Subject: [dns-privacy] UDP/853 port allocation request for draft-ietf-dprive-dnsoquic

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Mon, 29 Nov 2021 14:03:16 +0000

Just a heads-up to the DPRIVE WG and for the DoQ authors[1]: after some discussions within IESG/IAB, I am afraid that UDP/853 won't be allocated to DoQ. Nothing definitive yet of course but IAB/IESG have raised the following concerns:

  *   Lack of real technical motivation (except for 'symmetry' or for operational reasons).
  *   Moving DoDTLS to historic will not help, as it will simply return udp/853 to the pool to be re-used later.
  *   The *currently* possible demux between QUIC & DTLS is not something carved in stone forever. Hence, a future problem can happen if DTLS v23 cannot be demuxed from QUIC v19. This would put a heavy constraint on the evolution of both QUIC & DTLS, i.e., ossifying both protocols. Not to mention that both QUIC & DTLS want to expose as little as possible to observers, making demux of future versions quite improbable...

Personally, I do not think that it is critical to re-use udp/853 but happy to work with the authors and the WG to attempt to re-use it.

Comments are welcome, as usual ;-)

Regards,

-éric

[1] I already have exchanged some email messages with authors and chairs last week, but it is time to extend the discussion to the WG

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 29 Nov 2021 08:19:50 -0800

On Mon, Nov 29, 2021 at 6:04 AM Eric Vyncke (evyncke) <evyncke=
[email-masked]> wrote:

> Just a heads-up to the DPRIVE WG and for the DoQ authors[1]: after some
> discussions within IESG/IAB, I am afraid that UDP/853 won't be allocated to
> DoQ. Nothing definitive yet of course but IAB/IESG have raised the
> following concerns:
>
>
>
>    - Lack of real technical motivation (except for 'symmetry' or for
>    operational reasons).
>    - Moving DoDTLS to historic will not help, as it will simply return
>    udp/853 to the pool to be re-used later.
>    - The *currently* possible demux between QUIC & DTLS is not something
>    carved in stone forever. Hence, a future problem can happen if DTLS v23
>    cannot be demuxed from QUIC v19. This would put a heavy constraint on
>    the evolution of both QUIC & DTLS, i.e., ossifying both protocols. Not to
>    mention that both QUIC & DTLS want to expose as little as possible to
>    observers, making demux of future versions quite improbable...
>
>
I don't particularly care whether 853 is assigned to DoQ or not, but these
reasons do not strike me as particularly strong.

In particular, there are at least sets of indicia that allow for demuxing
DTLS and QUIC:

- Bit 0x40, which is 1 in QUIC and 0 in DTLS.
- All QUIC packets are integrity protected (the early ones with a fixed key)

I doubt that this second thing is going to change materially (though of
course the key may change) so it seems likely that it will be possible to
distinguish QUIC from DTLS indefiitely.

-Ekr

---

From: Vladimír Čunát <[email-masked]>
Date: Mon, 29 Nov 2021 19:36:29 +0100

On 29/11/2021 17.19, Eric Rescorla wrote:
> I don't particularly care whether 853 is assigned to DoQ or not, but 
> these reasons do not strike me as particularly strong.

+1

DNS over DTLS is not known to be used (or even "implemented", I think), 
and that state seems unlikely to change, especially after moving that 
combination to historic status... so I can't see how demuxing of future 
versions on UDP/853 applies (except some experiments perhaps).

To be clear, I certainly have no motivation to keep arguing with IESG 
about this, though I'd find it nicer to have the 853 pair.

--Vladimir | knot-resolver.cz

---

From: "Martin Thomson" <[email-masked]>
Date: Tue, 30 Nov 2021 07:51:44 +1100

On Tue, Nov 30, 2021, at 03:19, Eric Rescorla wrote:
> it seems likely that it will be possible to distinguish QUIC from DTLS indefiitely.

Unless QUIC and DTLS change a whole lot, that's true.  And while we can't say anything definitive about the future, this remains a documented (RFC 7983) and useful property to maintain.  So I have every reason to believe that it will stay that way.

So 853 seems perfectly fine.  

(It's almost as though the authors carefully considered these points already.  I know that I did.)