IETF Logo Mail Archive

Re: [DNSOP] ALT-TLD and (insecure) delgations.

Ted Lemon <mellon@fugue.com> Fri, 10 February 2017 00:28 UTC

Return-Path: <mellon@fugue.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34BAA1294EE for <dnsop@ietfa.amsl.com>; Thu, 9 Feb 2017 16:28:12 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MOr2o3UzvcRB for <dnsop@ietfa.amsl.com>; Thu, 9 Feb 2017 16:28:10 -0800 (PST)
Received: from mail-qt0-x22c.google.com (mail-qt0-x22c.google.com [IPv6:2607:f8b0:400d:c0d::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95E5A12967E for <dnsop@ietf.org>; Thu, 9 Feb 2017 16:28:09 -0800 (PST)
Received: by mail-qt0-x22c.google.com with SMTP id k15so20662780qtg.3 for <dnsop@ietf.org>; Thu, 09 Feb 2017 16:28:09 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=4zuhjAfaq/wU+GuF+hFxEcKrtIUvGjlz7ug1QHKImfQ=; b=DNWP7Qz1I6W9spNPLz9ABBJ8FoulEG3eG2CPjdyXlJMhcwn+Tc14eUWzi2ogIRv2fu OQJugTOL68M59+f+Dri9WHOHSC1c82RSU2k9JD013yJXFC2SkmjhrpVtcMqGbM8lmyuz dB+morftlIUBb1cvGIUlT+qyjXhiwZUf6T39DlC3fTejkNlqZjnWm5jWZ4AFihVpisGp qyimto/HlYgg1Zb8IgRphL0akWnse9bU1U+U0GSUCUz3UGVqmcq8QVReA47+A70sAVdr ss82/tDX2+xrBBF03nIbdbMIuUiUmlDwaHyoIy/gfE6C6f5pJdx9sbAK6k6J1S4K7al/ h27g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=4zuhjAfaq/wU+GuF+hFxEcKrtIUvGjlz7ug1QHKImfQ=; b=FnMNmDG9PTHk5n64FoX+1YkniOMd0BC58cluuiDaEjklabjwSL2V6RHHpCVkYMAkwj UdLB7DcYagP/ByF6q+IFDcr5JcMRZ/Adklu83B55CLjWPxnVvfURxyj9r1ldaXuUoWn3 3EXpVtdAbWfWLvJ46kDYZjBK3vfTbf01T9zrDnHSPejGgRyeWzwNVRmQqm7iciuk2Trh H6TDLtU9vPF66+gtXD4rwj3W2risIOsYmAioV2qdfh1YsuwC3EbTbR2f903L9VcCgaOO ZAugSSOo3ufie/haU0k+Zwox6bP3+6orzOkYaJAiGn7S04+x0ySDGkNCHJLAwtzx/u/A HtPA==
X-Gm-Message-State: AMke39kh6W0zSzeFH6W/liArl6UAUlxxVYMSuoxmrSY7x2UOOV5DGRBPLPnXUIv68ArN+w==
X-Received: by 10.200.55.178 with SMTP id d47mr6030875qtc.60.1486686488784; Thu, 09 Feb 2017 16:28:08 -0800 (PST)
Received: from [192.168.1.228] (c-73-167-64-188.hsd1.nh.comcast.net. [73.167.64.188]) by smtp.gmail.com with ESMTPSA id 23sm10644094qtp.20.2017.02.09.16.28.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 09 Feb 2017 16:28:07 -0800 (PST)
From: Ted Lemon <mellon@fugue.com>
Message-Id: <CFB6BEB2-4110-406A-A917-FC6361061B1C@fugue.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_C5C01EA4-EA9B-4343-843C-6E5AD0E9AC32"
Mime-Version: 1.0 (Mac OS X Mail 10.2 \(3259\))
Date: Thu, 09 Feb 2017 19:28:05 -0500
In-Reply-To: <20170209232830.0DE1B63669D6@rock.dv.isc.org>
To: Mark Andrews <marka@isc.org>
References: <20170207205554.B6974633BE40@rock.dv.isc.org> <18F2EB0D-5BD0-4CC5-B02C-2E5EA0B8CC23@fugue.com> <20170207214846.B66EF633C6C5@rock.dv.isc.org> <FB835756-2C46-40A9-88ED-2F8ADF812BA6@fugue.com> <20170208052544.862956356F33@rock.dv.isc.org> <FFAFD844-824C-44EA-A4B1-1AD28B4FE95C@fugue.com> <20170208060208.8C8E1635864D@rock.dv.isc.org> <E0A42577-0984-4ADD-8658-91413CBE783D@fugue.com> <20170208194208.DB02C635DD72@rock.dv.isc.org> <CAH1iCipA5nvWJqjdGUwJeeT_eU8EH8VYJU2hX1hJoiTb617K8Q@mail.gmail.com> <20170209163123.56hdbzaluekmvbh7@nic.fr> <20170209195722.DC1AB636586C@rock.dv.isc.org> <0394528C-99CD-41D4-9AB6-844D1318264C@gmail.com> <20170209204506.BC40D6365CBE@rock.dv.isc.org> <12D7473B-3A22-4A8D-9C13-2AEEDEABB879@fugue.com> <20170209224851.2FB1B63666E6@rock.dv.isc.org> <CAPt1N1nLmdoZ_3Kb8Kfp9sTsN-GYqo1A9CF3j4zb7QCvO3SLew@mail.gmail.com> <20170209232830.0DE1B63669D6@rock.dv.isc.org>
X-Mailer: Apple Mail (2.3259)
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/WRjMmsA_xWKvwlHssVis_kDgrSg>
Cc: "dnsop@ietf.org WG" <dnsop@ietf.org>, Brian Dickson <brian.peter.dickson@gmail.com>
Subject: Re: [DNSOP] ALT-TLD and (insecure) delgations.
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Feb 2017 00:28:12 -0000

On Feb 9, 2017, at 6:28 PM, Mark Andrews <marka@isc.org> wrote:
> Because QNAME minimization does not stop on NXDOMAIN.  Too much
> broken stuff out there to stop on NXDOMAIN.  The purpose of QNAME
> minimization is prevent leaking too much information about the qname
> to the parent zone.  It does nothing to prevent leakage of the QNAME
> to the containing zone.

Er, maybe I don't understand qname minimization correctly.   My understanding is that the way it works is that the recursive resolver does not forward the entire query up the chain: it just forwards the bit it needs resolved to answer the next question.   So, if you ask for foo.alt, the resolver should first ask for "." (except it probably already has it), and then "alt.", which will return an NXDOMAIN.   So it will never ask anybody for foo.alt, because it has no-one to ask.

v2.30.2 | Report a Bug | By Email | System Status