Subject: [DNSOP] Want to join the IETF 93 Hackathon to work on DNSSEC, DANE or DNS Privacy?

From: Dan York <[email-masked]>
Date: Wed, 1 Jul 2015 11:43:18 +0000

DNSOP participants,

Will you be in Prague on the weekend before IETF 93? (Or could you get there?)  A number of us will be involved with the hackathon happening on Saturday and Sunday:

https://www.ietf.org/registration/MeetingWiki/wiki/93hackathon

Our intent is to work on some tools/services related to DANE, DNSSEC and/or DNS privacy - either adding support to existing tools or projects, or developing something new that is useful in some way (and is not a duplicate of something else).   We don't have specific projects lined up yet  (we need to meet and decide what we're going to do)...  but any suggestions are certainly welcome.

If you'd like to join for either one or both days, the link to sign up is on that hackathon page.   Here's what we wrote as an abstract:

  *
DANE / DNS Privacy / DNSSEC
     *
Contribute to access of end-systems to new developments in DNS
     *
Protocols: DANE support for webmail, DNS-over-TLS (application uses), DNS-over-DTLS (stack and uses), TLSA client certs, client privacy election for EDNS client-subnet, getdns language bindings, etc.
     *
Tools: portable tool for creating and adding DANE RR’s to zones, changes to existing tools to support new crypto algorithms, etc.
     *
Measurement: New tools or sites for measuring DNSSEC or DANE deployment
     *
Available open source libraries: https://github.com/verisign/smaug, https://github.com/getdnsapi
     *
Available environment, support, and diagnostic tools: https://dnssec-tools.org, https://www.opendnssec.org
     *
Champions
        *
Dan York, Internet Society [email-masked]<mailto:[email-masked]>
        *
Allison Mankin, Verisign Labs [email-masked]<mailto:[email-masked]>
        *
Willem Toorop, NLnet Labs
        *
Sara Dickinson, Sinodun
        *
Others, TBA

Anyone is welcome to join with us.  The current list of participants is here:  https://www.ietf.org/registration/ietf93/hackathonattendance.py?sortkey=3&login=%0A<https://www.ietf.org/registration/ietf93/hackathonattendance.py?sortkey=3&login=>  (you can see that some people have listed that they will join in for DNS-related topics...)

See (some of) you in Prague,
Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked]<mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked]<mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/<http://www.internetsociety.org/deploy360/>

---

From: Tom Ritter <[email-masked]>
Date: Thu, 2 Jul 2015 15:20:30 -0500

As an idea:  some months ago dkg looked at hooking up unbound to an
upstream resolver over TCP/TLS.  It works, but it isn't ideal right
now.  Our findings:

A) client and server together negotiate TLS 1.2 (that's good!)

B) client doesn't appear to even try to validate the certificate

C) client doesn't hold open connections, but rather does one query per
   connection.  This is a tremendous amount of overhead.

D) server selects TLS_RSA_WITH_AES_256_GCM_SHA384 even though
   client preferred TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 or
   TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384.

E) server offers a TLS session ticket each time, and
   client is not re-using the session ticket (or any other abbreviated
   handshake mechanism) that i can tell.

unbound client config:

forward-zone:
 name: "."
 forward-addr: w.x.y.z@443
server:
 ssl-upstream: yes
 tcp-upstream: yes

unbound server-config:

interface: 0.0.0.0@443
interface: ::0@443
access-control: 0.0.0.0/0 allow
ssl-port: 443
ssl-service-pem: /etc/unbound/unbound_server.pem
ssl-service-key: /etc/unbound/unbound_server.key

-tom

On 1 July 2015 at 06:43, Dan York <[email-masked]> wrote:
> DNSOP participants,
>
> Will you be in Prague on the weekend before IETF 93? (Or could you get
> there?)  A number of us will be involved with the hackathon happening on
> Saturday and Sunday:
>
> Our intent is to work on some tools/services related to DANE, DNSSEC and/or
> DNS privacy - either adding support to existing tools or projects, or
> developing something new that is useful in some way (and is not a duplicate
> of something else).   We don't have specific projects lined up yet  (we need
> to meet and decide what we're going to do)...  but any suggestions are
> certainly welcome.
>
> If you'd like to join for either one or both days, the link to sign up is on
> that hackathon page.   Here's what we wrote as an abstract:
>
> Protocols: DANE support for webmail, DNS-over-TLS (application uses),
> DNS-over-DTLS (stack and uses), TLSA client certs, client privacy election
> for EDNS client-subnet, getdns language bindings, etc.
> Tools: portable tool for creating and adding DANE RR’s to zones, changes to
> existing tools to support new crypto algorithms, etc.
> Available environment, support, and diagnostic tools:
> https://dnssec-tools.org, https://www.opendnssec.org
> Champions
>
> Dan York, Internet Society [email-masked]
> Allison Mankin, Verisign Labs [email-masked]
> Anyone is welcome to join with us.  The current list of participants is
> here:
> https://www.ietf.org/registration/ietf93/hackathonattendance.py?sortkey=3&login=%0A
> (you can see that some people have listed that they will join in for
> DNS-related topics...)
>
> [email-masked]   +1-802-735-1624
> Jabber: [email-masked]
> http://www.internetsociety.org/
>
>
>
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 02 Jul 2015 16:36:51 -0400

> B) client doesn't appear to even try to validate the certificate

this is https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658

>    handshake mechanism) that i can tell.

I hope to work on these issues during the hackathon.

  --dkg

---

From: Willem Toorop <[email-masked]>
Date: Fri, 03 Jul 2015 09:02:14 +0200

Excellent idea!  Looking forward to help out with this!
I will discuss with Wouter (what he thinks about this and how he would
take it on), but also Sara is deep into Unbound code, especially with
respect to transports!

-- Willem

---

From: Allison Mankin <[email-masked]>
Date: Fri, 3 Jul 2015 08:11:13 -0400

Patches to unbound by Sara Dickinson (Sinodun) that are part of the
DNS-over-TLS aka T-DNS project:

Patches:
https://portal.sinodun.com/stash/projects/TDNS/repos/dns-over-tls_patches/browse

---

From: Paul Wouters <[email-masked]>
Date: Fri, 3 Jul 2015 13:00:46 -0400 (EDT)

>> upstream resolver over TCP/TLS.  It works, but it isn't ideal right

Yes. That support to allow only tcp for upstream querying was added
specifically at my request to beter support tor.

> this is https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=658

Yes because the TLS feature was only a port 53 circumvention technique,
not a real TLS support feature.

>>    connection.  This is a tremendous amount of overhead.

Yes, this is the biggest problem, especially in combination with
dnssec-trigger when it falls back to upstream tcp 80 or ssl443. Too many
timeouts for a full recursing server.

> I hope to work on these issues during the hackathon.

Cool!

Paul