Subject: Re: [dns-privacy] On behalf of Apr 1st, here is a DNSE solution.

From: "Guangqing Deng" <[email-masked]>
Date: Thu, 8 May 2014 09:45:16 +0800

Hi, Wes, I have a minor question about this draft. It is said in section 2.1 of this draft that the encrypted "real" request (namely the blob "EEEEEEEE" in this draft) is taken as the left-most label of the new synthetic domain name (namely "EEEEEEEEE.K1.example.org"). Since the length of a domain name label is within 64, now I am wondering is it always possible to insert an encrypted DNS request into one synthetic domain name as the left-most label? 

Guangqing Deng
CNNIC 
 
From: Wes Hardaker
Date: 2014-04-02 05:43
To: dns-privacy
Subject: [dns-privacy] On behalf of Apr 1st, here is a DNSE solution.
 
The problem with other solutions is that you (a DNS user) must trust
someone not to have been hacked or to sell you out.
 
This solution is a super-hack, but shows the type of architecture needed
to ensure that no entity but you knows both:
 
  - who made the request
  - what the request (and response) contains
 
Anyone that knows both is a potential point of compromise.
 
  http://datatracker.ietf.org/doc/draft-hardaker-dnse-split-key-dns/ 
 
Warning: the security in here is not.
-- 
Wes Hardaker
Parsons
 
_______________________________________________
dns-privacy mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 08 May 2014 20:06:34 -0700

"Guangqing Deng" <[email-masked]> writes:

> Hi, Wes, I have a minor question about this draft. It is said in
> section 2.1 of this draft that the encrypted "real" request (namely
> the blob "EEEEEEEE" in this draft) is taken as the left-most label of
> the new synthetic domain name (namely
> "EEEEEEEEE.K1.example.org"). Since the length of a domain name label
> is within 64, now I am wondering is it always possible to insert an
> encrypted DNS request into one synthetic domain name as the left-most
> label?

No, certainly there are issues in general.  There are maximum lengths
not just for a label, but for the number of labels.  So not only is
there size constraints for the size of an individual label (and there
are ways around that), but there are constraints on the number of labels
we can use (and there is no way around some of those issues;  You always
have to append a suffix which means you're always reducing the maximum
label count by the suffix length.  Which in the above is 2).
-- 
Wes Hardaker
Parsons

---

From: "Guangqing Deng" <[email-masked]>
Date: Fri, 9 May 2014 15:42:58 +0800

Have you ever built a prototype of this draft and done some test? If so, what is the extra time delay caused by it compared with normal DNS resolving? Maybe that is another problem.

Guangqing Deng
CNNIC 
 
From: Wes Hardaker
Date: 2014-05-09 11:06
To: Guangqing Deng
CC: Wes Hardaker; dns-privacy
Subject: Re: [dns-privacy] On behalf of Apr 1st, here is a DNSE solution.

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 10 May 2014 00:39:24 +0200

This is what I added in new version of CGA-TSIGe when I considered the
encryption and talked about encryption. It wasn't clear in the draft and
some people asked me about that.

Best,

Hosnieh

From: dns-privacy [mailto:[email-masked]] On Behalf Of
Guangqing Deng
Sent: Friday, May 09, 2014 9:43 AM
To: Wes Hardaker
Cc: dns-privacy
Subject: Re: [dns-privacy] On behalf of Apr 1st, here is a DNSE solution.

 Have you ever built a prototype of this draft and done some test? If so,
what is the extra time delay caused by it compared with normal DNS
resolving? Maybe that is another problem.

  _____  

Guangqing Deng

CNNIC 

From: Wes Hardaker <mailto:[email-masked]> 

Date: 2014-05-09 11:06

To: Guangqing Deng <mailto:[email-masked]> 

CC: Wes Hardaker <mailto:[email-masked]> ; dns-privacy
<mailto:[email-masked]> 

-- 

Wes Hardaker

Parsons

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 10 May 2014 00:42:48 +0200

Follow up, I considered the encryption of the whole questions and not just a
part of that.. maybe this is the only difference. But it is good to know
whether there is limitation in this regard. how long a string can be..?

Thanks,

Hosnieh

  _____  

Guangqing Deng

CNNIC 

Date: 2014-05-09 11:06

-- 

Wes Hardaker

Parsons

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 12 May 2014 07:23:32 -0700

"Guangqing Deng" <[email-masked]> writes:

> Have you ever built a prototype of this draft and done some test? If
> so, what is the extra time delay caused by it compared with normal DNS

Certainly any time you have multiple packets in flight in multiple
directions and require them all to be completely processed, it means
that you're final round trip time is subject to the worst-latency.  So
you're definitely trading speed for privacy in this case.
-- 
Wes Hardaker
Parsons

---

From: "Guangqing Deng" <[email-masked]>
Date: Wed, 21 May 2014 09:19:50 +0800

Now the question is that should we consider the speed and privacy separately or take them into consideration together?

Guangqing Deng
CNNIC 
 
From: Wes Hardaker
Date: 2014-05-12 22:23
To: Guangqing Deng

---

From: Wes Hardaker <[email-masked]>
Date: Wed, 21 May 2014 09:07:30 -0700

"Guangqing Deng" <[email-masked]> writes:

> Now the question is that should we consider the speed and privacy
> separately or take them into consideration together?

I suspect any solution will have compromises in it for one vs the other,
and thus you need to consider them together and weigh the best result
based on where you want to compromise and where you don't.  If we
optimize only for a single one first, we're likely to rule out the other
one from being solvable.
-- 
Wes Hardaker
Parsons