Re: [DNSOP] Secdir last call review of draft-ietf-dnsop-server-cookies-04

Brian Dickson <brian.peter.dickson@gmail.com> Wed, 02 December 2020 22:25 UTC

Return-Path: <brian.peter.dickson@gmail.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F8473A15A0; Wed, 2 Dec 2020 14:25:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OJ0IcDEH4rMn; Wed, 2 Dec 2020 14:25:41 -0800 (PST)
Received: from mail-vk1-xa2f.google.com (mail-vk1-xa2f.google.com [IPv6:2607:f8b0:4864:20::a2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F5C33A159F; Wed, 2 Dec 2020 14:25:41 -0800 (PST)
Received: by mail-vk1-xa2f.google.com with SMTP id a129so778130vki.5; Wed, 02 Dec 2020 14:25:41 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=UTxeo6VwaAwnh1jgC7xhH/C+o/4VfVHdKZIbL5I3Dqw=; b=XNm0HOWC159IbAe7zQcasFN7Js93UW0q4O3X/3inwgv+2UzJycV3wGD652/WysCMvp oBbSW4iLJTt/v/l/6w4ocfhCMFs0GTZRePC6URefKor9544yDjFmJ9g9uzltgMT/cp89 9Il3oKlEKke4F9BRZisC0AyTMWcnv6p4vxyviug2vj5W9Mqb01AnMQH78UspT31w0pLw QGXUWHUDj2wfPAhOWqkRBUCOd9kVF5L7HHwTr8Kn7vdMhkXz4bUhIsctTU2+gyap8Pbl zxVMLUMis7gYxlXOTzYbjUcHGysf614CjUjB2f2jUmF0SXwGdc14H7gGg+Cm+Q48LkhQ AdDg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=UTxeo6VwaAwnh1jgC7xhH/C+o/4VfVHdKZIbL5I3Dqw=; b=NJ35hr1vK+Lb01Dql4Wc/gSvZwGhmkagwDimOD6sWjgT8rLdY5bfe2+e+uQ27zIT35 33gsE6F3kW+KUV7QjmfRrAMLyljZZ2hLXJEx2wBz4JpHZLS8ri8OINYDIVfcnZWcmGIX 4aiaLpF5rFRtXY4f2NDidU8CUuIadIkzKwqSM11zmYG28tdkvBQfnwhjgssfCY8iThKU 0dUgCTgvGt4kgLOktYSlj0qOAQozcdw6Y3jOUcIE7KDtv2EewiR3b/R2zfMcT3Nt2q0N Hd1AaMSY+g3PpfjL1Bkwk1o9sNkrcvRY9nyolbuTVOCg4lSyKqv0qlfZDsXM0rVF8W8e 2qUQ==
X-Gm-Message-State: AOAM533c64gX8a6HPdlt6mgsTPQD0OiluSyeeiZhbaDY1LbMVGvqd021 DH3vYOo42iDzURPH2Vp0q7I4L1hxTKJlyipNFBM=
X-Google-Smtp-Source: ABdhPJyGDIuzE6jtvVrIOx1b4VygxrTiUiSB+WAE9AxNydum/HmkSbbSfissA7WhhWAENReAKRfbufkduJ0IwDU0ooo=
X-Received: by 2002:a1f:e807:: with SMTP id f7mr278922vkh.2.1606947940409; Wed, 02 Dec 2020 14:25:40 -0800 (PST)
MIME-Version: 1.0
References: <160693121881.9413.5642470305677631145@ietfa.amsl.com> <17AFD6F5-11DA-41BC-8C37-E1893648041D@isc.org> <75c266ba-573a-29e3-621d-aea9b27f195f@cs.tcd.ie> <b23d3f2b-4b4f-f70c-ff53-cbd2c229a887@nlnetlabs.nl> <d263c879-6c85-fbc3-3484-02402b1c52aa@cs.tcd.ie>
In-Reply-To: <d263c879-6c85-fbc3-3484-02402b1c52aa@cs.tcd.ie>
From: Brian Dickson <brian.peter.dickson@gmail.com>
Date: Wed, 02 Dec 2020 14:25:29 -0800
Message-ID: <CAH1iCirACLV5t2V0YdVRn=oXUxmMqmsTwQbG07c41von9ojtQQ@mail.gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Cc: Willem Toorop <willem@nlnetlabs.nl>, Ondřej Surý <ondrej@isc.org>, last-call@ietf.org, draft-ietf-dnsop-server-cookies.all@ietf.org, "dnsop@ietf.org WG" <dnsop@ietf.org>, secdir@ietf.org
Content-Type: multipart/alternative; boundary="00000000000029268e05b582b94d"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/t1CMFvYHQw7gX7ouYMEgoaYYlx8>
Subject: Re: [DNSOP] Secdir last call review of draft-ietf-dnsop-server-cookies-04
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 02 Dec 2020 22:25:43 -0000

On Wed, Dec 2, 2020 at 1:49 PM Stephen Farrell <stephen.farrell@cs.tcd.ie>
wrote:

>
> Hiya,
>
> On 02/12/2020 21:38, Willem Toorop wrote:
> > Op 02-12-2020 om 21:37 schreef Stephen Farrell:
> >
> > <snip>
> >
> >>> ad 2) we need a value that’s synchronized well enough and monotonic.
> >>> I honestly don’t see any value in using 64-bit value here. Using
> >>> unixtime has a value in itself, it’s a well-known and there’s a
> >>> little room for any implementer to make a mistake in an
> >>> implementation. The interoperability is more important than the
> >>> actual value of the counter. It’s write only counter, nobody is going
> >>> to interpret it after it has been generated, and it’s wide enough to
> >>> prevent brute forcing.
> >>
> >> So what happens after 2038? That's really not v. far in the
> >> future any more.
> >
> > The draft states that `All comparisons involving these fields MUST
> > use "Serial number arithmetic", as defined in [RFC1982]'. So it can not
> > be used to compare differences larger than 68 years, but comparisons of
> > cookie timestamps are more in the "hours" order of magnitude.
>
> Sorry for being dim, but is clear what value to put
> in those 4 octets in say 2039 such that different
> implementations will do the right thing? I did glance
> at rfc1982, so there may be very far-sighted text
> in there that I missed:-) And it may even be fine
> for this purpose if different servers differ by a
> second or so at that point, but even if so, it may
> be a bad plan to leave that unspecified in case
> other timestamps use the same code.
>

The reference to RFC1982 pretty much implies use of modulo arithmetic.
Maybe it would help to spell it out?
(Basically, calculate seconds since Jan 1 1970 at 0000 UTC, and if the
value is > 2^32, take the remainder mod 2^32.)

The RFC1982 specifies how the differences should be handled, so regardless
of which one is 0 and which one is 1 (or 2^32 - 1), the difference yielded
is a small number (i.e. 1).

This handles any relative time window less than 68 years, at any time in
the future (2038 or 2106 or 2256 or 22209.)

Brian