Subject: Re: [dns-privacy] I-D Action: draft-ietf-dprive-dtls-and-tls-profiles-10.txt

From: tjw ietf <[email-masked]>
Date: Mon, 3 Jul 2017 17:15:35 -0400

All

The diffs between -09 and -10 are fairly large as they address the issues
raised during IESG review.  Before we go and poke the ADs to clear their
DISCUSS positions, we want to make sure the WG has reviewed Sarah's updates.

I know everyone is busily updating their latest set of drafts before the
cutoff so I don't expect anything for a few days. But if folks could read
the diffs at least:

On Fri, Jun 16, 2017 at 4:52 AM, Sara Dickinson <[email-masked]> wrote:

> Hi All,
>
> Here is an update to the draft which attempts to address the majority of
> the comments received during IESG review so far. Given the number and
> extent of the changes I would request further careful review of this
> version, particularly from the working group.
>
> Changes are:
>
> * Clarified the specific attacks the Usage Profiles mitigate against.
> * Revised wording in the draft relating to 'security/privacy guarantees’
> and generally improved consistency of wording throughout the document.
> * Corrected and added a number of references:
>    - RFC7924 is now Normative
>    - RFC7918 and RFC8094 are now Normative (and therefore Downrefs)
>    - draft-ietf-tls-tls13, draft-ietf-dprive-padding-policy,RFC3315 and
> RFC7227 added
> * Terminology: Update definition of Privacy-enabling DNS server and moved
> normative definition to section 4.
> * Section 5 and 6.3: Included discussion of the additional attacks
> possible when using meta-queries to bootstrap the DNS service
> * Section 5: Added sentence on why Opportunistic Profile may fallback for
> latency reasons.
> * Section 5.1: Added discussion of when clients might change Usage
> Profiles.
> * Section 6.4: Added caveat on use of combined authentication re RFC7469.
> * Section 6.5: Added more detail on how authentication results might be
> used in Opportunistic.  Opportunistic clients now SHOULD try for the best
> case.
> * Section 7.3: Re-worked this section and the discussion of DHCP.
> * Section 9: Removed unnecessary text, added condition on use of RFC7250
> (Raw public keys).
> * Section 11.: More detail on padding policies.
> * Numerous editorial corrections.
>
> Regards
>
> Sara.
>
> > On 16 Jun 2017, at 09:49, [email-masked] wrote:
> >
> >
> > A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> > This draft is a work item of the DNS PRIVate Exchange of the IETF.
> >
> >        Title           : Usage and (D)TLS Profiles for DNS-over-(D)TLS
> >        Authors         : Sara Dickinson
> >                          Daniel Kahn Gillmor
> >                          Tirumaleswar Reddy
> >       Filename        : draft-ietf-dprive-dtls-and-tls-profiles-10.txt
> >       Pages           : 29
> >       Date            : 2017-06-16
> >
> > Abstract:
> >   This document discusses Usage Profiles, based on one or more
> >   authentication mechanisms, which can be used for DNS over Transport
> >   Layer Security (TLS) or Datagram TLS (DTLS).  These profiles can
> >   increase the privacy of DNS transactions compared to using only clear
> >   text DNS.  This document also specifies new authentication mechanisms
> >   - it describes several ways a DNS client can use an authentication
> >   domain name to authenticate a (D)TLS connection to a DNS server.
> >   Additionally, it defines (D)TLS protocol profiles for DNS clients and
> >   servers implementing DNS-over-(D)TLS.  This document updates RFC
> >   7858.
> >
> >
> > The IETF datatracker status page for this draft is:
> > https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-
> and-tls-profiles/
> >
> > There are also htmlized versions available at:
> > https://tools.ietf.org/html/draft-ietf-dprive-dtls-and-tls-profiles-10
> > https://datatracker.ietf.org/doc/html/draft-ietf-dprive-
> dtls-and-tls-profiles-10
> >
> > A diff from the previous version is available at:
> > https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-
> and-tls-profiles-10
> >
> >
> > Please note that it may take a couple of minutes from the time of
> submission
> > until the htmlized version and diff are available at tools.ietf.org.
> >
> > Internet-Drafts are also available by anonymous FTP at:
> > ftp://ftp.ietf.org/internet-drafts/
> >
> > _______________________________________________
> > dns-privacy mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/dns-privacy
>
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>

---

From: tjw ietf <[email-masked]>
Date: Mon, 3 Jul 2017 17:16:28 -0400

Arrgh, truncated

But if folks could read the diffs at least:

https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-and-tls-profiles-10

we can get the ADs to approve and clear their DISCUSS positions to move
this forward.

thanks
tim

On Mon, Jul 3, 2017 at 5:15 PM, tjw ietf <[email-masked]> wrote:

>> > https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-
>> tls-profiles/
>> >
>> > https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dtls
>> -and-tls-profiles-10
>> >
>> > https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-and
>> -tls-profiles-10
>> >
>> >

---

From: Terry Manderson <[email-masked]>
Date: Tue, 4 Jul 2017 02:26:16 +0000

I would like to echo Tim's request. WG - Please review, there are enough text changes here that the WG should be comfortable with them before asking for DISCUSS items to be cleared and then sending this item forward.

Cheers
Terry

On 4/07/2017, 7:16 AM, "dns-privacy on behalf of tjw ietf" <[email-masked] on behalf of [email-masked]> wrote:

    Arrgh, truncated

    
    we can get the ADs to approve and clear their DISCUSS positions to move this forward.

    thanks
    tim

    
    On Mon, Jul 3, 2017 at 5:15 PM, tjw ietf 
    <[email-masked]> wrote:
    
    All

    The diffs between -09 and -10 are fairly large as they address the issues raised during IESG review.  Before we go and poke the ADs to clear their DISCUSS positions, we want to make sure the WG has reviewed Sarah's updates.

    I know everyone is busily updating their latest set of drafts before the cutoff so I don't expect anything for a few days. But if folks could read the diffs at least:

    
    On Fri, Jun 16, 2017 at 4:52 AM, Sara Dickinson 
    <[email-masked]> wrote:
    
    Hi All,
    
    Here is an update to the draft which attempts to address the majority of the comments received during IESG review so far. Given the number and extent of the changes I would request further careful review of this version, particularly from the working group.
    
    Changes are:
    
    * Clarified the specific attacks the Usage Profiles mitigate against.
    * Revised wording in the draft relating to 'security/privacy guarantees’ and generally improved consistency of wording throughout the document.
    * Corrected and added a number of references:
       - RFC7924 is now Normative
       - RFC7918 and RFC8094 are now Normative (and therefore Downrefs)
       - draft-ietf-tls-tls13, draft-ietf-dprive-padding-policy,RFC3315 and  RFC7227 added
    * Terminology: Update definition of Privacy-enabling DNS server and moved normative definition to section 4.
    * Section 5 and 6.3: Included discussion of the additional attacks possible when using meta-queries to bootstrap the DNS service
    * Section 5: Added sentence on why Opportunistic Profile may fallback for latency reasons.
    * Section 5.1: Added discussion of when clients might change Usage Profiles.
    * Section 6.4: Added caveat on use of combined authentication re RFC7469.
    * Section 6.5: Added more detail on how authentication results might be used in Opportunistic.  Opportunistic clients now SHOULD try for the best case.
    * Section 7.3: Re-worked this section and the discussion of DHCP.
    * Section 9: Removed unnecessary text, added condition on use of RFC7250 (Raw public keys).
    * Section 11.: More detail on padding policies.
    * Numerous editorial corrections.
    
    Regards
    
    Sara.
    
    > On 16 Jun 2017, at 09:49, 
    [email-masked] <mailto:[email-masked]> wrote:
    >
    >
    > A New Internet-Draft is available from the on-line Internet-Drafts directories.
    https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/ <https://datatracker.ietf.org/doc/draft-ietf-dprive-dtls-and-tls-profiles/>
    > There are also htmlized versions available at:
    https://tools.ietf.org/html/draft-ietf-dprive-dtls-and-tls-profiles-10 <https://tools.ietf.org/html/draft-ietf-dprive-dtls-and-tls-profiles-10>
    https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dtls-and-tls-profiles-10 <https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dtls-and-tls-profiles-10>
    > A diff from the previous version is available at:
    https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-and-tls-profiles-10 <https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dtls-and-tls-profiles-10>
    >
    >
    > Please note that it may take a couple of minutes from the time of submission
    > until the htmlized version and diff are available at 
    tools.ietf.org <http://tools.ietf.org>.
    > Internet-Drafts are also available by anonymous FTP at:
    ftp://ftp.ietf.org/internet-drafts/ <ftp://ftp.ietf.org/internet-drafts/>
    https://www.ietf.org/mailman/listinfo/dns-privacy <https://www.ietf.org/mailman/listinfo/dns-privacy>

---

From: "Paul Hoffman" <[email-masked]>
Date: Thu, 06 Jul 2017 10:39:43 -0700

The changes in -10 all seem fine, and I didn't find any that changed the 
meaning of what the WG approved earlier.

--Paul Hoffman

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 19 Jul 2017 09:52:39 +0200

On Mon, Jul 03, 2017 at 05:15:35PM -0400,
 tjw ietf <[email-masked]> wrote 
 a message of 12 lines which said:

> The diffs between -09 and -10 are fairly large

Large in bytes, but most of them don't change the meaning of the text
(it is my opinion that most remarks during the IESG phase were
nitpicking, and that the new -10 version is not an improvment, but it
is not a degradation either.) The whole DHCP discussion is a good
example.

This being said, I've read -10, _and_ the diff, and I believe that, as
I said before, the document is OK and can move forward.

> Before we go and poke the ADs to clear their DISCUSS positions, we
> want to make sure the WG has reviewed Sarah's updates

I'm surprised by the new sentence in section 5 "it provides the
maximum protection an attacker will allow". Surely, the attacker, if
s·he has the choice, will not allow anything?

---

From: Sara Dickinson <[email-masked]>
Date: Mon, 31 Jul 2017 15:51:29 +0100

> On 19 Jul 2017, at 08:52, Stephane Bortzmeyer <[email-masked]> wrote:
> 

Hi Stephane, 

Many thanks for the review.

> s·he has the choice, will not allow anything?

Yes, but the attacker may not have the ability to disallow all protection, depending on the type attacker and the exact authentication used. This was actually Ekr’s phrase from his review. 

Sara.