Re: [Doh] New Version Notification for draft-dickinson-doh-dohpe-00.txt

[Ben Schwartz <[e-mail]>]

On Thu, Jul 19, 2018 at 10:52 AM Sara Dickinson <[e-mail]> wrote:

>
>
> On 18 Jul 2018, at 16:22, Ben Schwartz <[e-mail]> wrote:
>
> I think this draft could use review from readers familiar with HTTP.  I
> hope that people with knowledge of HTTP will help us to understand whether
> this draft's recommendations would result in a significant increase in user
> privacy.
>
>
> Completely agree.
>
>
> For the draft's authors, I have a question: does this draft's "privacy
> threat model" include a DOH server that uses active measures to
> differentiate clients?  Or is it scoped only to passive discrimination
> between different client implementations?
>
>
> Both of these.
>

OK.  In that case, I think the draft would need to cover all the client's
error handling, redirect following, and retry logic, i.e. any behavior the
server could observe by generating targeted or malformed responses.  This
sounds challenging.

This is also true for the underlying DNS implementation.  Even without HTTP
or TLS, I suspect that by similar methods (using malformed responses or
exercising various unusual features), a recursive resolver could identify
the stub resolver software with high precision.

As Martin points out, the HTTP aspect of this is fairly widely applicable,
outside of DOH.  I think the same is probably true of the DNS side.  Thus,
one possibility would be to address those aspects separately.

> As for other issues, I think the draft might need to consider header order.
>
>
> Yes - a couple of other folks have mentioned that too.
>
>   I also couldn't find an easy list of mandatory headers in RFC 7540, so
> that list might be worth repeating.
>
>
> There doesn’t seem to be a simple example in any draft I found so the
> current text is a bit of a cop-out. I was wondering if it would make more
> sense to have the list in draft-ietf-httpbis-bcp56bis-06 as a general
> clarification and then this document could reference that?
>
> Or Stephane suggested pointing to RFC 7230 (plus a bit of RFC 7231)
> instead. But actually I now think example messages would be the most
> explicit way to show what DoHPE messages should look like.
>
> Sara.
>
>
>
> On Wed, Jul 18, 2018 at 10:03 AM Sara Dickinson <[e-mail]> wrote:
>
>> Hi All,
>>
>> We’ve just submitted a very short draft outlining a privacy profile for
>> DoH called DoHPE.
>>
>> It is very basic at the moment but it would be great to get some feedback
>> on the idea here and to see if the WG sees this as something that should go
>> through this group or head somewhere else. Since the guidelines are purely
>> HTTP related, this does feel like the right audience to review the document
>> at least in the first instance.
>>
>> Sara.
>>
>>
>> Begin forwarded message:
>>
>> *From: *[e-mail]
>> *Subject: **New Version Notification for
>> draft-dickinson-doh-dohpe-00.txt*
>> *Date: *18 July 2018 at 09:58:48 GMT-4
>> *To: *"Sara Dickinson" <[e-mail]>, "Willem Toorop" <
>> [e-mail]>
>>
>>
>> A new version of I-D, draft-dickinson-doh-dohpe-00.txt
>> has been successfully submitted by Sara Dickinson and posted to the
>> IETF repository.
>>
>> Name: draft-dickinson-doh-dohpe
>> Revision: 00
>> Title: DoHPE: DoH with Privacy Enhancements
>> Document date: 2018-07-18
>> Group: Individual Submission
>> Pages: 8
>> URL:
>> https://www.ietf.org/internet-drafts/draft-dickinson-doh-dohpe-00.txt
>> Status:
>> https://datatracker.ietf.org/doc/draft-dickinson-doh-dohpe/
>> Htmlized:       https://tools.ietf.org/html/draft-dickinson-doh-dohpe-00
>> Htmlized:
>> https://datatracker.ietf.org/doc/html/draft-dickinson-doh-dohpe
>>
>>
>> Abstract:
>>   This document describes DoHPE (DoH with Privacy Enhancements) - a
>>   privacy and anonymity profile for DoH [I-D.ietf-doh-dns-over-https]
>>   clients.  The profile provides guidelines on the composition of DoH
>>   messages, designed to minimize disclosure of identifying information.
>>
>>
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> The IETF Secretariat
>>
>>
>> _______________________________________________
>> Doh mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/doh
>>
>
>