Subject: Re: dns & confidentiality?

From: Paul Vixie <[email-masked]>
Date: Fri, 04 Jun 2004 18:08:45 +0000

> should the DNS and the data it holds be considered confidential?

i don't know.  doing so could demand a DH exchange on every query, depending
on the threat model.  and would demand at least some kind of work-preload for
every initiator, like an expensive hash of <time,qname,qtype,qclass> to
discourage zone walking.  it's a much harder problem than NSEC2 addresses.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Eric A. Hall" <[email-masked]>
Date: Fri, 04 Jun 2004 13:18:58 -0500

> should the DNS and the data it holds be considered confidential?

Information in DNS is only as secure as all of the points where it is
cached. Seems to me that it's impossible to consider any such system as
anything other than incidentally confidential.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: [email-masked]
Date: Fri, 4 Jun 2004 18:21:54 +0000

> discourage zone walking.  it's a much harder problem than NSEC2 addresses.

	yes it is.  and i suspect that -IF- the current user
	base expects confidentiality, that the DNS as we know
	it is -DOA- and we should start on the new thing -now-.
	Much harder than NSEC2, which is a pretty much a translucent
	veil over the naked DNS.  Still, its worth asking the question.

--bill

---

From: Rob Austein <[email-masked]>
Date: Fri, 04 Jun 2004 14:51:37 -0400

At Fri, 4 Jun 2004 17:49:22 +0000, Bill Manning wrote:
> 
> Now that the DNSSECbis docs are locked, loaded, and the tubes flooded,

Only almost, and it might be nice to let the WG list quiet down a bit
so that folks could concentrate on the boring job of proofreading the
flipping -bis docs rather than jumping right into yet another high
volume debate, but I know that Bill is easily bored. :)

> perhaps its time to review one of the basic presumptions that drove the
> -bis set and seemed to cause any amount of angst in some operators.
> 

I suspect that the trust model would prove sufficiently complex that
it would render the result, if usable at all, sufficiently different
from DNS as we know it that it would be easier just to start over.

I'm tempted to say, along with Rocket J. Squirrel, that "that trick
never works", but I could of course be wrong.

---

From: [email-masked] (Geoffrey Sisson)
Date: Fri, 4 Jun 2004 20:21:22 +0100 (BST)

> should the DNS and the data it holds be considered confidential?

Based on our legal advice:

    http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg00687.html

. . . we're obligated to make a best-effort attempt to keep the data
in the DNS confidential.  Which for us, practically, at the moment,
means: "it's worse to expose data in the DNS via DNSSEC than to not
deploy DNSSEC".

:-(

Regards

Geoff

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 7 Jun 2004 09:51:28 +0200

On Fri, Jun 04, 2004 at 05:49:22PM +0000,
 [email-masked] <[email-masked]> wrote 

> should the DNS and the data it holds be considered confidential?

To me, no, *but* access to one record (a typical DNS query) is *not*
the same thing as bulk access to all the records (AXFR or zone
walking).

Many people seem to have trouble understanding the difference or are
concerned only with performance problems (see Paul Vixie's example of
AXFR in ".com" for a good example of why performance is not so big a
problem).

But the difference is not technical: with individual access, the
amount of damage you can do is inferior. That's all. That why several
laws (for instance, in France, the law "Informatique et Libertés" -
Data processing and Freedom) have different provisions for individual
access and bulk access.

To summary, individual access does not need confidentiality (at least
not in the current DNS framework, adding it would mean a huge change
in the DNS model) but bulk access should be restrictable (ACL in BIND,
for instance). If it is not restrictable, it means forcing a political
decision via a technical standard.