Subject: Re: [dns-privacy] [Ext] Re: ADoT requirements for signalling?

From: Vladimír Čunát <[email-masked]>
Date: Fri, 1 Nov 2019 08:33:53 +0100

On 10/31/19 8:38 PM, John Levine wrote:
>> root-servers.net be DNSSEC signed, but without a secure delegation. ...
> Do any DNS resolvers use root-servers.net?  I thought they took an IP
> address from the local cache file and then an NS query to get the
> current root set.  This doesn't strike me as a problem we urgently
> need to solve.

Knot Resolver does refresh all the info by default, i.e. the builtin
root server names and addresses only get used for bootstrapping.  See
also https://tools.ietf.org/html/rfc8109#section-3.3

Even so, I can't immediately see potential for a real-life problem if
that zone gets signed (normally).  It's normal to use glue addresses
without validating them - even unavoidable in the common cases of
in-bailiwick nameservers (say, NS cz.)

>> (Also, I think the ADoT requirements should include an assumption that ADoT
>> is not supported unless the nameserver name explicitly signals such at or
>> under the nameserver's name.)
> I'm not yet prepared to rule out approaches where the parent sends the signal.
+1.  I suspect it might be hard to avoid revealing at least
(in-bailiwick) NS name/zone without that or some "hack" like what
DNSCurve does, so better avoid unnecessary restrictions too soon.

Note that SNI encryption for TLS is also planned to be bootstrapped from
the same DNS subtree, so designing it whole to bootstrap without leaking
any name might be tough.  Still, perhaps NS name will be sufficient in
clear - to simplify achieving other goals of the protocol, given that NS
addresses will basically reveal their names anyway.

--Vladimir

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 1 Nov 2019 11:14:59 +0000

> -----Original Message-----
> From: dns-privacy <[email-masked]> On Behalf Of John Levine
> Sent: Thursday, October 31, 2019 3:39 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [EXTERNAL] Re: [dns-privacy] [Ext] Re: ADoT requirements for
> signalling?
>
> In article
> <[email-masked]
> ail.com> you write:
> >I think there will be both interest and deployment, sufficient to
> >justify the effort.
>
> I hope so, but some actual comments from large DNS operators would be
> welcome.

It might be worth looking at this draft for one operator's perspective:

https://datatracker.ietf.org/doc/draft-hal-adot-operational-considerations/

Scott

---

From: "John R Levine" <[email-masked]>
Date: 1 Nov 2019 12:09:50 -0400

>> current root set.  This doesn't strike me as a problem we urgently

Oh, wait, now I understand the problem -- the NS records in the root only 
provide the names of the root servers.  There's glue with the 
root-servers.net A and AAAA records but they're unsigned.

I still think that a local root mirror is likely to be less of a kludge 
than whatever else we come up with to validate ADoT roots.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly