Subject: Re: [dns-privacy] I-D Action: draft-ietf-dprive-dns-over-tls-00.txt

From: "Wessels, Duane" <[email-masked]>
Date: Thu, 1 Oct 2015 16:35:46 +0000

Simon,

> On Sep 21, 2015, at 2:58 AM, Simon Josefsson <[email-masked]> wrote:
> 
> "Wessels, Duane" <[email-masked]> writes:
> 
>> The former draft described two approaches to establishing a
>> DNS-over-TLS session: upgrade-based (aka STARTTLS for DNS) and
>> port-based.  In this new version we have removed the upgrade-based
>> approach and describe only the use of a well-known port.
> 
> Yay, thank you!
> 
> I believe the abstract or introduction section should mention that TLS
> gives you data integrity services, which protects against on-path
> tampering.  Right now the document talks about encryption to protect
> against eavesdropping.  However, the RFC 7258 pervasive monitoring
> attack includes active attacks and thus I believe talking about
> integrity is useful to set the context right.

I've added a short sentence to the abstract:

@@ -169,7 +169,9 @@
         This document describes the use of TLS to provide privacy
         for DNS.  Encryption provided by TLS eliminates opportunities
         for eavesdropping on DNS queries in the network, such as
-        discussed in RFC 7258.  In addition, this document specifies
+        discussed in RFC 7258.
+        TLS also protects against on-path tampering.
+        In addition, this document specifies
         two usage profiles for DNS-over-TLS and provides advice on
         performance considerations to minimize overhead from using
         TCP and TLS with DNS.

> One comment/thought around the /etc/service name 'domain-s'.  I find it
> undescriptive and difficult to type.  How about 'dnsovertls' or
> something more descriptive?

This has already been discussed and the IANA Ports Review team has provided
guidance that the -s suffix is preferred:

https://mailarchive.ietf.org/arch/msg/dns-privacy/dO99_jjoBUrHS2hCNDKTNRlBLFo

DW

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 1 Oct 2015 19:51:52 +0200

On Wed, Sep 30, 2015 at 10:36:14PM +0000,
 Wessels, Duane <[email-masked]> wrote 
 a message of 163 lines which said:

> Does this change address your concerns?

Yes, thanks.

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 2 Oct 2015 10:09:43 +0200

> > I believe the abstract or introduction section should mention that
> > TLS gives you data integrity services, which protects against
> > on-path tampering.  Right now the document talks about encryption
> > to protect against eavesdropping.  However, the RFC 7258 pervasive
> > monitoring attack includes active attacks and thus I believe
> > talking about integrity is useful to set the context right.
> 

Hi Duane.  Thank you.  7258 also talks about active attacks.  So
maybe it reads better to say: 

  Encryption provided by TLS eliminates opportunities for eavesdropping
  and on-path tampering with DNS queries in the network, such as
  discussed in RFC 7258.

> > One comment/thought around the /etc/service name 'domain-s'.  I
> > find it undescriptive and difficult to type.  How about
> > 'dnsovertls' or something more descriptive?
> 
> This has already been discussed and the IANA Ports Review team has
> provided guidance that the -s suffix is preferred:
> 

Thanks for the pointer.  I guess my comment here is too late.

/Simon

---

From: "Wessels, Duane" <[email-masked]>
Date: Fri, 9 Oct 2015 21:53:29 +0000

> On Oct 2, 2015, at 1:09 AM, Simon Josefsson <[email-masked]> wrote:
> 

Thanks, this change has been made.

DW