Re: [DNSOP] Consensus check on underscore names and draft-ietf-dnsop-rfc7816bis

[Peter Thomassen <[e-mail]>]

On 7/7/21 7:54 PM, Warren Kumari wrote:
> Obviously there is a tradeoff here -- privacy vs deployment.
> 1: while it's **possible** that there is a delegation point at the
> underscore label, (IMO) it is unlikely. If there is no delegation, you
> will simply be coming back to the same server again and again, and so
> you are not leaking privacy sensitive information.

There are deployments with delegations at _openpgpkey, such as _openpgpkey.posteo.de. This is how I would do such a deployment myself. As there are only hashes exposed, I don't see a privacy issue if no QNAME Minimization is done. (The point is that I would argue that such a delegation points is not unlikely.)

Another example is _acme-challenge. About 0.1% of zones hosted at desec.io have a delegation point there. (Ok, that's not very frequent.)

The draft for authenticated bootstrapping of DNSSEC delegations (https://datatracker.ietf.org/doc/draft-thomassen-dnsop-dnssec-bootstrapping/) does suggest a zone cut at an underscore name. However, that's not to say it would be a privacy-relevant one, so it seems fine to me when QNAME Minimization is not done in this case.

It is unclear whether the future will bring underscore labels under which privacy-sensitive owner names may reside.

> Should the advice above be strengthened to SHOULD / RECOMMENDED?

Especially because of the last reason above, I tend towards MAY.

However, I would endorse SHOULD / RECOMMENDED if the wording is changed such that "skipping a split" is done "up to the lowest-level" underscore label. In other words, jumping from example.com to _25._tcp.example.com would be RECOMMENDED, but jumping from example.com to foobar._openpgpkey.example.com would not, because "foobar" is no an underscore label. Generally, if there are N consecutive underscore labels, minimization SHOULD be skipped for the N-1 of them which are closest to the root.

Cheers,
Peter

-- 
Like our community service? 💛
Please consider donating at

https://desec.io/

deSEC e.V.
Kyffhäuserstr. 5
10781 Berlin
Germany

Vorstandsvorsitz: Nils Wisiol
Registergericht: AG Berlin (Charlottenburg) VR 37525