Re: [Resolverless-dns] Paper on Resolver-less DNS

Viktor Dukhovni <ietf-dane@dukhovni.org> Thu, 29 August 2019 15:34 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: resolverless-dns@ietfa.amsl.com
Delivered-To: resolverless-dns@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C027A1208B1 for <resolverless-dns@ietfa.amsl.com>; Thu, 29 Aug 2019 08:34:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.2
X-Spam-Level:
X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V2cwzAcgAUAP for <resolverless-dns@ietfa.amsl.com>; Thu, 29 Aug 2019 08:34:45 -0700 (PDT)
Received: from straasha.imrryr.org (straasha.imrryr.org [100.2.39.101]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D41631208AD for <resolverless-dns@ietf.org>; Thu, 29 Aug 2019 08:34:44 -0700 (PDT)
Received: from [10.200.2.180] (sdzac10-108-1-nat.nje.twosigma.com [8.2.105.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by straasha.imrryr.org (Postfix) with ESMTPSA id 1AF884C874 for <resolverless-dns@ietf.org>; Thu, 29 Aug 2019 11:34:44 -0400 (EDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
In-Reply-To: <4ec7dd1d-e914-0adb-4240-296f2f762b5f@informatik.uni-hamburg.de>
Date: Thu, 29 Aug 2019 11:34:42 -0400
Content-Transfer-Encoding: quoted-printable
Reply-To: resolverless-dns@ietf.org
Message-Id: <ADC6E119-0EED-4990-A975-F594C9282872@dukhovni.org>
References: <CAHbrMsBhR1yaLxQk7wZk54Jdf5nvkS03KC3UTae0Famu2+SV8g@mail.gmail.com> <4568720.uvMTqBdgP4@linux-9daj> <fb12f102-714d-95cc-c6cc-0871a2df9f50@informatik.uni-hamburg.de> <34813218.VKkrhzyXsx@linux-9daj> <ae355776-a1bb-cf23-f380-133439661d1f@informatik.uni-hamburg.de> <1171283855.590.1566558699991@appsuite-gw1.open-xchange.com> <a8d9398b-4fea-0a1e-3fa7-5954d001f9ea@informatik.uni-hamburg.de> <1405682425.665.1566561941610@appsuite-gw1.open-xchange.com> <220061a8-608c-0a87-4656-213c87979284@informatik.uni-hamburg.de> <849BE7D4-A07E-496B-B413-E1C979390DA8@osterweil.net> <b2b3e56a-c577-f08a-627a-f54e2e6fadb6@informatik.uni-hamburg.de> <f093a605-6e7d-0237-df5c-441d6789c66f@erik-sy.de> <54892F22-27E4-4444-9CC8-2D9E84A9668F@dukhovni.org> <4ec7dd1d-e914-0adb-4240-296f2f762b5f@informatik.uni-hamburg.de>
To: resolverless-dns@ietf.org
X-Mailer: Apple Mail (2.3445.104.11)
Archived-At: <https://mailarchive.ietf.org/arch/msg/resolverless-dns/SpaJQc6Kqzc8xDwjn-_ZpZuWTzU>
Subject: Re: [Resolverless-dns] Paper on Resolver-less DNS
X-BeenThere: resolverless-dns@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Resolverless DNS <resolverless-dns.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/resolverless-dns>, <mailto:resolverless-dns-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/resolverless-dns/>
List-Post: <mailto:resolverless-dns@ietf.org>
List-Help: <mailto:resolverless-dns-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/resolverless-dns>, <mailto:resolverless-dns-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Aug 2019 15:34:47 -0000

> On Aug 29, 2019, at 10:36 AM, Erik Sy <sy@informatik.uni-hamburg.de>; wrote:
> 
> On 8/27/19 23:39, Viktor Dukhovni wrote:
>> Of course I am OK with a security mechanism that may deny access,
>> that's not the right question.
> 
> I disagree, that this question is flawed. It assumes that DNSSEC + DANE
> is an optional security mechanism in the context of web browsers.

Do or don't, there is no "try".  Optional security mechanisms are
largely pointless.  Presently browsers don't support DANE, some
day they may.  In any case, the issue at hand is DNS(SEC) bypass,
not DANE.

Resolver-less DNS as proposed disregards long-standing defenses
against address forgery by third parties, breaks geo load-balancing,
breaks local filters that protect networks against known bad actors,
and IDS systems that detect compromised nodes.

It introduce a new cache-poisoning channel, and surprising differences
between the IP addresses a browser might use to reach a site from cold
start vs. after visiting some unrelated site.

In the case of IPv6 it can be used to fingerprint and track clients by
giving them ephemeral client-specific addresses (in the server's /64
or broader prefix) for third-party servers, and then proxying their
connections (at layer 4) to the real server, while tracking the
client's access to each site.
 
> At least the given mechanism needs also to provide a significant
> security benefit. In my view, the additional benefit of DNSSEC+ DANE
> compared to Certificate Transparency + Strict Transport Security (HSTS
> or MTA-STS) is for the majority of server operators or users not relevant.

Let's not mix up HTTP and MTA-to-MTA SMTP.  In SMTP, DANE has significantly
broader deployment (protected domains) than MTA-STS.  The latter covers more
users of the big three centralized free email providers, but I am not a fan
of over-centralization of the Internet, and prefer open federated architectures.

> In my view, supporting DNSSEC + DANE TLSA in resolver-less DNS makes
> only sense if the server provides a full DNSSEC validation chain because
> everything else seems to introduce significant delays.

In any case, the issue at hand is DNS, not DANE.  A client that wants TLSA
records is not going to obtain them via resolver-less DNS, which IIRC is
just about IP addresses.

-- 
	Viktor.