DNS64, DANE and DPRIV

[Phillip Hallam-Baker <[e-mail]>]

Following up on the DNS64 discussion. There is an important action item
that IETF can take right now that has a lot of leverage for IPv6
deployment.

* DPRIV be required to provide a mechanism for mutual authentication as
well as confidentiality.

This is not a major increase in scope. Authentication is essential for
confidentiality. But it is a big improvement in leverage.


The idea of DPRIV is that instead of sending requests to a random DNS
resolver in plaintext, we instead send them encrypted. And by implication
we also direct them to a resolver that can be trusted not to disclose the
traffic to an attacker.

So in the DPRIV model, the resolver is trusted. I suggest that there are in
fact quantized levels of trust.

0) Service: To provide responses to requests
1) Confidentiality: To not disclose traffic to third parties
2) Routing Integrity: To provide A and AAAA record responses that connect
traffic to the correct end point
3) Security Integrity: To provide keys for the end points.

Now depending on how much processing you are prepared to put in the client
you can reduce the level of trust. But you do need more code (or human
intervention).

So it is in theory possible to use DNSSEC to avoid the need to rely on the
resolver to return responses but I have never seen that done in a
completely robust fashion because it would require a lot of code and a lot
of corner cases.

The point of DNS64 is to provide a mechanism that makes it easy to turn on
IPv6 today. All the client needs is a connection to a DNS router that
supports DNS64.


Because of network circumstances a client using DNS64 is almost certainly
going to need to use DPRIV for access simply because port 53 has been
sabotaged so thoroughly. So we are going to have to trust the DPRIV
resolver to level 1 at minimum

The fact that we are considering DNS64 at all implies that we are willing
to trust the resolver to level 2. But to do that we have to have
authentication of the resolver at minimum and I would argue that mutual is
also necessary for enterprise deployment.

As soon as we have DPRIV with authentication it becomes possible to ship
IPv6 only products today. The only facility those products require to
connect to the IPv4 Internet is a DPRIV connection to a DNS resolver that
offers DNS64.


Note however, that trust to level 2 does not entail trust to level 3. An IP
address and a Key or Key fingerprint are two very different things. A Key
or Key fingerprint is an authenticator. An IP address is not an
authenticator, or at least it is a very weak one whose interpretation
requires us to trust a great deal more than our resolver.