--- 1/draft-bortzmeyer-dprive-rfc7626-bis-00.txt 2018-07-18 14:13:14.770796488 -0700 +++ 2/draft-bortzmeyer-dprive-rfc7626-bis-01.txt 2018-07-18 14:13:14.818797652 -0700 @@ -1,51 +1,51 @@ dprive S. Bortzmeyer Internet-Draft AFNIC Obsoletes: 7626 (if approved) S. Dickinson Intended status: Informational Sinodun IT -Expires: January 3, 2019 July 2, 2018 +Expires: January 17, 2019 July 16, 2018 DNS Privacy Considerations - draft-bortzmeyer-dprive-rfc7626-bis-00 + draft-bortzmeyer-dprive-rfc7626-bis-01 Abstract This document describes the privacy issues associated with the use of the DNS by Internet users. It is intended to be an analysis of the present situation and does not prescribe solutions. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- - Drafts is at https://datatracker.ietf.org/drafts/current/. + Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." - This Internet-Draft will expire on January 3, 2019. + This Internet-Draft will expire on January 17, 2019. Copyright Notice Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents - (https://trustee.ietf.org/license-info) in effect on the date of + (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 @@ -63,41 +63,41 @@ 2.5.3. Rogue Servers . . . . . . . . . . . . . . . . . . . . 13 2.5.4. Authentication of servers . . . . . . . . . . . . . . 13 2.5.5. Blocking of services . . . . . . . . . . . . . . . . 14 2.6. Re-identification and Other Inferences . . . . . . . . . 14 2.7. More Information . . . . . . . . . . . . . . . . . . . . 15 3. Actual "Attacks" . . . . . . . . . . . . . . . . . . . . . . 15 4. Legalities . . . . . . . . . . . . . . . . . . . . . . . . . 15 5. Security Considerations . . . . . . . . . . . . . . . . . . . 16 6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 7. Changelog . . . . . . . . . . . . . . . . . . . . . . . . . . 16 - 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 - 8.1. Normative References . . . . . . . . . . . . . . . . . . 16 + 8. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 + 8.1. Normative References . . . . . . . . . . . . . . . . . . 17 8.2. Informative References . . . . . . . . . . . . . . . . . 17 8.3. URIs . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 22 1. Introduction This document is an analysis of the DNS privacy issues, in the spirit of Section 8 of [RFC6973]. The Domain Name System is specified in [RFC1034], [RFC1035], and many later RFCs, which have never been consolidated. It is one of the most important infrastructure components of the Internet and often ignored or misunderstood by Internet users (and even by many professionals). Almost every activity on the Internet starts with a DNS query (and often several). Its use has many privacy implications and this is an attempt at a comprehensive and accurate list. Let us begin with a simplified reminder of how the DNS works. (See - also [I-D.ietf-dnsop-terminology-bis].) A client, the stub resolver, + also [I-D.ietf-dnsop-terminology-bis]) A client, the stub resolver, issues a DNS query to a server, called the recursive resolver (also called caching resolver or full resolver or recursive name server). Let's use the query "What are the AAAA records for www.example.com?" as an example. AAAA is the QTYPE (Query Type), and www.example.com is the QNAME (Query Name). (The description that follows assumes a cold cache, for instance, because the server just started.) The recursive resolver will first query the root name servers. In most cases, the root name servers will send a referral. In this example, the referral will be to the .com name servers. The resolver repeats the query to one of the .com name servers. The .com name servers, in @@ -619,21 +619,21 @@ Both Strict mode for DNS-over-TLS and DoH require authentication of the server and therefore as long as the authentication credentials are obtained over a secure channel then using either of these transports defeats the attack of re-directing traffic to rogue servers. Of course attacks on these secure channels are also possible, but out of the scope of this document. 2.5.5. Blocking of services User privacy can also be at risk if there is blocking (by local - network operators or more genearl mechanisms) of access to recursive + network operators or more general mechanisms) of access to recursive servers that offer encrypted transports. For example active blocking of port 853 for DNS-over-TLS or of specific IP addresses (e.g. 1.1.1.1) could restrict the resolvers available to the client. Similarly attacks on such services e.g. DDoS could force users to switch to other services that do not offer encrypted transports for DNS. 2.6. Re-identification and Other Inferences An observer has access not only to the data he/she directly collects @@ -711,91 +711,96 @@ [sidn-entrada]. 5. Security Considerations This document is entirely about security, more precisely privacy. It just lays out the problem; it does not try to set requirements (with the choices and compromises they imply), much less define solutions. Possible solutions to the issues described here are discussed in other documents (currently too many to all be mentioned); see, for instance, 'Recommendations for DNS Privacy Operators' - [I-D.dickinson-bcp-op]. + [I-D.dickinson-dprive-bcp-op]. 6. Acknowledgments Thanks to Nathalie Boulvard and to the CENTR members for the original work that led to this document. Thanks to Ondrej Sury for the interesting discussions. Thanks to Mohsen Souissi and John Heidemann for proofreading and to Paul Hoffman, Matthijs Mekking, Marcos Sanz, Tim Wicinski, Francis Dupont, Allison Mankin, and Warren Kumari for proofreading, providing technical remarks, and making many readability improvements. Thanks to Dan York, Suzanne Woolf, Tony Finch, Stephen Farrell, Peter Koch, Simon Josefsson, and Frank Denis for good written contributions. And thanks to the IESG members for the last remarks. 7. Changelog - draft-borztmeyer-dprive-RFC7626-bis-00: + draft-bortzmeyer-dprive-rfc7626-bis-01 - o Initial commit. Differences to RFC7626: + o Update reference for dickinson-bcp-op to draft-dickinson-dprive- + bcp-op - * Update many references + draft-borztmeyer-dprive-rfc7626-bis-00: - * Add discussions of encrypted transports including DNS-over-TLS - and DoH + Initial commit. Differences to RFC7626: - * Add section on DNS payload + o Update many references - * Add section on authentication of servers + o Add discussions of encrypted transports including DNS-over-TLS and + DoH - * Add section on blocking of services + o Add section on DNS payload + + o Add section on authentication of servers + + o Add section on blocking of services 8. References 8.1. Normative References [RFC1034] Mockapetris, P., "Domain names - concepts and facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034, November 1987, . [RFC1035] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, DOI 10.17487/RFC1035, November 1987, . [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., Morris, J., Hansen, M., and R. Smith, "Privacy Considerations for Internet Protocols", RFC 6973, - DOI 10.17487/RFC6973, July 2013, - . + DOI 10.17487/RFC6973, July 2013, . [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May 2014, . 8.2. Informative References [aeris-dns] Vinot, N., "Vie privee: et le DNS alors?", (In French), - 2015, - . + 2015, . [castillo-garcia] Castillo-Perez, S. and J. Garcia-Alfaro, "Anonymous Resolution of DNS Queries", 2008, . [dagon-malware] Dagon, D., "Corrupted DNS Resolution Paths: The Rise of a Malicious Resolution Authority", ISC/OARC Workshop, 2007, - . + . [darkreading-dns] Lemos, R., "Got Malware? Three Signs Revealed In DNS Traffic", InformationWeek Dark Reading, May 2013, . [data-protection-directive] European Parliament, "Directive 95/46/EC of the European @@ -809,22 +814,22 @@ [day-at-root] Castro, S., Wessels, D., Fomenkov, M., and K. Claffy, "A Day at the Root of the Internet", ACM SIGCOMM Computer Communication Review, Vol. 38, Number 5, DOI 10.1145/1452335.1452341, October 2008, . [denis-edns-client-subnet] Denis, F., "Security and privacy issues of edns-client- - subnet", August 2013, - . + subnet", August 2013, . [ditl] CAIDA, "A Day in the Life of the Internet (DITL)", 2002, . [dns-footprint] Stoner, E., "DNS Footprint of Malware", OARC Workshop, October 2010, . [dnschanger] @@ -859,29 +864,30 @@ . [herrmann-reidentification] Herrmann, D., Gerber, C., Banse, C., and H. Federrath, "Analyzing Characteristic Host Access Patterns for Re- Identification of Web User Sessions", DOI 10.1007/978-3-642-27937-9_10, 2012, . - [I-D.dickinson-bcp-op] - Dickinson, S., Rijswijk-Deij, R., and A. Mankin, - "Recommendations for DNS Privacy Service Operators", - draft-dickinson-bcp-op-00 (work in progress), March 2018. + [I-D.dickinson-dprive-bcp-op] + Dickinson, S., Overeinder, B., Rijswijk-Deij, R., and A. + Mankin, "Recommendations for DNS Privacy Service + Operators", draft-dickinson-dprive-bcp-op-00 (work in + progress), July 2018. [I-D.ietf-dnsop-terminology-bis] Hoffman, P., Sullivan, A., and K. Fujiwara, "DNS - Terminology", draft-ietf-dnsop-terminology-bis-10 (work in - progress), April 2018. + Terminology", draft-ietf-dnsop-terminology-bis-11 (work in + progress), July 2018. [I-D.ietf-doh-dns-over-https] Hoffman, P. and P. McManus, "DNS Queries over HTTPS (DoH)", draft-ietf-doh-dns-over-https-12 (work in progress), June 2018. [morecowbell] Grothoff, C., Wachs, M., Ermert, M., and J. Appelbaum, "NSA's MORECOWBELL: Knell for DNS", GNUnet e.V., January 2015, . @@ -916,64 +922,64 @@ Security (DNSSEC) Hashed Authenticated Denial of Existence", RFC 5155, DOI 10.17487/RFC5155, March 2008, . [RFC5936] Lewis, E. and A. Hoenes, Ed., "DNS Zone Transfer Protocol (AXFR)", RFC 5936, DOI 10.17487/RFC5936, June 2010, . [RFC6269] Ford, M., Ed., Boucadair, M., Durand, A., Levis, P., and P. Roberts, "Issues with IP Address Sharing", RFC 6269, - DOI 10.17487/RFC6269, June 2011, - . + DOI 10.17487/RFC6269, June 2011, . [RFC7413] Cheng, Y., Chu, J., Radhakrishnan, S., and A. Jain, "TCP Fast Open", RFC 7413, DOI 10.17487/RFC7413, December 2014, . [RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre, "Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May 2015, . [RFC7624] Barnes, R., Schneier, B., Jennings, C., Hardie, T., Trammell, B., Huitema, C., and D. Borkmann, "Confidentiality in the Face of Pervasive Surveillance: A Threat Model and Problem Statement", RFC 7624, - DOI 10.17487/RFC7624, August 2015, - . + DOI 10.17487/RFC7624, August 2015, . [RFC7858] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and P. Hoffman, "Specification for DNS over Transport Layer Security (TLS)", RFC 7858, DOI 10.17487/RFC7858, May 2016, . [RFC7871] Contavalli, C., van der Gaast, W., Lawrence, D., and W. Kumari, "Client Subnet in DNS Queries", RFC 7871, - DOI 10.17487/RFC7871, May 2016, - . + DOI 10.17487/RFC7871, May 2016, . [RFC7873] Eastlake 3rd, D. and M. Andrews, "Domain Name System (DNS) Cookies", RFC 7873, DOI 10.17487/RFC7873, May 2016, . [RFC7929] Wouters, P., "DNS-Based Authentication of Named Entities (DANE) Bindings for OpenPGP", RFC 7929, - DOI 10.17487/RFC7929, August 2016, - . + DOI 10.17487/RFC7929, August 2016, . [ripe-atlas-turkey] Aben, E., "A RIPE Atlas View of Internet Meddling in Turkey", March 2014, - . + . [sidn-entrada] Hesselman, C., Jansen, J., Wullink, M., Vink, K., and M. Simon, "A privacy framework for 'DNS big data' applications", November 2014, . [thomas-ditl-tcp] Thomas, M. and D. Wessels, "An Analysis of TCP Traffic in