Re: [dns-privacy] Multiple DNS requests per packet, multiple packet responses

["Wiley, Glen" <[e-mail]>]

-- 
Glen Wiley
KK4SFV

Sr. Engineer
The Hive, Verisign, Inc.




On 3/21/14 10:54 AM, "Stephane Bortzmeyer" <[e-mail]> wrote:

>On Wed, Mar 19, 2014 at 01:40:01PM -0400,
> Phillip Hallam-Baker <[e-mail]> wrote
> a message of 144 lines which said:
>
>> One consequence of encrypting DNS traffic is that we break backwards
>> compatibility.
>
>Just a reminder: "This list is for the discussion of the problem
>statement surrounding the addition of privacy to the DNS protocol."
>Privacy is the goal, encryption may be a solution. This list is
>dns-privacy, not dns-encryption.

+1

>
>> Since we are going to break backwards compatibility we should take
>> the opportunity to fix some of the problems in the DNS protocol.
>
>I disagree with this approach: adding encryption, should we decide it,
>is more than enough work to keep an IETF mailing list active for many
>months (years?) Saying "hey, cool, the gates are open, let's try to
>push all the other stuff I want" seems a sure recipe for a second
>system failure <http://en.wikipedia.org/wiki/Second-system_effect>.

The past decade of chatter regarding changes to DNS is a strong indicator
of the need to keep the scope of these changes tightly constrained if
there is any hope of producing consensus on a solution.

>
>> So I would like to require a server that supports the crypto query
>>protocol
>> to be required to actually implement what is written in 1035 and
>>respond to
>> multiple queries.
>
>RFC 1035 is quite broken here since it does not say how to set the
>status code when the different questions yield differente results. In
>the last years, several people have proposed to update RFC 1035 to
>make this scheme workable (for instance by requesting that all the
>questions use the same qname or by having several response packets, as
>you suggest) but it never went far.
>
>
>_______________________________________________
>dns-privacy mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/dns-privacy