[dnssd] Multicast DNS (mDNS) Threat Model and Security Consideration

["Albrecht, Harald" <[e-mail]>]

Hi,

just came across a few minor things in the DNSSD I-D "Multicast DNS (mDNS) Threat Model and Security Consideration" -02.

In section 3.2.2, second scenario the term "Time To Leave" for TTL should be "Time To Live" instead (http://en.wikipedia.org/wiki/Domain_Name_System#DNS_resource_records). Albeit I have to admit that "time to leave" has a very nice ring :)

In section 3.3.1 you write "[...] these services may automatically announce over mDNS both Universal Local Addresses (ULA) [RFC4193] and Global Unicast Addresses (GUA). Since a GUA address is global, the associated node may become accessible over the Internet." I think that the second GUA reference should be to ULAs instead, that is, "Since a ULA address is global [...]".

Another thing that strikes me is the use of "GUA address" and "ULA address". The "A" in "GUA" and "ULA" already means address, so "GUA address" basically means a "global unicast address address". Either a sole "GUA"/"ULA" is already sufficient or always spell "global unicast address" in full.

With respect to section 3.7.1 "Storing mDNS names in unicast DNS" I wonder if there are attacks possible based on leaking UTF-8 labels into unicast DNS and thus upsetting either DNS servers, (stub) resolvers, and IDNA libraries?

In section 3.13.4.1 what is the security standpoint rationale to not publish GUAs? For instance, if a site decides to not use ULAs but only GUAs (believe me, there are such huge sites in IPv4 that run their company intranet on global addresses, not on private ones) then this would not be less secure than using ULAs. Some moments before the draft argues with respect to ULA accessibility. The same also applies to GUAs. Not publishing something doesn't mean it's not reachable - this would be a perfect example of security by obscurity. And security by obscurity is known to not offer any security at all. So, please detail the rationale behind 3.13.4.1 and it focusing on ULA only.

Best regards,
Harald Albrecht

Siemens AG
Digital Factory Division
Gleiwitzer Str. 555
90475 Nuernberg, Germany

Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Gerhard Cromme; Managing Board: Joe Kaeser, Chairman, President and Chief Executive Officer; Roland Busch, Lisa Davis, Klaus Helmrich, Janina Kugel, Siegfried Russwurm, Ralf P. Thomas; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322