku5fU25p 8qow==
X-Gm-Message-State: AOAM533KqhRcqmdTj6WyBuJYH4AjeY5HELz9EioAGx4d5GH8sOwerAY1 8ywQApEtM1zp1Ufz6HeXzmvwSOb61YIuKdiYR+M=
X-Google-Smtp-Source: ABdhPJyrQzGW6dxYzxVBxr8Lq1VUPybrwW1PPqZ9UMeqKPtLdyUg3lsW98fkrS9Ze0lkGHG4HJojvA==
X-Received: by 2002:ac8:70d8:: with SMTP id g24mr5020503qtp.221.1602098991175; Wed, 07 Oct 2020 12:29:51 -0700 (PDT)
Received: from LakeHartwell.local ([2601:154:c001:f99e:405e:b44a:49f9:2b6a]) by smtp.gmail.com with ESMTPSA id s22sm2262316qtq.78.2020.10.07.12.29.50 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 07 Oct 2020 12:29:50 -0700 (PDT)
To: Warren Kumari <warren@kumari.net>, The IESG <iesg@ietf.org>
Cc: draft-ietf-dprive-rfc7626-bis@ietf.org, dprive-chairs@ietf.org, dns-privacy@ietf.org
References: <160193413191.28964.1483642169279931217@ietfa.amsl.com>
From: Brian Haberman <brian@innovationslab.net>
Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw==
Message-ID: <59635c3f-e291-02bc-06a8-cbef46e38361@innovationslab.net>
Date: Wed, 7 Oct 2020 15:29:48 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.12.1
MIME-Version: 1.0
In-Reply-To: <160193413191.28964.1483642169279931217@ietfa.amsl.com>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dMiZAbaYIuoZVoZyuHfqm5xU4GHUtq2w4"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dns-privacy/xBESeUG7pMd-_3jA6j8zU11uT9M>
Subject: Re: [dns-privacy] Warren Kumari's Discuss on draft-ietf-dprive-rfc7626-bis-06: (with DISCUSS and COMMENT)
X-BeenThere: dns-privacy@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <dns-privacy.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dns-privacy/>
List-Post: <mailto:dns-privacy@ietf.org>
List-Help: <mailto:dns-privacy-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dns-privacy>, <mailto:dns-privacy-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Oct 2020 19:29:54 -0000

Hi Warren,
     Thanks for the feedback. I have a couple of responses (as document
shepherd) inline...

On 10/5/20 5:42 PM, Warren Kumari via Datatracker wrote:
> Warren Kumari has entered the following ballot position for
> draft-ietf-dprive-rfc7626-bis-06: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dprive-rfc7626-bis/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Apologies for changing my YES to a DISCUSS -- I found a later version of my
> notes on this draft.
> 
> My DISCUS is specifically around the"The Alleged Public Nature of DNS Data" /
> "It has long been claimed that "the data in the DNS is public" section -- it
> seems to be unnecessarily creating and then shooting down a strawman. The "the
> data in the DNS is public" aphorism talks is more about the confidentiality one
> can expect **publishing** data in the DNS, not the privacy of the lookups. 
> This whole section (to my mind) undersells the threat that publishing something
> in the DNS and expecting it to remain private creates -- for example, I'd be
> extremely foolish to insert: my-password-fd345432233e.example.com 600 IN TXT
> "Hunter2"
> 
> Services like Farsight Securities (excellent!) DNSDB will likely capture this
> almost as soon as I use it somewhere. In addition, the "Due to the lack of
> search capabilities, only a given QNAME will reveal the resource records
> associated with that name" sentence is either false, or at the very least,
> misleading.

The above is an excellent example of the subtle difference between DNS
publication privacy and DNS transaction privacy. DNSDB only know the
domain name because the DNS transaction is not encrypted.

The goal of this section, going back to 7626, is to point out that
difference. I believe you agree with that given your support for the
second paragraph in the section.

> 
> $ dig +dnssec foo.ietf.org | grep NSEC
> clearly tells me that the names etherpad.ietf.org and ftp.ietf.org both exist,
> and $ dig +dnssec ftpa.ietf.org | grep NSEC tells me that the next name is
> guides.ietf.org....
> 

Sure, if a zone operator leverages NSEC records, the above could happen.
If a zone operator does not want that type of enumeration to occur,
NSEC3 records should be used.

Is the ask here for some description of possible means of enumerating a
zone if NSEC records are published? Or that Passive DNS allows observers
to collect names if a collector is in the DNS exchange path? That seems
like overkill to me given that the enumeration can only occur in very
specific instances.

Regards,
Brian