Re: [secdir] Security review of draft-ietf-dnsop-onion-tld-00.txt

[Kathleen Moriarty <[e-mail]>]

Hi,

I don't see any on list responses to the points Christian raised, have
they been addressed?

Thank you,
Kathleen

On Mon, Jul 20, 2015 at 4:09 AM, Christian Huitema <[e-mail]> wrote:
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> The document proposes to reserve the “.onion” TLD for special use by the TOR
> project. The document is short and easy to read, went through the last call
> process, and is probably ready to publish. I just wish there was a clearer
> structure to the security section.
>
> I am a bit puzzled by the way the security section is written. Since the
> purpose of the draft is to reserve the “.onion” TLD, I would expect the
> security section to present the security issues mitigated or introduced by
> this TLD reservation. As far as I understand, the main security issues come
> from client confusion, which could cause “.onion” names to be resolved
> through the standard DNS process. A number of bad things happen then, from
> simple information disclosure that a client is trying to access a TOR
> service, to potential spoofing of secure TOR services. In fact, the main
> reason for the registration request is to mitigate these security issues, by
> requesting that standard DNS resolvers and servers recognize “.onion”
> requests and refuse to forward them.
>
> The security section makes all these points, but it also mixes in a
> description of the structure of .onion names and their cryptographic
> components. I believe the issues would be easier to understand if the main
> body of the document included a short description of the TOR naming process
> and name resolution.
>
> The security section also does not explain how the “leakage of names” issue
> is mitigated for legacy systems. By definition, these systems have not been
> updated and do not perform special treatment of “.onion” names. The TLD
> reservation probably helps somewhat, but this is not discussed.
>
> Then, the security section also does not discuss how malicious name
> resolvers could be deployed in order to attack the TOR network. For example,
> if TOR security relies on DNS servers “black holing” misrouted request to
> resolve “.onion” names, what happens if malicious servers replace the
> suggested black-holing with some malicious tampering?
>
> -- Christian Huitema
>
>
>
>
>
>



-- 

Best regards,
Kathleen