Re: [Dots] Magnus Westerlund's No Objection on draft-ietf-dots-server-discovery-14: (with COMMENT)

["Konda, Tirumaleswar Reddy" <[e-mail]>]

> -----Original Message-----
> From: Magnus Westerlund <[e-mail]>
> Sent: Friday, November 6, 2020 4:12 PM
> To: [e-mail]; Konda, Tirumaleswar Reddy
> <[e-mail]>
> Cc: [e-mail]; [e-mail]; draft-ietf-dots-server-
> [e-mail]; [e-mail]
> Subject: Re: Magnus Westerlund's No Objection on draft-ietf-dots-server-
> discovery-14: (with COMMENT)
> 
> On Fri, 2020-11-06 at 07:44 +0000, Konda, Tirumaleswar Reddy wrote:
> > > -----Original Message-----
> > > From: Magnus Westerlund via Datatracker <[e-mail]>
> > > Sent: Thursday, November 5, 2020 7:27 PM
> > > To: The IESG <[e-mail]>
> > > Cc: [e-mail]; [e-mail];
> > > [e-mail]; Valery Smyslov <[e-mail]>;
> [e-mail]
> > > Subject: Magnus Westerlund's No Objection on draft-ietf-dots-server-
> > > discovery-14: (with COMMENT)
> > >
> > > CAUTION: External email. Do not click links or open attachments unless
> you
> > > recognize the sender and know the content is safe.
> > >
> > > Magnus Westerlund has entered the following ballot position for
> > > draft-ietf-dots-server-discovery-14: No Objection
> > >
> > > When responding, please keep the subject line intact and reply to all
> email
> > > addresses included in the To and CC lines. (Feel free to cut this
> > > introductory
> > > paragraph, however.)
> > >
> > >
> > > Please refer to https://www.ietf.org/iesg/statement/discuss-
> criteria.html
> > > for more information about IESG DISCUSS and COMMENT positions.
> > >
> > >
> > > The document, along with other ballot positions, can be found here:
> > > https://datatracker.ietf.org/doc/draft-ietf-dots-server-discovery/
> > >
> > >
> > >
> > > ----------------------------------------------------------------------
> > > COMMENT:
> > > ----------------------------------------------------------------------
> > >
> > > Shouldn't the security consideration section 8.2 ave some additional
> > > warnings
> > > about the ease of affecting the dns lookup when .local is used. This as
> mDNS
> > > more easily can be gamed?
> >
> > Yes, but the discovery uses global names and not ".local". DNSSEC can be
> used
> > to validate the response.
> 
> Ok, that is better, sorry for missing that part. Still as mDNS results that that
> nodes on the network segment or multicast domain used easily can inject
> answers.

Yes.

> So it enlarges the attack surface, but DNS without DNSSEC appears quite
> sensitive to targeted attacks on the name resolution of the DOTS servers.
> I think comparing sections 8.3 and 8.2 is interesting. In 8.2 you are explicit
> about the attackers interest in compromising the S-NAPTR resolution. But
> the
> same attack potential in DNS-SD is not mentioned.

The attack discussed in 8.2 is also applicable to 8.3 and authenticating the discovered DOTS server using TLS server certificate protects against DNS spoofing attack (similar to HTTPS).

> 
> Is redirects allowed here when doing the lookup and does that affect what
> domain
> name one will use in SNI in DTLS when connecting to the DOTS agent? Just
> trying
> to understand if the DTLS connection step is a second line of defence for the
> DNSSD step? 

Re-directs are only possible after the (D)TLS session is established, please see https://tools.ietf.org/html/rfc8782#section-4.6 


> In other words that an attacker can inject or modify DNS
> response to
> ensure that the DOTS client connects to the attacks server, but that it isn't
> fooled that this is the intended one?

Yes, spoofing the DNS response is of no use as it will be detected by the DOTS client during server certificate validation.

Cheers,
Tiru


> 
> Cheers
> 
> Magnus
> 
> 
> 
> 
>