draft-ietf-dprive-dns-over-tls-04.txt   draft-ietf-dprive-dns-over-tls-05.txt 
Network Working Group Z. Hu Network Working Group Z. Hu
Internet-Draft L. Zhu Internet-Draft L. Zhu
Intended status: Standards Track J. Heidemann Intended status: Standards Track J. Heidemann
Expires: July 24, 2016 USC/Information Sciences Expires: July 25, 2016 USC/Information Sciences
Institute Institute
A. Mankin A. Mankin
D. Wessels D. Wessels
Verisign Labs Verisign Labs
P. Hoffman P. Hoffman
ICANN ICANN
January 21, 2016 January 22, 2016
DNS over TLS: Initiation and Performance Considerations DNS over TLS: Initiation and Performance Considerations
draft-ietf-dprive-dns-over-tls-04 draft-ietf-dprive-dns-over-tls-05
Abstract Abstract
This document describes the use of TLS to provide privacy for DNS. This document describes the use of TLS to provide privacy for DNS.
Encryption provided by TLS eliminates opportunities for eavesdropping Encryption provided by TLS eliminates opportunities for eavesdropping
and on-path tampering with DNS queries in the network, such as and on-path tampering with DNS queries in the network, such as
discussed in RFC 7258. In addition, this document specifies two discussed in RFC 7258. In addition, this document specifies two
usage profiles for DNS-over-TLS and provides advice on performance usage profiles for DNS-over-TLS and provides advice on performance
considerations to minimize overhead from using TCP and TLS with DNS. considerations to minimize overhead from using TCP and TLS with DNS.
skipping to change at page 1, line 49 skipping to change at page 1, line 49
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 24, 2016. This Internet-Draft will expire on July 25, 2016.
Copyright Notice Copyright Notice
Copyright (c) 2016 IETF Trust and the persons identified as the Copyright (c) 2016 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 3, line 26 skipping to change at page 3, line 26
and server. DNS Security Extensions (DNSSEC), [RFC4033] provide and server. DNS Security Extensions (DNSSEC), [RFC4033] provide
_response integrity_ by defining mechanisms to cryptographically sign _response integrity_ by defining mechanisms to cryptographically sign
zones, allowing end-users (or their first-hop resolver) to verify zones, allowing end-users (or their first-hop resolver) to verify
replies are correct. By intention, DNSSEC does not protect request replies are correct. By intention, DNSSEC does not protect request
and response privacy. Traditionally, either privacy was not and response privacy. Traditionally, either privacy was not
considered a requirement for DNS traffic, or it was assumed that considered a requirement for DNS traffic, or it was assumed that
network traffic was sufficiently private, however these perceptions network traffic was sufficiently private, however these perceptions
are evolving due to recent events [RFC7258]. are evolving due to recent events [RFC7258].
Other work that has offered the potential to encrypt between DNS Other work that has offered the potential to encrypt between DNS
clients and servers includes DNSCurve [dempsky-dnscurve], clients and servers includes DNSCurve [dempsky-dnscurve], DNSCrypt
ConfidentialDNS [I-D.confidentialdns] and IPSECA [I-D.ipseca]. In [dnscrypt-website], ConfidentialDNS [I-D.confidentialdns] and IPSECA
addition to the present draft, the DPRIVE working group has recently [I-D.ipseca]. In addition to the present draft, the DPRIVE working
adopted a DNS-over-DTLS [draft-ietf-dprive-dnsodtls] proposal. group has recently adopted a DNS-over-DTLS
[draft-ietf-dprive-dnsodtls] proposal.
This document describes using DNS-over-TLS on a well-known port and This document describes using DNS-over-TLS on a well-known port and
also offers advice on performance considerations to minimize also offers advice on performance considerations to minimize
overheads from using TCP and TLS with DNS. overheads from using TCP and TLS with DNS.
Initiation of DNS-over-TLS is very straightforward. By establishing Initiation of DNS-over-TLS is very straightforward. By establishing
a connection over a well-known port, clients and servers expect and a connection over a well-known port, clients and servers expect and
agree to negotiate a TLS session to secure the channel. Deployment agree to negotiate a TLS session to secure the channel. Deployment
will be gradual. Not all servers will support DNS-over-TLS and the will be gradual. Not all servers will support DNS-over-TLS and the
well-known port might be blocked by some firewalls. Clients will be well-known port might be blocked by some firewalls. Clients will be
skipping to change at page 16, line 46 skipping to change at page 16, line 46
<http://tools.ietf.org/html/draft-dempsky-dnscurve-01>. <http://tools.ietf.org/html/draft-dempsky-dnscurve-01>.
[dgr-dprive-dtls-and-tls-profiles] [dgr-dprive-dtls-and-tls-profiles]
Dickinson, S., Gillmor, D., and T. Reddy, Dickinson, S., Gillmor, D., and T. Reddy,
"Authentication and (D)TLS Profile for DNS-over-TLS and "Authentication and (D)TLS Profile for DNS-over-TLS and
DNS-over-DTLS", draft-dgr-dprive-dtls-and-tls-profiles-00 DNS-over-DTLS", draft-dgr-dprive-dtls-and-tls-profiles-00
(work in progress), December 2015, <https:// (work in progress), December 2015, <https://
tools.ietf.org/html/ tools.ietf.org/html/
draft-dgr-dprive-dtls-and-tls-profiles-00>. draft-dgr-dprive-dtls-and-tls-profiles-00>.
[dnscrypt-website]
Denis, F., "DNSCrypt", December 2015,
<https://www.dnscrypt.org/>.
[dnssec-trigger] [dnssec-trigger]
NLnet Labs, "Dnssec-Trigger", May 2014, NLnet Labs, "Dnssec-Trigger", May 2014,
<https://www.nlnetlabs.nl/projects/dnssec-trigger/>. <https://www.nlnetlabs.nl/projects/dnssec-trigger/>.
[draft-ietf-dprive-dnsodtls] [draft-ietf-dprive-dnsodtls]
Reddy, T., Wing, D., and P. Patil, "DNS over DTLS Reddy, T., Wing, D., and P. Patil, "DNS over DTLS
(DNSoD)", draft-ietf-dprive-dnsodtls-01 (work in (DNSoD)", draft-ietf-dprive-dnsodtls-01 (work in
progress), June 2015, <https://tools.ietf.org/html/ progress), June 2015, <https://tools.ietf.org/html/
draft-ietf-dprive-dnsodtls-01>. draft-ietf-dprive-dnsodtls-01>.
 End of changes. 6 change blocks. 
8 lines changed or deleted 13 lines changed or added

This html diff was produced by rfcdiff 1.42. The latest version is available from http://tools.ietf.org/tools/rfcdiff/