Subject: [dns-privacy] I-D Action: draft-ietf-dprive-dnsodtls-07.txt

From: [email-masked]
Date: Wed, 06 Jul 2016 06:42:30 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the DNS PRIVate Exchange of the IETF.

        Title           : DNS over DTLS (DNSoD)
        Authors         : Tirumaleswar Reddy
                          Dan Wing
                          Prashanth Patil
	Filename        : draft-ietf-dprive-dnsodtls-07.txt
	Pages           : 11
	Date            : 2016-07-06

Abstract:
   DNS queries and responses are visible to network elements on the path
   between the DNS client and its server.  These queries and responses
   can contain privacy-sensitive information which is valuable to
   protect.  An active attacker can send bogus responses causing
   misdirection of the subsequent connection.

   To counter passive listening and active attacks, this document
   proposes the use of Datagram Transport Layer Security (DTLS) for DNS,
   to protect against passive listeners and certain active attacks.  As
   DNS needs to remain fast, this proposal also discusses mechanisms to
   reduce DTLS round trips and reduce DTLS handshake size.  The proposed
   mechanism runs over port 853.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dprive-dnsodtls/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dprive-dnsodtls-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dprive-dnsodtls-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Prashanth Patil (praspati)" <[email-masked]>
Date: Wed, 6 Jul 2016 13:54:12 +0000

The new revision addresses comments received on the list and @IETF-95.

-Prashanth

On 7/6/16, 6:42 AM, "dns-privacy on behalf of [email-masked]"
<[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>dns-privacy mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dns-privacy

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sun, 24 Jul 2016 21:04:22 +0200

On Wed, Jul 06, 2016 at 01:54:12PM +0000,
 Prashanth Patil (praspati) <[email-masked]> wrote 

> The new revision addresses comments received on the list and @IETF-95.

My review of -07 : I see no reason not to move it to WG last call.

Technical :

> DNS client can use the authenication mechanisms discussed in
> [I-D.ietf-dprive-dtls-and-tls-profiles]

> DNSoD client and server can use DTLS heartbeat [RFC6520]

In both cases, the language of RFC 2119 is not used. Is it on purpose?

Editorial:

s/authenication/authentication/

Random thoughts:

Now, a stub resolver may have to try four things (UDP/53, TCP/53,
UDP+DTLS/853 and TCP+TLS/853, all on the Standards track) before
communicating with a resolver. Should we write a meta-document, with
operational guidance, on how this could be done?

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Mon, 25 Jul 2016 04:44:06 +0000

> -----Original Message-----
> From: dns-privacy [mailto:[email-masked]] On Behalf Of
> Stephane Bortzmeyer
> Sent: Monday, July 25, 2016 12:34 AM
> To: Prashanth Patil (praspati) <[email-masked]>
> Cc: [email-masked]
> Subject: Re: [dns-privacy] I-D Action: draft-ietf-dprive-dnsodtls-07.txt
> 
> On Wed, Jul 06, 2016 at 01:54:12PM +0000,  Prashanth Patil (praspati)
> <[email-masked]> wrote  a message of 61 lines which said:
> 

No, will replace "can" with "MUST".

> s/authenication/authentication/

Thanks, fixed in my local copy.

> operational guidance, on how this could be done?

Yes, it will be useful.  This doc should discuss the precedence for UDP + DTLS verses TCP + TLS (it can consider using happy eyeballs technique).  

Cheers,
-Tiru