Re: [secdir] [dns-privacy] Secdir last call review of draft-ietf-dprive-rfc7626-bis-03

[Benjamin Kaduk <[e-mail]>]

On Tue, Jan 07, 2020 at 06:34:58PM +0000, Sara Dickinson wrote:
> 
> 
> > On 23 Dec 2019, at 22:05, Benjamin Kaduk <[e-mail]> wrote:
> > 
> > On Wed, Dec 18, 2019 at 02:00:45PM +0000, Stephen Farrell wrote:
> >> 
> >> Hiya,
> >> 
> >> On 18/12/2019 13:45, Sara Dickinson wrote:
> >>> 
> >>> 
> >>>> On 29 Nov 2019, at 15:39, Stephen Farrell via Datatracker <[e-mail]> wrote:
> >>>> 
> >>>> Reviewer: Stephen Farrell
> >>>> Review result: Ready
> >>> 
> >>> Hi Stephen, 
> >>> 
> >>> Thanks for reviewing (again)!
> >>> 
> >>>> 
> >>>> I might not be the best reviewer for this one as I've read it a few times
> >>>> before. But anyway, I scanned the diff [1] with RFC7626 and figure it
> >>>> seems fine. 
> >>>> 
> >>>> The only thing that occurred to me that seemed missing was to note
> >>>> that while the new privacy analysis in 3.5.1.1 is already complex, many
> >>>> systems are mobile and hence an analysis that ignores that won't be 
> >>>> sufficient. For a mobile device one really needs to analyse all of the 
> >>>> possible setups, and hence it's even harder to get to a good answer. 
> >>>> (It could be that that's elsewhere in the document but since I only 
> >>>> read the diff, I didn't see it:-)
> >>> 
> >>> There was a bit of discussion about this and the following text in 3.4.1 was added:
> >>> 
> >>> “ It is also noted that typically a device connected _only_ to a modern
> >>>   cellular network is
> >>> 
> >>>   o  directly configured with only the recursive resolvers of the IAP
> >>>      and
> >>> 
> >>>   o  all traffic (including DNS) between the device and the cellular
> >>>      network is encrypted following an encryption profile edited by the
> >>>      Third Generation Partnership Project (3GPP [2]).
> >>> 
> >>>   The attack surface for this specific scenario is not considered here."
> >>> 
> >>> Which hopefully covers this?
> >> 
> >> Not really, no. My point is that the analysis in 3.5.1.1
> >> doesn't encompass the fact that hosts are often (or even
> >> mostly) mobile and hence connect to many networks, and that
> >> the results of a privacy analysis related to DoT/DoH will
> >> likely differ for each of those networks, from the POV
> >> of the user or device owner, and even those two may not
> >> agree in some cases.
> >> 
> >> I don't believe that point is made in the document. But
> >> I'm ok that you and the ADs figure out if its needed or
> >> not.
> > 
> > I think some kind of treatment is needed, even if the extent of the
> > treatment might still be up for debate.
> > 
> > Sara: note that "mobile" here is used in the generic sense of "moving
> > around", not specific to a mobile or "cellular" pocket computer (aka
> > "phone”).
> 
> Thanks - I did misread Stephens response - I see the issue now.
> 
> As a starting point I would suggest some text at the very beginning of Section 3 along these lines. 
> 
> “This section outlines the privacy considerations associated with different aspects of the DNS for the end user. When reading this section it needs to be kept in mind that many of the considerations (for example, recursive resolver and transport protocol) can be specific to the network context that a device is using at a given point in time. A user may have many devices and each device might utilise many different networks (e.g. home, work, public or cellular) over a period of time or even concurrently. An exhaustive analysis of the privacy considerations for an individual user would need to take into account the set of devices used and the multiple dynamic contexts of each device. This document does not attempt such a complex analysis, instead it presents an overview of the various considerations that could form the basis of such an analysis. "

Okay.

> > 
> > (I also agree with Ekr that the considerations around 3GPP encryption
> > remain not great and would prefer to not rely on them.)
> 
> I think the idea of the above text was to show there is an orthogonal but out of scope issue with 3GPP encryption, not to make any judgement on it as a technology. Are you saying that the document should make an explicit statement something like ’This form of encryption should not generally be considered secure but an analysis is out of scope for this document. The attack surface for this specific scenario is not considered here.’?

I don't think it's necessary to make an explicit statement such as you
propose, but would prefer to just not not say as much about 3GPP encryption
at all.  The current text in the -03 is prefaced with "a device connected
_only_ to a modern cellular network", and while the latest-and-greatest
stuff has less known breakage, in practice current deployments still seem
to allow downgrade attacks to the more-vulnerable older protocols.

> If I have misunderstood, please suggest some text to be used here.

My thinking would be more along the lines of updating the bullet point in
3.4.1 to be like:

o some level of protection against some types of eavesdropping is afforded
  to all traffic (including DNS traffic) due to the cellular network
  link-layer encryption.

This is probably not the document in which to attempt a comprehensive
analysis of cellular traffic (including radio and core network), and with
this wording it probably avoids the need to pull in specific references for
attacks on cellular links, along the lines of
https://www.zdnet.com/article/stingray-security-flaw-cell-networks-phone-tracking-surveillance/,
https://arxiv.org/pdf/1510.07563.pdf, https://alter-attack.net/,
https://blog.cryptographyengineering.com/2013/05/14/a-few-thoughts-on-cellular-encryption/,
https://techcrunch.com/2019/02/24/new-4g-5g-security-flaws/, etc.

-Ben