Subject: [Dots] Magnus Westerlund's No Objection on draft-ietf-dots-server-discovery-14: (with COMMENT)

From: Magnus Westerlund via Datatracker <[email-masked]>
Date: Thu, 05 Nov 2020 05:56:35 -0800

Magnus Westerlund has entered the following ballot position for
draft-ietf-dots-server-discovery-14: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-dots-server-discovery/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Shouldn't the security consideration section 8.2 ave some additional warnings
about the ease of affecting the dns lookup when .local is used. This as mDNS
more easily can be gamed?

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Fri, 6 Nov 2020 07:44:02 +0000

> -----Original Message-----
> From: Magnus Westerlund via Datatracker <[email-masked]>
> Sent: Thursday, November 5, 2020 7:27 PM
> To: The IESG <[email-masked]>
> Cc: [email-masked]; [email-masked];
> [email-masked]; Valery Smyslov <[email-masked]>; [email-masked]
> Subject: Magnus Westerlund's No Objection on draft-ietf-dots-server-
> discovery-14: (with COMMENT)
> 
> CAUTION: External email. Do not click links or open attachments unless you
> recognize the sender and know the content is safe.
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 

Yes, but the discovery uses global names and not ".local". DNSSEC can be used to validate the response.

-Tiru

---

From: Magnus Westerlund <[email-masked]>
Date: Fri, 6 Nov 2020 10:41:55 +0000

> to validate the response.

Ok, that is better, sorry for missing that part. Still as mDNS results that that
nodes on the network segment or multicast domain used easily can inject answers.
So it enlarges the attack surface, but DNS without DNSSEC appears quite
sensitive to targeted attacks on the name resolution of the DOTS servers. 
I think comparing sections 8.3 and 8.2 is interesting. In 8.2 you are explicit
about the attackers interest in compromising the S-NAPTR resolution. But the
same attack potential in DNS-SD is not mentioned. 

Is redirects allowed here when doing the lookup and does that affect what domain
name one will use in SNI in DTLS when connecting to the DOTS agent? Just trying
to understand if the DTLS connection step is a second line of defence for the
DNSSD step? In other words that an attacker can inject or modify DNS response to
ensure that the DOTS client connects to the attacks server, but that it isn't
fooled that this is the intended one? 

Cheers

Magnus

---

From: "Konda, Tirumaleswar Reddy" <[email-masked]>
Date: Tue, 10 Nov 2020 07:30:10 +0000

> From: Magnus Westerlund <[email-masked]>
> Sent: Friday, November 6, 2020 4:12 PM
> To: [email-masked]; Konda, Tirumaleswar Reddy
> <[email-masked]>
> Cc: [email-masked]; [email-masked]; draft-ietf-dots-server-
> [email-masked]; [email-masked]
> Subject: Re: Magnus Westerlund's No Objection on draft-ietf-dots-server-
> email
> > Yes, but the discovery uses global names and not ".local". DNSSEC can be
> used
> > to validate the response.
> 

Yes.

> same attack potential in DNS-SD is not mentioned.

The attack discussed in 8.2 is also applicable to 8.3 and authenticating the discovered DOTS server using TLS server certificate protects against DNS spoofing attack (similar to HTTPS).

> DNSSD step? 

Re-directs are only possible after the (D)TLS session is established, please see https://tools.ietf.org/html/rfc8782#section-4.6 

> In other words that an attacker can inject or modify DNS
> response to

Yes, spoofing the DNS response is of no use as it will be detected by the DOTS client during server certificate validation.

Cheers,
Tiru