Subject: [DNSOP] Benoit Claise's No Objection on draft-ietf-dnsop-root-loopback-04: (with COMMENT)

From: "Benoit Claise" <[email-masked]>
Date: Mon, 28 Sep 2015 06:53:58 -0700

Benoit Claise has entered the following ballot position for
draft-ietf-dnsop-root-loopback-04: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-root-loopback/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

   Malicious third
   parties might be able to observe that traffic on the network between
   the recursive resolver and one or more of the DNS roots
   ....
   The primary goals of this design is to provide faster negative
   responses to stub resolver queries that contain junk queries, and to
   prevent queries and responses from being visible on the network. 

I've been wondering. So this mechanism is basically to speed up junk
queries.
What can a malicious third party do by observing junk queries. Nothing, I
guess.

I guess you want something like.
OLD:
   The primary goals of this design is to provide faster negative
   responses to stub resolver queries that contain junk queries, and to
   prevent queries and responses from being visible on the network.

NEW: 
   The primary goals of this design is to provide faster negative
   responses to stub resolver queries that contain junk queries, and to
   prevent valid queries and responses from being visible on the network.

---

From: "Paul Hoffman" <[email-masked]>
Date: Tue, 29 Sep 2015 15:46:43 -0700

Actually, seeing junk queries can leak some valuable information. For 
example, imagine that some malware sends junk queries for a known name; 
seeing that can be valuable information for someone watching the stream 
of requests. There are some companies whose business model include 
watching cache misses in recursive resolvers for interesting patterns.

>  prevent valid queries and responses from being visible on the 

Given the above, we would like to leave the text as-is because some 
recursive operators care about exposure of bad queries as well.

--Paul Hoffman and Warren Kumari

---

From: Benoit Claise <[email-masked]>
Date: Wed, 30 Sep 2015 09:58:05 +0200

Paul,
> example, imagine that some malware sends junk queries for a known 
> name; seeing that can be valuable information for someone watching the 
> stream of requests. There are some companies whose business model 
> include watching cache misses in recursive resolvers for interesting 
> patterns.
Thanks, I learned something.
A sentence or two on that topic would have helped me. Just saying ...

Regards, Benoit
> .