Subject: Re: [dns-privacy] [[email-masked]: I-D Action: draft-bortzmeyer-dns-qname-minimisation-00.txt]

From: Stephane Bortzmeyer <[email-masked]>
Date: Thu, 20 Mar 2014 16:37:06 +0100

On Thu, Mar 20, 2014 at 11:09:34AM -0400,
 Phillip Hallam-Baker <[email-masked]> wrote
 a message of 50 lines which said:

> minimization might well cause registries to take countermeasures if
> minimization was to affect their business models.

It's a general problem of security: the Bad Guys take
countermeasures. It was discussed in depth at the privacy tutorial at
the last IETF meeting, in London. Someone mentioned "business issues"
with privacy. And another one replied "anti-spam measures disturbed
some people's business, too".

> At the moment their servers support NS queries.  But if minimization
> is introduced they might change policy and start blocking.

This would be a violation of the protocol. We cannot prevent it but we
can at least call a spade a spade.

> the code might want to consider counter strategies. For example, if
> the request is for A records from secret.example.evil, it might
> query for A records as follows
>
> ? A, _.evil
> ? A, _.example.evil
> ? A, www.example.evil

Yes, good idea. "A" is probably the less revealing qtype. Should I add
this trick in the draft?

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 20 Mar 2014 11:40:09 -0400

> can at least call a spade a spade.

I would like to try to avoid the situation where we only ever allow
ourselves to think one move ahead.

> Yes, good idea. "A" is probably the less revealing qtype. Should I add

I think it is useful.

At the very least raise the issue in implementer's minds. This is all
advice to implementers after all.

Least privilege says that we don't need to leak this information and
so we should not.

Another trick that can be played on larger servers is to use cached
data including stale cached data to inform the decision.

--
Website: http://hallambaker.com/

---

From: Joe Abley <[email-masked]>
Date: Thu, 20 Mar 2014 10:43:51 -0500

> advice to implementers after all.

What about QTYPE ANY for this?

I understand the practical reasons for hiding the QTYPE behind A, but anything that has the appearance of being v4-only makes my eye twitch (and remember we need a solution for the future when IPv4 is a marginal, barely-used protocol, and A RRSets are rare, ha, ha).

ANY will cause larger responses in some/many cases, but it's stuff that once cached might well be useful and suppress subsequent queries, at least some of the time.

Joe

---

From: Tony Finch <[email-masked]>
Date: Thu, 20 Mar 2014 17:28:34 +0000

> What about QTYPE ANY for this?

Let's look like we are doing evil DDoS attacks :-)

I think this will sometimes help in the situation when there is not a zone
cut at the leaf. e.g. I know the name servers for example.com; is
www.example.com in the same zone or not? If I assume not and make an NS
query (expecting a referral) that will often be a waste; if I assume it is
in the same zone and send A and AAAA queries to the parent that will leak
information; if I make an ANY query I will get the answer(s) or a referral
directly, except if www.example.com is a CNAME (which is frequently the
case) I will have to make followup queries because ANY queries do not
trigger alias processing.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Faeroes: Southwest 7 to severe gale 9, perhaps storm 10 later. Very rough,
becoming high in south. Squally showers. Moderate or good.