Subject: Re: [dns-privacy] Resolver to authoritative discussion guidance

From: Puneet Sood <[email-masked]>
Date: Fri, 7 Sep 2018 13:39:03 -0400

All,

I am interested in this topic from the recursive resolver perspective.
The original outline covers the things I am interested in.

-Puneet

On Fri, Aug 31, 2018 at 10:22 AM Brian Haberman
<[email-masked]> wrote:
>
> All,
>      The conversations around this topic have gone silent. Are there
> other perspectives that we need to understand?
>
>      Tim and I are discussing an interim in September to get some
> focused discussion on requirements, issues, and gating factors. Please
> continue to raise items that you think warrant consideration for the
> recursive to authoritative privacy work item. Without content, it won't
> make much sense to hold an interim.
>
> Regards,
> Brian
>
> On 7/19/18 2:10 PM, Brian Haberman wrote:
> > All,
> >      The chairs would like to get the WG discussion started on exploring
> > privacy solutions for recursive resolver to/from authoritative server
> > exchanges. To start, we want to focus on *use cases and requirements*.
> > In our view, the WG needs to consider the:
> >
> >     - User perspective
> >     - Implementer perspective
> >     - 2nd-level server operator perspective
> >     - Recursive resolver operator perspective
> >
> >      For the time being, we would like to bypass the TLD server operator
> > perspective. While we are in this phase of discussion, the chairs would
> > like everyone to follow these guidelines:
> >
> >     - Focus on *what* is needed.
> >     - Avoid *how* to achieve it.
> >     - Consider both ends of DNS the exchange.
> >     - Scenarios will frame the discussion.
> >
> >      The chairs will start a mailing list thread for each of the four
> > discussion points. As ideas are presented, we will start aggregating the
> > details in a GitHub repo.
> >
> > Regards,
> > Brian & Tim
> >
> >
> >
> > _______________________________________________
> > dns-privacy mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/dns-privacy
> >
>
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Christian Huitema <[email-masked]>
Date: Fri, 7 Sep 2018 21:50:30 -0700

>>     - Scenarios will frame the discussion.

I am interested in the "no resolver" aspect. The privacy argument for
using encrypted to a recursive resolver is that the stub's queries get
mixed into an "anonymity set" of all the stubs using the same recursive
resolver. That's a fine argument, but it requires users to put a lot of
trust in the recursive resolvers. Clients would not be forced to trust
the recursive resolvers if they could do the entire recursion themselves.

Of course, running a recursive resolver from the client itself is not
currently a good privacy option. The client would end up sending lots of
clear text traffic to authoritative sites, traffic that could easily be
monitored. But if that traffic was encrypted, the "recursive client"
option would become significantly more attractive. Yes, the IP addresses
of the authoritative servers will be visible. But these servers have an
"anonymity set" of their own, as they often serve a large number of
domains. The adversaries will know that the user contacted a server, but
they will not know which domain on that server.

The recursive client option has the advantage of diluting the client's
requests over a multiplicity of servers. This makes the privacy of the
system significantly more robust. Recursive servers are interesting
targets, and adversaries can compel their cooperation through subpoena
or scarlet letters, or they can target them for hacking. With a
recursive client approach, the adversaries will have to gain cooperation
of a large number of servers, which may well be located in a variety of
jurisdictions. This could be much harder.

And because of that, I am quite interested in practical ways to encrypt
the traffic from clients to authoritative servers.

-- Christian Huitema

---

From: Hugo Maxwell Connery <[email-masked]>
Date: Mon, 10 Sep 2018 08:29:19 +0000

Hi,

Christian makes a very good point about distributing the DNS query cache out of the recursive resolver into the clients, which is a privacy boon.  However, that comes at the cost of increased load on the authoritative servers as that collective recursive resolver cache is not standing between the clients and the auth servers.

I think that this is trade off that individuals and organisations could decide.  I imagine that organisations (work places etc.) would likely choose to use a recursive resolver, but private individuals may choose the recursive client option.  Whatever the case, I think it is valuable to facilitate that option being easily available.

Regards,
  Hugo Connery

________________________________________
From: dns-privacy [[email-masked]] on behalf of Christian Huitema [[email-masked]]
Sent: Saturday, 8 September 2018 06:50
To: Brian Haberman; [email-masked]
Subject: Re: [dns-privacy] Resolver to authoritative discussion guidance

[snip intro].

-- Christian Huitema