Subject: [dns-privacy] Call For Adoption: draft-wing-dprive-dnsodtls

From: Tim Wicinski <[email-masked]>
Date: Wed, 20 May 2015 10:03:27 -0400

During the previous Call for Adoption a number of participants expressed 
interest in adopting this work.  WG members felt it needed some 
improvements, but thought it had potential. The authors addressed the 
issues and feel it meets what the working group was seeking, and have 
requested that we initiate a call for adoption.

If the working group adopts this document, it only means it wishes to 
study this solution more carefully.  The working group may still 
determine to not move forward with it.

The draft is available here: 
https://datatracker.ietf.org/doc/draft-wing-dprive-dnsodtls/
Please review this draft to see if you think it is suitable for adoption 
by , and comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This call for adoption ends Tuesday June 2, 2015

Thanks

Warren/Tim
chairs

---

From: Bob Harold <[email-masked]>
Date: Wed, 20 May 2015 10:40:15 -0400

On Wed, May 20, 2015 at 10:03 AM, Tim Wicinski <[email-masked]> wrote:

> study this solution more carefully.  The working group may still determine
> to not move forward with it.
>
I support adoption, and I will review.

I am unclear on Page 5
6.  Demultiplexing, Polling, Port Usage, and Discovery

"After performing the above steps, the host should determine if the
   DNS server supports DNSoD by sending a DTLS ClientHello message."

It is unclear to me what the "above steps" actually refers to.  Can you
clarify?

-- 
Bob Harold

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 21 May 2015 12:23:54 +0200

Tim Wicinski <[email-masked]> writes:

> Please review this draft to see if you think it is suitable for
> adoption by , and comments to the list, clearly stating your view.
>

I support adoption, in order to coordinate DNS-over-DTLS with
DNS-over-TLS.  I would be willing to contribute text and do review.

/Simon

---

From: 🔓Dan Wing <[email-masked]>
Date: Fri, 22 May 2015 09:13:15 -0700

On 20-May-2015 07:40 am, Bob Harold <[email-masked]> wrote: 
> 
> 
> On Wed, May 20, 2015 at 10:03 AM, Tim Wicinski <[email-masked] <mailto:[email-masked]>> wrote:
> During the previous Call for Adoption a number of participants expressed interest in adopting this work.  WG members felt it needed some improvements, but thought it had potential. The authors addressed the issues and feel it meets what the working group was seeking, and have requested that we initiate a call for adoption.
> 
> If the working group adopts this document, it only means it wishes to study this solution more carefully.  The working group may still determine to not move forward with it.
> 
> The draft is available here: https://datatracker.ietf.org/doc/draft-wing-dprive-dnsodtls/ <https://datatracker.ietf.org/doc/draft-wing-dprive-dnsodtls/>
> Please review this draft to see if you think it is suitable for adoption by , and comments to the list, clearly stating your view.
> 
> It is unclear to me what the "above steps" actually refers to.  Can you clarify?

Section 6 suggests how a DNSoDTLS client can determine that its connected network will work with DNSoDTLS.  The exact method and algorithm will require more discussion in the WG, especially to balance the needs for security and interoperability against implementation flexibility.

-d

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 22 May 2015 14:42:12 -0400

> https://datatracker.ietf.org/doc/draft-wing-dprive-dnsodtls/

I support the WG adopting this document for consideration.

I'm willing to review.

Looking at -01 of the draft:

 Section 3.2:

   Verifying the server certificate based on fingerprint needs to be
   spelled out more clearly (what exactly is fingerprinted, how it is
   fingerprinted).  But i don't think we should be fingerprinting the
   certificate itself at all in this case.  I think we should be
   fingerprinting the subject's public key.  The folks working on HTTP
   Public Key Pinning (HPKP) already went through this discussion, and
   settled on pinning public keys instead of certificates for good
   reason: in the pinning case, we want to make sure that we're looking
   at the same public key, not about the identity material wrapped
   around it in the cert.  (this also allows them to work with
   oob-pubkeys, as you recommend in section 7)

 Section 3.3:

   This section seems to bundle assumptions about DHCP information and
   system configuration all together ("an implementation will
   attempt"). I think we should separate those considerations, and make
   it clearer that this section is not a normative set of guidelines,
   but rather a description of common behaviors and choices.

Section 7:

   "amoritized" should be "amortized".  I'm not convinced by the NOT
   RECOMMENDED in this section. Especially as the root zone expands, it
   doesn't look all that much different than any other busy
   authoritative nameserver.  This sort of SHOULD NOT ought to be backed
   up by hard data, or some sort of operational characteristics (X
   number of clients, each querying Y times per day, or something), or
   else it looks like it would apply to all authoritative nameservers.
   I understand that we want dprive to focus first on the stub->resolver
   link, but i don't think we should shoot down using DNSSoD on
   resolver->authoritative links without more consideration.

Regards,

        --dkg

---

From: "Guangqing Deng" <[email-masked]>
Date: Tue, 26 May 2015 09:54:07 +0800

Resolution latency is very crucial for DNS system and the latency of DNS-over-DTLS is relatively low compared with DNS-over-TLS. I support adoption, and BTW is there any public software library of DTLS for doing DNS-over-DTLS  evaluation?

Guangqing Deng
CNNIC 
 
From: Dan Wing
Date: 2015-05-23 00:13
To: Bob Harold
CC: Tim Wicinski; [email-masked]
Subject: Re: [dns-privacy] Call For Adoption: draft-wing-dprive-dnsodtls

The draft is available here: https://datatracker.ietf.org/doc/draft-wing-dprive-dnsodtls/
Please review this draft to see if you think it is suitable for adoption by , and comments to the list, clearly stating your view.

I am unclear on Page 5

-d

---

From: "Christian Huitema" <[email-masked]>
Date: Mon, 25 May 2015 19:31:50 -0700

> Resolution latency is very crucial for DNS system and the latency of DNS-over-DTLS is relatively low compared with DNS-over-TLS.

Do you have measurements showing that, or is it just an opinion?

-- Christian Huitema

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 25 May 2015 20:04:41 -0700

> Resolution latency is very crucial for DNS system and the latency of DNS-over-DTLS is relatively low compared with DNS-over-TLS.

Is the latency for an established TLS connection any worse than for a DTLS connection? It would be good to see numbers if this is the case.

--Paul Hoffman

---

From: "Guangqing Deng" <[email-masked]>
Date: Tue, 26 May 2015 11:42:16 +0800

I only mean the latency when establishing connections. 

Guangqing Deng
CNNIC 
 
From: Paul Hoffman
Date: 2015-05-26 11:04
To: Guangqing Deng
CC: dns-privacy

--Paul Hoffman
_______________________________________________
dns-privacy mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Tue, 26 May 2015 04:58:25 +0000

From: dns-privacy [mailto:[email-masked]] On Behalf Of Guangqing Deng
Sent: Tuesday, May 26, 2015 7:24 AM
To: dns-privacy
Cc: Tim Wicinski; Dan Wing (dwing)
Subject: Re: [dns-privacy] Call For Adoption: draft-wing-dprive-dnsodtls

You can use OpenSSL.

-Tiru

________________________________
Guangqing Deng
CNNIC

From: Dan Wing<mailto:[email-masked]>
Date: 2015-05-23 00:13
To: Bob Harold<mailto:[email-masked]>
CC: Tim Wicinski<mailto:[email-masked]>; [email-masked]<mailto:[email-masked]>
Subject: Re: [dns-privacy] Call For Adoption: draft-wing-dprive-dnsodtls

On 20-May-2015 07:40 am, Bob Harold <[email-masked]<mailto:[email-masked]>> wrote:

On Wed, May 20, 2015 at 10:03 AM, Tim Wicinski <[email-masked]<mailto:[email-masked]>> wrote:
During the previous Call for Adoption a number of participants expressed interest in adopting this work.  WG members felt it needed some improvements, but thought it had potential. The authors addressed the issues and feel it meets what the working group was seeking, and have requested that we initiate a call for adoption.

I am unclear on Page 5

-d

---

From: Shane Kerr <[email-masked]>
Date: Wed, 27 May 2015 13:58:08 +0000

Tim and all,

On Wed, 20 May 2015 10:03:27 -0400

> Please also indicate if you are willing to contribute text, review, etc.

This document is deep and wide, so I doubt that it can actually go
forward as a single document. It seems to contain a mix of ideas,
suggestions, and discussion, some related to DNSoD in particular and
some that will apply to any encrypted DNS transport (for example, the
increased packet size indeed needs to be addressed somehow, the proposal
to multiplex has merit, the issue of which port to use will exist
everywhere, ...).

I think that I support adoption as a discussion piece. My feeling is
that it will end up as 2 or 3 documents in the end - possibly with only
1 or 2 ending up as RFCs, of course. :)

I am willing to review!

Cheers,

--
Shane