Subject: [dns-privacy] draft-mayrhofer-edns0-padding

From: Alexander Mayrhofer <[email-masked]>
Date: Thu, 23 Jul 2015 16:50:14 +0000

Hi,

I had a discussion with Daniel Khan Gillmor today, and we talked about his proposal to specify a padding option in TLS so that message-size based correlation attacks on encrypted DNS packets could be prevented. We  continued discussing other options (such as "artificial" RRs in the additional section), and I floated the idea that we could use EDNS0 to include padding in DNS packets.

So, I've created a quick-and-dirty strawman proposal draft for this idea, and i'm happy to discuss this during tomorrow's DPRIVE session if we have time:

https://www.ietf.org/id/draft-mayrhofer-edns0-padding-00.txt

Bring out the pitchforks and torches :)

Alex

---

From: George Michaelson <[email-masked]>
Date: Thu, 23 Jul 2015 18:52:25 +0200

What does it mean to exceed the proffered EDNS0 buffer size with your
padded response?

You're 'silent' on length, but surely the server should respect the EDNS0
size proffer as a limit?

On Thu, Jul 23, 2015 at 6:50 PM, Alexander Mayrhofer <
[email-masked]> wrote:

> Hi,
>
> I had a discussion with Daniel Khan Gillmor today, and we talked about his
> proposal to specify a padding option in TLS so that message-size based
> correlation attacks on encrypted DNS packets could be prevented. We
> continued discussing other options (such as "artificial" RRs in the
> additional section), and I floated the idea that we could use EDNS0 to
> include padding in DNS packets.
>
> So, I've created a quick-and-dirty strawman proposal draft for this idea,
> and i'm happy to discuss this during tomorrow's DPRIVE session if we have
> time:
>
> _______________________________________________
> DNSOP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsop
>

---

From: Alexander Mayrhofer <[email-masked]>
Date: Thu, 23 Jul 2015 16:54:47 +0000

George,

i certainly agree. Noted for a revision.

Alex

Von: George Michaelson [mailto:[email-masked]]
Gesendet: Donnerstag, 23. Juli 2015 18:52
An: Alexander Mayrhofer
Cc: [email-masked]; [email-masked]
Betreff: Re: [DNSOP] draft-mayrhofer-edns0-padding

What does it mean to exceed the proffered EDNS0 buffer size with your padded response?

You're 'silent' on length, but surely the server should respect the EDNS0 size proffer as a limit?

On Thu, Jul 23, 2015 at 6:50 PM, Alexander Mayrhofer <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Alex

_______________________________________________
DNSOP mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Fri, 24 Jul 2015 01:19:53 +0200

On Thu 2015-07-23 18:50:14 +0200, Alexander Mayrhofer wrote:

> I had a discussion with Daniel Khan Gillmor today, and we talked about
> his proposal to specify a padding option in TLS so that message-size
> based correlation attacks on encrypted DNS packets could be
> prevented. We continued discussing other options (such as "artificial"
> RRs in the additional section), and I floated the idea that we could
> use EDNS0 to include padding in DNS packets.
>
> So, I've created a quick-and-dirty strawman proposal draft for this
> idea, and i'm happy to discuss this during tomorrow's DPRIVE session
> if we have time:
>

wow, thanks for the incredibly quick writeup!

I think this draft could have an informative reference to Haya Shulman's
research on difficulties in DNS encryption, which won the recent ANRP:

  https://irtf.org/anrp
  https://www.ietf.org/mail-archive/web/dns-privacy/current/pdfWqAIUmEl47.pdf

Section 3.2.2 shows that her mechanism for inferring the contents of
queries becomes *even more effective* by including the size of the
packets in her analysis.  (Everyone working on dprive should read this
paper to get a sense of some of the massive difficulties we need to
consider because of the structure of DNS traffic analysis; just
encrypting the traffic is insufficient for several reasons)

I also note that draft-mayrhofer-edns0-padding curently suggests that
the minimum padding size is 1 octet.  Is there any reason to avoid a
padding size of 0? 

        --dkg

---

From: Mark Andrews <[email-masked]>
Date: Fri, 24 Jul 2015 13:01:48 +1000

This can be dropped.  EDNS aware clients are required to ignore unknown EDNS options.

   A server MUST use the 'Padding' option in a DNS response (QR=1) only
   when that response correlates to a query that contained the 'Padding'
   option.

For QUERY I would be padding the request out to 400 octets.  This allows for
all legal query names (max question size is 255+2+2 octets), some EDNS options
and the pad option.

Mark

In message <[email-masked]>, Daniel Kahn Gillmor writes:
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]