Subject: [DNSOP] I-D Action: draft-ietf-dnsop-qname-minimisation-04.txt

From: [email-masked]
Date: Fri, 19 Jun 2015 05:38:52 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Domain Name System Operations Working Group of the IETF.

        Title           : DNS query name minimisation to improve privacy
        Author          : Stephane Bortzmeyer
	Filename        : draft-ietf-dnsop-qname-minimisation-04.txt
	Pages           : 11
	Date            : 2015-06-19

Abstract:
   This document describes one of the techniques that could be used to
   improve DNS privacy (see [I-D.ietf-dprive-problem-statement]), a
   technique called "QNAME minimisation", where the DNS resolver no
   longer sends the full original QNAME to the upstream name server.

   REMOVE BEFORE PUBLICATION Discussions of the document should take
   place on the DNSOP working group mailing list [dnsop].

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-dnsop-qname-minimisation/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-dnsop-qname-minimisation-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-dnsop-qname-minimisation-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Bob Harold <[email-masked]>
Date: Fri, 19 Jun 2015 09:10:33 -0400

On Fri, Jun 19, 2015 at 8:38 AM, <[email-masked]> wrote:

> At the end of section 6 it says:

A possible solution is
to always use the traditional algorithm when the cache is cold and
then to move to QNAME minimisation.  This will decrease the privacy a
bit

Every time the TTL of those records expires, that part of the cache is
"cold", so it will happen regularly, and over time any repeated query will
show up in the logs, so I think it affects privacy much more than "a bit"
and should be avoided completely if privacy is a concern.
Does that make sense?

---

From: Paul Vixie <[email-masked]>
Date: Fri, 19 Jun 2015 08:05:16 -0700

Bob Harold wrote:
>
> On Fri, Jun 19, 2015 at 8:38 AM, <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     ...
>
> "cold", so it will happen regularly, and over time any repeated query
> will show up in the logs, so I think it affects privacy much more than
> "a bit" and should be avoided completely if privacy is a concern.
> Does that make sense?

i agree with bob harold's analysis of the likely outcome of the 'when
cold' approach described in the above quote.

-- 
Paul Vixie

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 20 Jun 2015 16:43:38 +0200

On Fri, Jun 19, 2015 at 09:10:33AM -0400,
 Bob Harold <[email-masked]> wrote 
 a message of 132 lines which said:

> Every time the TTL of those records expires, that part of the cache
> is "cold", so it will happen regularly,

We talk here about infrastructure (NS and SOA records), which
typically have longer TTLs. Anyway, to address your remark, I suggest
to move this trick to appendix B, like all the other alternatives, and
to add a remark in section 7 (security considerations) remarking that
all the alternatives in appendix B decrease privacy. Does it work?
This is committed as 
<https://github.com/bortzmeyer/my-IETF-work/commit/604aff49dc9e80a87b9fe0093bc602095914510b>

---

From: Bob Harold <[email-masked]>
Date: Mon, 22 Jun 2015 12:56:20 -0400

Looks ok to me, thanks.

-- 
Bob Harold
hostmaster, UMnet, ITcom
Information and Technology Services (ITS)
[email-masked]
734-647-6524 desk

On Sat, Jun 20, 2015 at 10:43 AM, Stephane Bortzmeyer <[email-masked]>
wrote:

> <
> https://github.com/bortzmeyer/my-IETF-work/commit/604aff49dc9e80a87b9fe0093bc602095914510b
> >
>
>