Re: [secdir] [dns-privacy] Secdir last call review of draft-ietf-dprive-rfc7626-bis-03

[Benjamin Kaduk <[e-mail]>]

On Wed, Dec 18, 2019 at 02:00:45PM +0000, Stephen Farrell wrote:
> 
> Hiya,
> 
> On 18/12/2019 13:45, Sara Dickinson wrote:
> > 
> > 
> >> On 29 Nov 2019, at 15:39, Stephen Farrell via Datatracker <[e-mail]> wrote:
> >>
> >> Reviewer: Stephen Farrell
> >> Review result: Ready
> > 
> > Hi Stephen, 
> > 
> > Thanks for reviewing (again)!
> > 
> >>
> >> I might not be the best reviewer for this one as I've read it a few times
> >> before. But anyway, I scanned the diff [1] with RFC7626 and figure it
> >> seems fine. 
> >>
> >> The only thing that occurred to me that seemed missing was to note
> >> that while the new privacy analysis in 3.5.1.1 is already complex, many
> >> systems are mobile and hence an analysis that ignores that won't be 
> >> sufficient. For a mobile device one really needs to analyse all of the 
> >> possible setups, and hence it's even harder to get to a good answer. 
> >> (It could be that that's elsewhere in the document but since I only 
> >> read the diff, I didn't see it:-)
> > 
> > There was a bit of discussion about this and the following text in 3.4.1 was added:
> > 
> > “ It is also noted that typically a device connected _only_ to a modern
> >    cellular network is
> > 
> >    o  directly configured with only the recursive resolvers of the IAP
> >       and
> > 
> >    o  all traffic (including DNS) between the device and the cellular
> >       network is encrypted following an encryption profile edited by the
> >       Third Generation Partnership Project (3GPP [2]).
> > 
> >    The attack surface for this specific scenario is not considered here."
> > 
> > Which hopefully covers this?
> 
> Not really, no. My point is that the analysis in 3.5.1.1
> doesn't encompass the fact that hosts are often (or even
> mostly) mobile and hence connect to many networks, and that
> the results of a privacy analysis related to DoT/DoH will
> likely differ for each of those networks, from the POV
> of the user or device owner, and even those two may not
> agree in some cases.
> 
> I don't believe that point is made in the document. But
> I'm ok that you and the ADs figure out if its needed or
> not.

I think some kind of treatment is needed, even if the extent of the
treatment might still be up for debate.

Sara: note that "mobile" here is used in the generic sense of "moving
around", not specific to a mobile or "cellular" pocket computer (aka
"phone").

(I also agree with Ekr that the considerations around 3GPP encryption
remain not great and would prefer to not rely on them.)

Thanks for raising these issues, Stephen and Ekr.

-Ben