Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients
nalini elkins <nalini.elkins@e-dco.com> Tue, 12 March 2019 01:54 UTC
Return-Path: <nalini.elkins@e-dco.com>
X-Original-To: dnsop@ietfa.amsl.com
Delivered-To: dnsop@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4646C12E039 for <dnsop@ietfa.amsl.com>; Mon, 11 Mar 2019 18:54:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pUxab6BdDRlT for <dnsop@ietfa.amsl.com>; Mon, 11 Mar 2019 18:54:45 -0700 (PDT)
Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 495BF12D4E9 for <dnsop@ietf.org>; Mon, 11 Mar 2019 18:54:41 -0700 (PDT)
Received: by mail-lj1-x22f.google.com with SMTP id l16so823093ljc.9 for <dnsop@ietf.org>; Mon, 11 Mar 2019 18:54:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Yu9wpMac0qPy1t2fHsCOu1V6EC+oYiTi6mZWH3usOlo=; b=1sHRCyu7zlw4/V2tR7FsBzFoUhObKXi0mIYmJCr4r35tOfcCwOvKQqf1ypn4nbI8IB WWZY2zZ7EINgyLj5Z9SLMmRJL1VhNSL/Bb75VnFJ01XHQao3kTQ1jO31q+7AMQoNsJhi bF9fZImOCi8KlOmGMRyCyr3bshWo4ndqHAchUaDYNTEmFNEAY/h2HWwxisHR1DRxC/tw WpQ//hTjBvgBVxHHXiioL55HBMUxu3k49dqm3Ohpc1eadaNmlcbKhEspmUwcPGXFknzu 8XOy7G3oWDozdHGLDmA0OFtvkYR/Kr/dcE+46tjs/mTFHrfsq3AF6TsuEkCFkPl5liS0 HPpA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Yu9wpMac0qPy1t2fHsCOu1V6EC+oYiTi6mZWH3usOlo=; b=jjOL3EDo4aAK1x818LSudjZ3ocm3elbjnNLQ0MzdSMGUBpI7oQZI41UKrEmU5FQhWh +OW/yr6UgYwsT+yy6jxTRU3Lexw8Rwrv8yKbiuAKYnaYstiWHJyfeeiP4RzEIiNvSG5t e2LkfukTwUhHpXi4IWJDmAtrIA+wafcBEbV7rWTwk8X85+Cktacd7jWlonouFm3qRdcE Q3AABTx2x76uHy4Q99NC9Eima0wCHhv32Ft7PYXxy5i9uJk+2bPXUuxwPZSezjh2XsjO lwK4/l78qTEFOutvO2e/g6XIko/0+we0hmLf++m6+FuclvEyniqeesMlHSqoY+d2yNpk aDCg==
X-Gm-Message-State: APjAAAUbYtYyw5jHsX+2kBV9+4FnZHrKUWiZNvhEny7YBAlMzRqx72NQ AwZaC7uFCR6plTGSaJ8Y6I8Kf49lYgsVSIvY67eFAA==
X-Google-Smtp-Source: APXvYqzLQS/P1I/0IA1NDx7r4WqCZafy5vmwdJnCsNTpOH6vwtRVF6snT5AeaIyMKL7onjngu9r4BYGN7hiFpJMbuA4=
X-Received: by 2002:a2e:87cf:: with SMTP id v15mr818835ljj.22.1552355679295; Mon, 11 Mar 2019 18:54:39 -0700 (PDT)
MIME-Version: 1.0
References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <eea64b30-aad0-a030-5360-1b1484f1d0e3@huitema.net> <CAPsNn2WhjHSEHJUEL8GB6X0d24fkajgPnY4YgkOQbXjyxb5q8Q@mail.gmail.com> <e62efaf3-4a35-4a52-5ed4-dee2e7fafe72@huitema.net> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <CAPsNn2XNCzgAdfJtxBVboAe+d6sbCiV2fZv9185wm+HN+3zRdg@mail.gmail.com> <BYAPR16MB279065EE519680E7FC9A637CEA480@BYAPR16MB2790.namprd16.prod.outlook.com> <CAPsNn2Up1AtJJCdmu_9NC4jfzc-8dtE+QjUzRxMBUwaN44gvOg@mail.gmail.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <CAPsNn2VAgLDW++kb=Csfczp4oydqa4sY-dKWw7P7qTwj=MfxdQ@mail.gmail.com> <b405fbdd-dc36-5df1-b5bc-9ff2dcb149a2@cs.tcd.ie>
In-Reply-To: <b405fbdd-dc36-5df1-b5bc-9ff2dcb149a2@cs.tcd.ie>
From: nalini elkins <nalini.elkins@e-dco.com>
Date: Tue, 12 Mar 2019 07:24:29 +0530
Message-ID: <CAPsNn2VGMz0-3-5rZ7iSJcEAEWiT4pDMVETBnG60OE3LDbnf+Q@mail.gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Cc: Paul Vixie <paul@redbarn.org>, "doh@ietf.org" <doh@ietf.org>, "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@mcafee.com>, "dnsop@ietf.org" <dnsop@ietf.org>, "Ackermann, Michael" <mackermann@bcbsm.com>, Christian Huitema <huitema@huitema.net>, "dns-privacy@ietf.org" <dns-privacy@ietf.org>, Vittorio Bertola <vittorio.bertola=40open-xchange.com@dmarc.ietf.org>
Content-Type: multipart/alternative; boundary="000000000000d470610583dbf824"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnsop/yfdXA7eyOmHo-10F6N_27zIXbIA>
Subject: Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients
X-BeenThere: dnsop@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnsop>, <mailto:dnsop-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnsop/>
List-Post: <mailto:dnsop@ietf.org>
List-Help: <mailto:dnsop-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>, <mailto:dnsop-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 12 Mar 2019 01:54:54 -0000
Stephen, > TLS1.3 will, I expect, noticeably improve security for an awful lot of enterprises in time. I am sure you are right. There is also likely to be quite a bit of pain ahead for many. Also, this is exactly why I propose a neutral observer who might tease out the nuances. Or say something along the lines of "if you do x, you will need to do y". It may also be needed to have subtopics. And, the pro and con sides could also provide a writeup. The write up could also propose transition strategies. I am trying to make it so that people, including enterprises, can better decide the merits of the situation for themselves. Many people do not have the time, expertise or energy to follow these discussions which have gone on for a number of years. I have also seen assessments of protocol changes from people who have "a dog in the hunt" so to speak. That is, vendors who provide an assessment which (shockingly enough) results in their own products (which again shockingly, cost money) being the best solution. There is much hyperbole on all sides of not just the TLS1.3 issue but DoH also. I compliment the authors of the current drafts on DoH deployment drafts for good efforts to bring light to this subject. Having said that, I would like to see IETF work with a neutral third party, maybe an academic institution, or CERT, or someone else help people, including enterprise operators, who have to make decisions to implement these protocols and possibly change their architecture strategies. Even if we manage to come to consensus on an IETF draft and create an RFC on DoH deployment, many enterprises do not keep up with all RFCs nor do they always have the time to evaluate everything properly because they are so busy with the fires of the current day. I worked for large enterprises for many years doing network design and troubleshooting. I was always extremely busy fighting the issues of the day. Enterprises, and many others, do pay attention to what NIST or CERT says. Just my 2 cents to try to find a long term solution to what has been a contentious and exhausting multi-year set of discussions for all involved and which seems set to rekindle with DoH. Nalini On Tue, Mar 12, 2019 at 5:30 AM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote: > > (This distribution list is too scattered and diverse. Be > great if some AD or someone just picked one list for this. > In the meantime...) > > On 11/03/2019 20:43, nalini elkins wrote: > > impact assessment that certain changes such as > > DoH and TLS1.3 will have on enterprises, > > TLS1.3 will, I expect, noticeably improve security for an awful > lot of enterprises in time. > > As for DoH, I wonder has anyone done studies on how split-horizon > names and access patterns leak today? > > I don't recall having read that kind of study. I can imagine > many ways in which that kind of stuff would leak. I'd be very > surprised if it never happens. I don't know how often it does. > > For names, leaking once is kinda fatal. For access patterns, > I guess one leak exposes an IP address that's interested in a > name (e.g. secret-project.example.com) but more would be > needed for broader access patterns to be exposed to "foreign" > recursives and/or in-band networks. > > ISTM that it is quite possible that enterprises that deploy their > own DoH services could potentially reduce such leakage and gain > overall. (I'm assuming here that sensible browser-makers will > end up providing something that works for browsers running in > networks with split-horizon setups before those browsers turn > on DoH as a default at scale.) > > Cheers, > S. > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Christian Huitema
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Paul Vixie
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Christian Huitema
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Paul Vixie
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Eliot Lear
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Daniel Stenberg
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Brian Dickson
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Eric Rescorla
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Stephen Farrell
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… nalini elkins
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Stephen Farrell
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Neil Cook
- Re: [DNSOP] [EXTERNAL] Re: [dns-privacy] [Doh] Ne… Winfield, Alister
- Re: [DNSOP] [EXTERNAL] [dns-privacy] [Doh] New: d… Eliot Lear
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [dns-privacy] [EXTERNAL] [Doh] New: d… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephane Bortzmeyer
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Stephane Bortzmeyer
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephane Bortzmeyer
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Stephane Bortzmeyer
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Neil Cook
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Eric Rescorla
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephane Bortzmeyer
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Jim Reid
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Ralf Weber
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Neil Cook
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Jim Reid
- Re: [DNSOP] [dns-privacy] [EXTERNAL] [Doh] New: d… Eliot Lear
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Yishai Beeri (yishaib)
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Michael Sinatra
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Yishai Beeri (yishaib)
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Brian Dickson
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Mark Andrews
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Paul Wouters
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Paul Wouters
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Raymond Burkholder
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Vittorio Bertola
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… nalini elkins
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Raymond Burkholder
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Vittorio Bertola
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Raymond Burkholder
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Vittorio Bertola
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Eliot Lear
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Konda, Tirumaleswar Reddy
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Brian Haberman
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Livingood, Jason
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Christian Huitema
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Brian Dickson
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Brian Dickson
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Michael Sinatra
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Stephen Farrell
- Re: [DNSOP] [Doh] [dns-privacy] New: draft-bertol… Adam Roach
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Michael Sinatra
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Ted Lemon
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Bob Harold
- Re: [DNSOP] [dns-privacy] [Doh] New: draft-bertol… Paul Vixie
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… william manning
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Watson Ladd
- Re: [DNSOP] [dns-privacy] New: draft-bertola-bcp-… Paul Vixie