Re: [dns-privacy] Warren Kumari's Discuss on draft-ietf-dprive-rfc7626-bis-06: (with DISCUSS and COMMENT)

[Brian Haberman <[e-mail]>]

Hi Warren,
     Thanks for the feedback. I have a couple of responses (as document
shepherd) inline...

On 10/5/20 5:42 PM, Warren Kumari via Datatracker wrote:
> Warren Kumari has entered the following ballot position for
> draft-ietf-dprive-rfc7626-bis-06: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-dprive-rfc7626-bis/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> Apologies for changing my YES to a DISCUSS -- I found a later version of my
> notes on this draft.
> 
> My DISCUS is specifically around the"The Alleged Public Nature of DNS Data" /
> "It has long been claimed that "the data in the DNS is public" section -- it
> seems to be unnecessarily creating and then shooting down a strawman. The "the
> data in the DNS is public" aphorism talks is more about the confidentiality one
> can expect **publishing** data in the DNS, not the privacy of the lookups. 
> This whole section (to my mind) undersells the threat that publishing something
> in the DNS and expecting it to remain private creates -- for example, I'd be
> extremely foolish to insert: my-password-fd345432233e.example.com 600 IN TXT
> "Hunter2"
> 
> Services like Farsight Securities (excellent!) DNSDB will likely capture this
> almost as soon as I use it somewhere. In addition, the "Due to the lack of
> search capabilities, only a given QNAME will reveal the resource records
> associated with that name" sentence is either false, or at the very least,
> misleading.

The above is an excellent example of the subtle difference between DNS
publication privacy and DNS transaction privacy. DNSDB only know the
domain name because the DNS transaction is not encrypted.

The goal of this section, going back to 7626, is to point out that
difference. I believe you agree with that given your support for the
second paragraph in the section.

> 
> $ dig +dnssec foo.ietf.org | grep NSEC
> clearly tells me that the names etherpad.ietf.org and ftp.ietf.org both exist,
> and $ dig +dnssec ftpa.ietf.org | grep NSEC tells me that the next name is
> guides.ietf.org....
> 

Sure, if a zone operator leverages NSEC records, the above could happen.
If a zone operator does not want that type of enumeration to occur,
NSEC3 records should be used.

Is the ask here for some description of possible means of enumerating a
zone if NSEC records are published? Or that Passive DNS allows observers
to collect names if a collector is in the DNS exchange path? That seems
like overkill to me given that the enumeration can only occur in very
specific instances.

Regards,
Brian