Subject: [dns-privacy] I-D Action: draft-ietf-dprive-dnsoquic-07.txt

From: [email-masked]
Date: Wed, 01 Dec 2021 08:02:09 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS PRIVate Exchange WG of the IETF.

        Title           : DNS over Dedicated QUIC Connections
        Authors         : Christian Huitema
                          Sara Dickinson
                          Allison Mankin
	Filename        : draft-ietf-dprive-dnsoquic-07.txt
	Pages           : 31
	Date            : 2021-12-01

Abstract:
   This document describes the use of QUIC to provide transport privacy
   for DNS.  The encryption provided by QUIC has similar properties to
   that provided by TLS, while QUIC transport eliminates the head-of-
   line blocking issues inherent with TCP and provides more efficient
   packet loss recovery than UDP.  DNS over QUIC (DoQ) has privacy
   properties similar to DNS over TLS (DoT) specified in RFC7858, and
   latency characteristics similar to classic DNS over UDP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsoquic/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-dprive-dnsoquic-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dnsoquic-07

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Sara Dickinson <[email-masked]>
Date: Wed, 1 Dec 2021 16:05:49 +0000

Hi All,

This update address a final few comments we got during WGLC after the bulk of WGLC comments had been addressed in the -06 version:

* Add a paragraph to discuss DNS over HTTP/3 vs DoQ
* Updated text on middlebox considerations
* Clarify use of MessageID 0

Note that it retains the text requesting allocation of port 853 (the Early Port Allocation request made last week is still under review).

Regards

Sara.

> On 1 Dec 2021, at 16:02, [email-masked] wrote:
> 
> 
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Brian Haberman <[email-masked]>
Date: Wed, 1 Dec 2021 11:35:33 -0500

Thanks, Sara.

I will continue with my shepherd review with the goal of advancing this 
to our AD by early next week.

Anyone who made comments who doesn't believe they were adequately 
addressed, please let me/Tim know.

Regards,
Brian

---

From: Brian Haberman <[email-masked]>
Date: Tue, 7 Dec 2021 11:52:41 -0500

Hi all,
      During my review, I saw that the id-nits check flagged to down 
references (RFCs 8094 and 8467). RFC 3967 generally requires that 
standards track documents not normatively reference documents at a lower 
maturity level.

      My reading of the draft leads me to believe that RFC 8094 
(DNS-over-DTLS) does not need to be a normative reference as the text is 
simply describing which spec is currently associated with UDP port 853. 
On the other hand, the reference to RFC 8467 (Padding Policy for 
EDNS(0)) needs to be a normative reference (even though it has a status 
of Experimental).

      RFC 3967 allows for waivers for down references, but they need to 
be called out during IETF Last Call. My intent is to indicate in the 
shepherd writeup that RFC 8094 can be moved to an Informative reference, 
but that a down-ref waiver is being requested for RFC 8467.

      Please let me know if you disagree with the above direction.

Regards,
Brian

On 12/1/21 11:35 AM, Brian Haberman wrote:
>> This update address a final few comments we got during WGLC after the 
>> bulk of WGLC comments had been addressed in the -06 version:
>>
>> Note that it retains the text requesting allocation of port 853 (the 
>> Early Port Allocation request made last week is still under review).
>>
>> Regards
>>
>> Sara.
>>
>>

---

From: Vladimír Čunát <[email-masked]>
Date: Tue, 7 Dec 2021 18:24:09 +0100

> Please let me know if you disagree with the above direction. 

I do not disagree, but in case of 8467 I can also imagine making the 
normative padding-policy requirements more vague, with a non-normative 
reference to 8467 as an "example" of (selecting) a good policy.

--Vladimir | knot-resolver.cz

---

From: Alexander Mayrhofer <[email-masked]>
Date: Thu, 9 Dec 2021 10:25:52 +0100

Sara, Allison, Christian,

I read through the latest revision of DoQ, and i'm afraid i do have a
comment regarding the padding section. More specifically, i think the
second "option" of section 6.4 should refer to the base specification
of EDNS0-Padding, rather than the Padding policies RFC. It currently
reads as:

   *  if padding at the QUIC level is not available or not used, DNS
      over QUIC MUST ensure that all DNS queries and responses are
      padded to a small set of fixed sizes, using the EDNS padding
      extension as specified in "Padding Policies for Extension
      Mechanisms for DNS (EDNS(0))" [RFC8467].

And i do believe that - as the sentence stands - the reference should
be RFC 7830. Note that RFC 8467 is Experimental (and was by intent, as
the privacy properties of Padding would probably shift with more
operational expertise). So, i feel REQUIRING that padding is used
makes more sense than REQUIRING the use of the experimental padding
sizes in RFC8467.

I think the sentence should read "padded to a small set of fixed
sizes, using the EDNS Padding Extension as specified in [RFC7830]."

I like the "aligned with..." text in the previous bullet point, which
could also be used here, indicating that the MUST is for the the
padding, and not necessarily for that revision of the padding policy.

It's not a showstopper, though. What do you think?

best,
Alex