Subject: Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 1 Apr 2021 15:04:38 +0200

On Wed, Mar 31, 2021 at 02:32:46PM +0100,
 Jim Reid <[email-masked]> wrote 
 a message of 13 lines which said:

> > RFC 7626 (the threat model and problem analysis that some people
> > claim is missing) is clear (section 2.5.2 for instance).
> 
> RFC7626 is 6 years old.

RFC 793 is 39 years old. Let's drop TCP and move to QUIC (the RFCs are
in the RCF-EDITOR state).

And I'm too charitable to mention the age of DNS RFCs.

> It predates the DoH and DoT (and soon DoQ) specs.

So what? 

> Some other risks have changed since 2015 too.

Please be specific and mention them.

> It’s not your fault that fine RFC has been OBE. :-)

I don't remember receving it from Elisabeth II
<https://en.wikipedia.org/wiki/Order_of_the_British_Empire>

---

From: Jim Reid <[email-masked]>
Date: Thu, 1 Apr 2021 21:08:44 +0100

> On 1 Apr 2021, at 14:04, Stephane Bortzmeyer <[email-masked]> wrote:
> 
> And I'm too charitable to mention the age of DNS RFCs

You should be above whatabootery* Stephane.

> Please be specific and mention them.

I already did. But here goes again. DoT hadn’t been standardised by then. DoH hadn’t even been invented. Nobody had talked in detail about DoT or other encrypted transports to authoritative servers. [IIRC the initial focus of DoT was stub to resolver traffic.]  8.8.8.8 and the other all-fours resolver services didn’t exist. There wasn’t the prospect of the world’s web browsers doing DoH lookups (and to third-party resolvers in some cases) instead of Do53. There’s now significant disruption to how DNS lookups get performed -- ie more centralisation and consolidation -- which introduce new risks, threats and privacy considerations.

It looks to me the DNS landscape has changed a lot since RFC7626 was published. So the threats and risks have changed too. YMMV.

Besides if RFC7626 hadn’t been OBE, there wouldn’t be an RFC7626-bis. RFC7626 doesn’t mention encrypted transports at all. RFC7626-bis does.

* A Scottish word for raising non-sequiturs: what about...

---

From: Wes Hardaker <[email-masked]>
Date: Mon, 05 Apr 2021 10:21:07 -0700

Brian Haberman <[email-masked]> writes:

> That would be a first step. Does anyone have an idea of how widely used
> 8806 is today?

As a (single-ish) data point: localroot.isi.edu has > 100 registered
people, with ~90 registered servers and slowly growing (with upward
spikes after presentations at various venues by various people).  I need
to collect better stats for "recently active" too (I have them, but I
don't trust them at the moment).

-- 
Wes Hardaker                                     
My Pictures:       http://capturedonearth.com/

---

From: Brian Haberman <[email-masked]>
Date: Mon, 5 Apr 2021 13:47:01 -0400

Thanks, Wes!