Subject: Re: [Doh] WGLC on draft-ietf-doh-dns-over-https

From: Mark O <[email-masked]>
Date: Wed, 2 May 2018 14:46:21 +0000

The charter for the DOH working group states that "The working group will analyze the security and privacy issues that could arise from accessing DNS over HTTPS". I'd like to suggest that the section on Security Considerations of draft-ietf-doh-dns-over-https should include text on the impact on cyber defence. Additionally, there is currently no section on Privacy Considerations; I think there ought to be one, highlighting the privacy implications of adopting DOH.

Suggested text:

Security Considerations
"DNS queries and responses transmitted using DOH will not be visible to security appliances that filter traffic without proxying it. These security appliances may be used to protect the user (or the DNS resolver) from cyber attackers, by blocking DNS resolution and therefore connection attempts to black-listed domains that have been associated with malware or mass hacking attacks, or using DNS to monitor outbreaks of such malware across a network. DOH may reduce the effectiveness of these security appliances."
(The section on Operational Considerations already includes the statement "Filtering or inspection systems that rely on unsecured transport of DNS will not function in a DNS over HTTPS environment", but this fails to capture the impact on cyber defence.)

Privacy Considerations
"As recognised in RFC7626, running DNS queries over an unencrypted channel has privacy implications for the user: both the name of the domain being queried, and the source IP addresses of the user, are available to an eavesdropper. Although neither of these may be sensitive in themselves, the linking of one to another is a major privacy concern. DOH improves privacy for the user because the domain names being queried are no longer visible to the attacker."

"Some enterprises may use DNS filtering systems, which may filter queries or re-write DNS responses to protect applications and local users from malware or illicit content.
The DNS filtering system is an observer of the enterprise users' DNS queries and responses and may be able to correlate the queries and responses to HTTPS sessions, and attribute DNS queries to individuals. This has privacy implications for the enterprise users. With DOH, DNS filtering systems that rely on clear DNS traffic will no longer work; this is a privacy improvement, but also causes a security risk to the enterprise if not addressed. One possible remedial action would be to decrypt the HTTPS data that contains the DOH queries and responses. Since it is not possible to distinguish DOH from other HTTPS traffic and selectively decrypt only the DOH traffic, the result would be to decrypt all HTTPS traffic, which would represent a greater level of privacy intrusion."

I also suggest moving this [existing] paragraph from "Security Considerations" to "Privacy Considerations":
"A client can use DNS over HTTPS as one of multiple mechanisms to obtain DNS data.  If a client of this protocol encounters an HTTP error after sending a DNS query, and then falls back to a different DNS retrieval mechanism, doing so can weaken the privacy expected by the user of the client."

Additionally, there is a paragraph in the Security Considerations about not trusting an HTTPS DNS server just because it has been discovered; it says "a client MUST only trust DNS API server that is configured as trustworthy." For clarity, it might be better to reverse the logic of this statement, i.e. "a client MUST NOT trust a DNS API server that has not been configured by the client to be trustworthy."

- Mark

> On 19 Apr 2018, at 5:07 am, Ben Schwartz <[email-masked]<mailto:[email-masked]>> wrote:
>
> All,
> This message starts a two week WG Last Call on advancing:
>
>   Title           : DNS Queries over HTTPS
>   Author          : Paul Hoffman, Patrick McManus
>   Filename        : draft-ietf-doh-dns-over-https-07
>   Pages           : 17
>   Date            : 2018-04-11
>
> as a Standards Track document. The last call will end on May 2, 2018.
> All substantive comments are to be sent to the [email-masked]<mailto:[email-masked]> list for
> discussions. Editorial comments can be sent to the document editor.
>
> You can find the latest version of the document here:
> https://tools.ietf.org/html/draft-ietf-doh-dns-over-https-07<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-doh-dns-over-https-07&data=02%7C01%7Cmark.o%40ncsc.gov.uk%7Ce9728b6d82404d02373608d5afa9012b%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636608062758393189&sdata=cBZNGrqEwvdQOK99cXmGHME3yLlFx1ICYOc1nC7%2BhyI%3D&reserved=0>
>
> Regards,
> Ben & tale
> _______________________________________________
> Doh mailing list
> [email-masked]<mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/doh<https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdoh&data=02%7C01%7Cmark.o%40ncsc.gov.uk%7Ce9728b6d82404d02373608d5afa9012b%7C14aa5744ece1474ea2d734f46dda64a1%7C0%7C0%7C636608062758393189&sdata=LPXN8ek%2BI%2F9ts8t6eW6xJgr1hxO1QFgCVMnE2p%2F4SGg%3D&reserved=0>

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 2 May 2018 16:09:10 +0000

On May 2, 2018, at 7:46 AM, Mark O <[email-masked]> wrote:
> 
>  The charter for the DOH working group states that “The working group will analyze the security and privacy issues that could arise from accessing DNS over HTTPS”.

It does. However, it does not say that the protocol document has to do so.

> I’d like to suggest that the section on Security Considerations of draft-ietf-doh-dns-over-https should include text on the impact on cyber defence.

It might be better dealt with in a standalone document. Given that the IETF historically takes at least a year to "agree" on wording relating to this, causing the protocol document to wait for such agreement might be bad. For example, I find some of the wording you proposed to be highly biased towards "middleboxes have a right to inspect". Others might find your wording too weak, and would want more wording along the lines of "security middleboxes already inspect DNS messages, and DOH is preventing that, so DOH hurts security". There are literally thousands of messages on this topic on various IETF mailing lists in the past few years.

Further, the wording proposed is as appropriate for DNS-over-TLS as for DOH (with slightly different security and privacy considerations), and thus a separate document that deals with both of them would actually be more helpful than just doing it for DOH.

--Paul Hoffman