IETF Logo Mail Archive

Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients

"Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com> Tue, 12 March 2019 05:15 UTC

Return-Path: <TirumaleswarReddy_Konda@mcafee.com>
X-Original-To: doh@ietfa.amsl.com
Delivered-To: doh@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81A47131290; Mon, 11 Mar 2019 22:15:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.301
X-Spam-Level:
X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RFbAaA8OvC8U; Mon, 11 Mar 2019 22:15:18 -0700 (PDT)
Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE93213128F; Mon, 11 Mar 2019 22:15:17 -0700 (PDT)
X-NAI-Header: Modified by McAfee Email Gateway (5500)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552367518; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-exchange-diagnostics:x-microsoft-antispam-prvs: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=8apUTQ2Rg2TuPm6eDGJC7S1cpxXConzm3seeit 3Vpjs=; b=Vezmk/YUGZoCaO4S4tkzW0GdzwhZnmKeNzkqTic+ Mg/FaHLBLXdccYl1BKB9+Cy9QLnBFRxeQP/ORh20/bPqjQOM/e Cu/EIkPqsiwAv33WNBkGuJQPr0aduQin69QHwv4VNDturEwzEB /cYCWCXVfXKr1nB7JxRtSSXgIP/rZq4=
Received: from DNVEXAPP1N05.corpzone.internalzone.com (DNVEXAPP1N05.corpzone.internalzone.com [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 21f1_7bb6_a793184e_2323_4c6e_9224_3f1dcdf25a14; Mon, 11 Mar 2019 23:11:58 -0600
Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:14:47 -0600
Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 11 Mar 2019 23:14:47 -0600
Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:14:45 -0600
Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2743.namprd16.prod.outlook.com (20.178.232.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.18; Tue, 12 Mar 2019 05:14:43 +0000
Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1686.021; Tue, 12 Mar 2019 05:14:43 +0000
From: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>, Paul Vixie <paul@redbarn.org>, "doh@ietf.org" <doh@ietf.org>
CC: nalini elkins <nalini.elkins@e-dco.com>, "dnsop@ietf.org" <dnsop@ietf.org>, "Ackermann, Michael" <mackermann@bcbsm.com>, "Christian Huitema" <huitema@huitema.net>, "dns-privacy@ietf.org" <dns-privacy@ietf.org>, Vittorio Bertola <vittorio.bertola=40open-xchange.com@dmarc.ietf.org>
Thread-Topic: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients
Thread-Index: AQHU2C+f7jidn2WHF0WeuF/A93J/OKYGu6uAgAAqIQCAADb2gIAASnQQ
Date: Tue, 12 Mar 2019 05:14:42 +0000
Message-ID: <BYAPR16MB27902B449F94D0332AAED8E8EA490@BYAPR16MB2790.namprd16.prod.outlook.com>
References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <eea64b30-aad0-a030-5360-1b1484f1d0e3@huitema.net> <CAPsNn2WhjHSEHJUEL8GB6X0d24fkajgPnY4YgkOQbXjyxb5q8Q@mail.gmail.com> <e62efaf3-4a35-4a52-5ed4-dee2e7fafe72@huitema.net> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <CAPsNn2XNCzgAdfJtxBVboAe+d6sbCiV2fZv9185wm+HN+3zRdg@mail.gmail.com> <BYAPR16MB279065EE519680E7FC9A637CEA480@BYAPR16MB2790.namprd16.prod.outlook.com> <CAPsNn2Up1AtJJCdmu_9NC4jfzc-8dtE+QjUzRxMBUwaN44gvOg@mail.gmail.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <CAPsNn2VAgLDW++kb=Csfczp4oydqa4sY-dKWw7P7qTwj=MfxdQ@mail.gmail.com> <b405fbdd-dc36-5df1-b5bc-9ff2dcb149a2@cs.tcd.ie>
In-Reply-To: <b405fbdd-dc36-5df1-b5bc-9ff2dcb149a2@cs.tcd.ie>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
dlp-product: dlpe-windows
dlp-version: 11.2.0.6
dlp-reaction: no-action
authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com;
x-originating-ip: [103.245.47.20]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 5c11c847-5046-46ed-5c19-08d6a6a9a2d1
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2743;
x-ms-traffictypediagnostic: BYAPR16MB2743:
x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIyNzQzOzIzOkVBQmlWNWZNK0g1a0tOdGFSbXlNVlJtcHU0?= =?utf-8?B?UTZlNk0wYWU2amhiSXl0QmFLQ3NPcDhacjI0SFN4TGFIeWx1OVN4UHFWK2JR?= =?utf-8?B?N3liSGVsOG1kWlZnallVcS82Uys4N3hhY2pjaGMzZXRnUHVUU3pVaUtzYlhB?= =?utf-8?B?THVUTVd4ZWpzWU1CSVVnYi9iVDQyb0JFZlZsaWxPWnk3STdhVmhJeUp3L2xL?= =?utf-8?B?ZEoydTJ6REpyTllWOWU5bHBuT0FvUks0TDZTS1g5L255ckFwVWdXRzI3dzYy?= =?utf-8?B?cTBXOU5kdDU4OEtJekVwTmVwbXRBRzdVYTNTY0RyZ2dVbzBWZU1EdFB3U2g5?= =?utf-8?B?RERRT09GTjViMjgwbGJCZWZ3ZG84aStyTmRTeHBES3N2Qjd1cGh1SlpUZU1O?= =?utf-8?B?VXZaSXBTeDRkUEpWZjQyWDdwRDRrUFloamhyTUR6VUhESWx5TFNhV20xbW1n?= =?utf-8?B?OHIxS3FVWjExQWZDeXZhazJhcTNjQVJlRHlkeFVFbk1BR2R2UTlCMkdlY0RS?= =?utf-8?B?aTg5cWpDK1RSK3VheGQySmhyc3BEYks3bDQxNEIzNkZhOUdaRVgwNStYTFR1?= =?utf-8?B?cVFhekpNNUM4VG03NFhFelNHL0JkVUJzUi9LM2NnTE1ndnFTVUQ2aWxmQlh0?= =?utf-8?B?b0NNUUFWY0hNUUZva0IvbE1WQTdYeXQ1OHJvTmVDNWhkcWlpbXFiWXY1K2p1?= =?utf-8?B?MWdaK2wxcVArOXBRWlV5dGlpWU5RWVEwTmwzUGp0aGFwRHQxRS80em1kRnFO?= =?utf-8?B?N2w5dlR0T1FaNzhSZWJVSklSejljSjFyRlBHbzdZWHl6ZElUZmJFNUR0TGVj?= =?utf-8?B?YW0zRzAwNVN2WDVMaVErMGc5czUyTmFwTHJzYjl2Ykdna2RLWEIyQzlUVkNi?= =?utf-8?B?c3pjL25hSXBZWS9hTnAwMEtrSmZmYjN6YmZaR21TaHF2cmZmelllSG9XeXlt?= =?utf-8?B?RUo3VVFBVzJVM1UrQkFmcDJnSkF4SVY4eHlWWTZtMnNrWkV1bjFacHpXQVl1?= =?utf-8?B?dVFkU1JheW9OajZWNmhyZWs0cTdwdU9YWGtvMG94YmQwRjdhbG9SNzZIekdI?= =?utf-8?B?ZWNXZkhVWWR1RXVXUW40WTlOVEMyVnRxUk9YbXY0c0pXN2dTRjVEaXJVSFhr?= =?utf-8?B?cTQ4d0F3OVM1aGoyT0puK1BXOUJ3Yml2S3ZzaGpkR3U2REFXUUlQMDV4ZUhI?= =?utf-8?B?MU5IVFVnL2tHZFRRYWxEa1lkMFArZUlqTGFDRmlXVG52TTBhUnordlhvZ2VM?= =?utf-8?B?ak9tS2ZvRENndDFJSHRld0NhL3lrVnQzSDlEYVh3YkZ4ZTR1eFdpREJXcERn?= =?utf-8?B?S0ZGeFNZZGg2RWQwYmZwcXVveGFhVjkyTldvUGtyVlhWMlhYMTVydlBEekNs?= =?utf-8?B?TDNITFJCSEZ1S3BWS0JUVzdHVlljMEl1ZzRERlYwU0dlMXVrcFFnOGRROCtF?= =?utf-8?B?VTdPR0FHVWUzRHRhWENrcTFsVSsvV0RZYnRZOHQ3SU9jaXhxVUp1Tkh0d2hy?= =?utf-8?B?RVkxT1E3cnZyR0s1Wk1tTnlIeEJVWnEza3ZnTUdydEFuY1pxSHdRdFppRnFa?= =?utf-8?B?aHpQV0lzeGhlTk9mMGNuY1NZUFo5ZTF0bGJ0WUdpZFNIVXMrTHBwOGJDd3JT?= =?utf-8?B?TkcyT2RKbHNoQ09KS0FSSUZWOUFnNVpUYVBYQm8rOFJBaUZVMElUdkgrcTV3?= =?utf-8?B?cHJENEx3eXRxNW1haUVIWVZiaTF3MmN0d012LzJwTGZSSXUySmhYMVkySHBt?= =?utf-8?B?alg2Z2FFUXFjbHBpeHpXc1RjMktXNzRRaCtvcmpjaEhRSnNnU3BxQ3ZjQnl5?= =?utf-8?B?My9RZlJ4czhTQVNNT1ZvWnZsWFJaSWNRZXM3elB4TWlNaGUzRlZTcU9WSEI4?= =?utf-8?B?Y3Buc20vcnQ4bEJia2dzNWdyazV1bXMvakNqb3pucUw0Z1FxcThvREFheTFW?= =?utf-8?B?Vy9sRVVYWndmYmUrNHA2bmw5UVk4VVFKQlRrbjFFK2l0TERkUm5TTVhaQWxJ?= =?utf-8?Q?99wkEV?=
x-microsoft-antispam-prvs: <BYAPR16MB2743060473D26D963BDF700FEA490@BYAPR16MB2743.namprd16.prod.outlook.com>
x-forefront-prvs: 09749A275C
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(39860400002)(136003)(396003)(189003)(199004)(55674003)(32952001)(13464003)(97736004)(186003)(80792005)(53936002)(316002)(93886005)(6436002)(53546011)(6246003)(296002)(26005)(6506007)(81156014)(76176011)(66574012)(5660300002)(102836004)(2501003)(66066001)(81166006)(8936002)(7696005)(72206003)(8676002)(14454004)(99286004)(478600001)(52536013)(305945005)(11346002)(74316002)(7736002)(486006)(106356001)(9686003)(54906003)(2906002)(105586002)(476003)(446003)(4326008)(86362001)(68736007)(55016002)(33656002)(71190400001)(229853002)(71200400001)(3846002)(110136005)(6116002)(256004)(25786009)(14444005)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2743; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam-message-info: sNSFFo1p13BhpSX0//h0GCVDaBV3QE37qqnyqamWX56jhbU187YuxWlW7XRIXQvJT0Y0XEwbPhnXUrLAACNjBITj+JLAGpGmuQCWYkQtQo/s6/WJDeVKaqhsjN+HKP9h0S3Y3odJgn1zY3tdwXuMcP2+9xa5C4Z9uQQoNkWhvllLo2wiEngWUxT7aZ/b3ZiEAil+taC/WMhAoueAMLvQCRjnW3J9pknTfKkhVAYSVGHewuFSJUjzSpQwjaPYA6bzhXCnfwSBaay9+FVY/D2R1Wz08ZNthkqtfCCUgeoFH3dT9RSLxkKqmgoPLFKyuaFTyjqe1QsnNMEFKL1L5y2dMXAEhmLnD4QjBpwJ2WB9yjv0DHVEV+9dj/aaL5iCjBpeuEmpaQ8REr0AYx76dfYD+zYhfXhKjltcdCffP+fmjTc=
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 5c11c847-5046-46ed-5c19-08d6a6a9a2d1
X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 05:14:42.9686 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2743
X-OriginatorOrg: mcafee.com
X-NAI-Spam-Flag: NO
X-NAI-Spam-Level:
X-NAI-Spam-Threshold: 15
X-NAI-Spam-Score: 0.1
X-NAI-Spam-Version: 2.3.0.9418 : core <6500> : inlines <7031> : streams <1815460> : uri <2811186>
Archived-At: <https://mailarchive.ietf.org/arch/msg/doh/wmNyb2Ak-1k1t4oNsQHZeERqOcs>
Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients
X-BeenThere: doh@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DNS Over HTTPS <doh.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/doh>, <mailto:doh-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/doh/>
List-Post: <mailto:doh@ietf.org>
List-Help: <mailto:doh-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/doh>, <mailto:doh-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 12 Mar 2019 05:15:21 -0000

> -----Original Message-----
> From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
> Sent: Tuesday, March 12, 2019 5:30 AM
> To: Paul Vixie <paul@redbarn.org>rg>; doh@ietf.org
> Cc: nalini elkins <nalini.elkins@e-dco.com>om>; Konda, Tirumaleswar Reddy
> <TirumaleswarReddy_Konda@McAfee.com>om>; dnsop@ietf.org; Ackermann,
> Michael <mackermann@bcbsm.com>om>; Christian Huitema
> <huitema@huitema.net>et>; dns-privacy@ietf.org; Vittorio Bertola
> <vittorio.bertola=40open-xchange.com@dmarc.ietf.org>
> Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients
> 
> 
> (This distribution list is too scattered and diverse. Be great if some AD or
> someone just picked one list for this.
> In the meantime...)
> 
> On 11/03/2019 20:43, nalini elkins wrote:
> >  impact assessment that certain changes such as DoH and TLS1.3 will
> > have on enterprises,
> 
> TLS1.3 will, I expect, noticeably improve security for an awful lot of
> enterprises in time.
> 
> As for DoH, I wonder has anyone done studies on how split-horizon names
> and access patterns leak today?
> 
> I don't recall having read that kind of study. I can imagine many ways in
> which that kind of stuff would leak. I'd be very surprised if it never happens.
> I don't know how often it does.
> 
> For names, leaking once is kinda fatal. For access patterns, I guess one leak
> exposes an IP address that's interested in a name (e.g. secret-
> project.example.com) but more would be needed for broader access
> patterns to be exposed to "foreign"
> recursives and/or in-band networks.
> 
> ISTM that it is quite possible that enterprises that deploy their own DoH
> services could potentially reduce such leakage and gain overall. (I'm
> assuming here that sensible browser-makers will end up providing
> something that works for browsers running in networks with split-horizon
> setups before those browsers turn on DoH as a default at scale.)

If Enterprise network provides a DoT/DoH server, browser should be able to discover and use the Enterprise DoT/DoH server.

-Tiru

> 
> Cheers,
> S.

v2.8.7 | Report a Bug | By Email