Subject: RE: dns & confidentiality?

From: "Scott Rose" <[email-masked]>
Date: Fri, 4 Jun 2004 14:52:43 -0400

I wonder how many of those that _do_ expect confidentiality actually need
it.  Or if anyone really MUST have confidentiality for IP address lookup.  I
guess there could be some scenarios where it is desired, but that also
depends on what a user wants to keep confidential.

I agree that DNS itself doesn't have the necessary features to have that
now, and neither does DNSSEC/bis/ter.  Something else would be needed:
either hop-hop or end-end?

Scott

> -----Original Message-----
> From: [email-masked]
>

> 	yes it is.  and i suspect that -IF- the current user
> 	base expects confidentiality, that the DNS as we know
> 	it is -DOA- and we should start on the new thing -now-.
> 	Much harder than NSEC2, which is a pretty much a translucent
> 	veil over the naked DNS.  Still, its worth asking the question.
>
>
> --bill
>
> --
> to unsubscribe send a message to [email-masked] with
> the word 'unsubscribe' in a single line as the message text body.
> archive: <http://ops.ietf.org/lists/namedroppers/>
>

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Danny Mayer <[email-masked]>
Date: Fri, 04 Jun 2004 20:32:49 -0400

>depends on what a user wants to keep confidential.

The people who want confidentiality need to define EXACTLY what they mean
by that, otherwise the working group will end up working towards yet another
goal that doesn't satisfy their perceived needs.

Danny

---

From: Alex Bligh <[email-masked]>
Date: Sat, 05 Jun 2004 13:37:45 +0100

--On 04 June 2004 20:32 -0400 Danny Mayer <[email-masked]> wrote:

>> it.  Or if anyone really MUST have confidentiality for IP address
>> lookup.  I guess there could be some scenarios where it is desired, but
>> that also depends on what a user wants to keep confidential.
>

Indeed. Confidentiality is a nebulous word. That might include anything
up to an including:
* Ensuring noone with access to the wire between server and resolver
  can infer anything about either the names resolved, or the results of
  that resolution
* Ditto with respect to those with the ability to snoop caching
  nameservers
* Requirements for clients themselves to authenticate before being
  given confidential data

I think Paul dropped the confidentiality suggestion in as a possibility.
I don't think anyone has yet argued for it, and if they do, I think
it's a mostly orthogonal requirement to the enumerability problem
(certainly the above type of requirements are not something Nominet is
looking for to my knowledge).

Alex

---

From: [email-masked]
Date: Sat, 5 Jun 2004 13:13:41 +0000

> * Requirements for clients themselves to authenticate before being

	yup...

> looking for to my knowledge).

	may or may not have been Paul (which one?) but it
	is certainly called out in the DNS threat model RFC.
	And Geoff did indicate that Nominet has received legal
	advice that confidentiality is required.  Rock/hardPlace.

--bill

---

From: Alex Bligh <[email-masked]>
Date: Sat, 05 Jun 2004 16:28:36 +0100

--On 05 June 2004 13:13 +0000 [email-masked] wrote:

> 	advice that confidentiality is required.

I think (as per the referenced in Geoff's message to which you refer) it's
specific confidentiality that's required on that front (i.e. of the
database rather than of its components), rather than "everything must be
held confidential".

But away from the legal point, there's the "what do we want this protocol
to do" question. Again, from Nominet's view, whilst I can see the three
things I posted might be desirable features to some, they aren't something
Nominet's looking for.

The point of my message was to indicate what advice we had not received,
and what functionality we were not seeking :-) - given "confidentiality"
can mean anything to anyone.

Alex

---

From: Danny Mayer <[email-masked]>
Date: Sat, 05 Jun 2004 20:57:11 -0400

>can mean anything to anyone.

I raised the issue of defining "confidentiality" since it's not clear at all
what that means. For example: alex registers a domain alex.co.uk
with Nominet (and I'm not really picking on Alex or Nominet here).
What needs to be kept confidential? Is it:

a) the domain name alex.co.uk itself, in which case I would argue that
by registering the domain and making it available through the parent
domain, the name has been published and is available for everyone
to use. Otherwise why register it in the DNS?

b) He doesn't want people to know about the domain since you can
find out all sorts of information via whois, in which case the problem
lies with whois and not DNS.

c) Doesn't want someone else walking the co.uk and getting a complete
list of all domains. This could affect performance of the DNS servers
due to the advent of kiddiescripts being created to do this.

d) something else.

Again I'm not picking on Alex or Nominet. I just want to understand
exactly what they want to protect.

Danny