Subject: [DNSOP] Stephen Farrell's Yes on draft-ietf-dnsop-edns-chain-query-06: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Mon, 15 Feb 2016 11:34:11 -0800

Stephen Farrell has entered the following ballot position for
draft-ietf-dnsop-edns-chain-query-06: Yes

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-edns-chain-query/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

- In section 3 you promised me privacy considerations in section
8 but I didn't find any there. That was almost a DISCUSS, but
since fixing it is easy and I assume won't be controversial I
can stick with a YES ballot:-)

- I would suggest that you do note in section 8, that the fqdn
in the CHAIN option could allow an attacker to (re-)identify a
client. E.g. if the attacker sees that you have validated
tetbed.ie before that could single you out, even if you have
changed your n/w, cilent IP address etc. Presumably that would
be a relatively long lasting concern as well, as RRSIG expiry
tends to be weeks ahead. I think just noting that and maybe
saying that DPRIVE is a likely mitigation would be a good thing
to do.

---

From: Paul Wouters <[email-masked]>
Date: Thu, 18 Feb 2016 09:43:18 -0500 (EST)

I have added the following two sections to the security considerations.
Let me know if that addresses your concerns:

8.1.  Additional work and bandwidth

    Producing CHAIN answers incurs additional load and bandwidth on the
    Recursive Resolver.  At any time, a Recursive Resolver may decide to
    no longer answer with CHAIN answers and fall back to traditional DNS
    answers.

[8.2 was the original section regarding Amplification]

8.3.  Privacy Considerations

    A client producing CHAIN queries reveals a little more information
    about its cache contents than regular DNS clients.  This could be
    used the fingerprint a client across network reconnections.  If DNS
    privacy is a concern, a CHAIN query client MAY try to use a DNS
    transport that provides privacy, such as [DNS-over-TLS] or a trusted
    DNS server that is contacted through a VPN connection such as IPsec.

I believe that resolves the "promises" in Section 3.

Paul

---

From: joel jaeggli <[email-masked]>
Date: Thu, 18 Feb 2016 07:39:57 -0800

That works for me.

note, the IESG review is now completed. so we hold token on when to ship it.

thanks
joel

On 2/18/16 6:43 AM, Paul Wouters wrote:
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 18 Feb 2016 21:58:17 +0000

> I believe that resolves the "promises" in Section 3.

Thanks, those additions are good,
Cheers,
S.