> I'm one of those that made that argument. I do think we should fix this in TLS, but realistically, browsers are going to continue sending SNI in the > clear for at least another 10 years. Yes, we should fix this now, because whenever we start, that's when the 10-year countdown begins. The same is > true for any modification to DNS, except the timeframe is likely to be even longer.
Even if TLS is not fixed, there is still value in improving DNS privacy. Stephane makes the point in his draft: What also makes the DNS traffic different is that it may take a different path than the communication between the initiator and the recipient. For instance, an eavesdropper may be unable to tap the wire between the initiator and the recipient but may have access to the wire going to the resolver, or to the authoritative name servers. Suppose that a host sends a query for "_bittorrent-tracker._tcp.domain.example.com." If it does not have a cached copy of the NS record for "example.com," the query will go the ".com" server. Because the query carries the entire QNAME, anyone who eavesdrop on the TLD server would learn that the host is attempting to contact a bit torrent server at "domain.example.com." They would learn that even if they are not able to eavesdrop on the direct path between the host and "domain.example.com." Now suppose that instead of sending a query with the full QNAME, the host just sends to the ".com" server a query for the NS record of "example.com." Once it receives the response, the host can send the full query directly to "ns.example.com." Clearly, that too can be eavesdropped, but only if the eavesdropper has a tap on the direct path between the client and the bit torrent server. And if it has such a tap, it will find anyhow that there is TCP-IP traffic between the host and the bittorrent server at "domain.example.com," which means that parsing the DNS query would not provide extra information. So we have here a simple way to prevent leakage of information. It can actually be implemented unilaterally by resolvers, and does not require a change in the DNS protocol. It does require that the resolver somehow learn the "zone cuts," but that is not impossible to learn. -- Christian Huitema _______________________________________________ perpass mailing list [email protected] https://www.ietf.org/mailman/listinfo/perpass
