Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread John Heidemann
On Thu, 01 Apr 2021 11:59:26 +0200, Tomas Krizek wrote: >On 31/03/2021 23.28, Rob Sayre wrote: >> On Wed, Mar 31, 2021 at 2:16 PM Bill Woodcock wrote: >> >>> >>> …and it’s measuring latency rather than server-side load. I just checked >>> with our engineers, and it sounds like the server load

[dns-privacy] RFC7626 and risk/threat analysis

2021-04-01 Thread Jim Reid
> On 1 Apr 2021, at 14:04, Stephane Bortzmeyer wrote: > > RFC 793 is 39 years old. Let's drop TCP and move to QUIC (the RFCs are > in the RCF-EDITOR state). > > And I'm too charitable to mention the age of DNS RFCs You should be above whatabootery* Stephane. >> Some other risks have changed

Re: [dns-privacy] WG Call for Adoption: draft-pauly-dprive-oblivious-doh

2021-04-01 Thread Brian Haberman
Hi all, Thanks for all the discussion on this draft. The amount of feedback was very useful for the chairs. We judged that there is not consensus to adopt this draft at this time, but we do have some suggestions for the authors: 1. Continue to follow the chartering of OHTTP to see what can

[dns-privacy] -02 of draft-ietf-dprive-opportunistic-adotq

2021-04-01 Thread Paul Hoffman
Greetings again. We have produced draft-ietf-dprive-opportunistic-adotq-02 based on extensive WG feedback before, during, and after the WG meeting. A couple of big changes include: - All that fully-authenticated description we added to -01 before the WG meeting because we didn't know that

[dns-privacy] I-D Action: draft-ietf-dprive-opportunistic-adotq-02.txt

2021-04-01 Thread internet-drafts
A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS PRIVate Exchange WG of the IETF. Title : Recursive to Authoritative DNS with Unauthenticated Encryption Authors : Paul Hoffman

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Christian Huitema
> On Mar 31, 2021, at 10:51 PM, Rob Sayre wrote: > >  > On Wed, Mar 31, 2021 at 10:43 PM Christian Huitema > wrote: >> I think that's the big motivation behind DoQ. Because QUIC runs over UDP, it >> makes some things easier than TCP. In particular, I have seen (and done) >> demos of

[dns-privacy] DDoS resiliance & DNS-over-TCP (was Root Server Operators Statement on DNS Encryption)

2021-04-01 Thread Shane Kerr
Bill, On 31/03/2021 22.29, Bill Woodcock wrote: On Mar 31, 2021, at 9:55 PM, Rob Sayre wrote: I still don't understand the resistance here. Some data on what the impact would be still seems like the most helpful thing to move the conversation forward. We have that:

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Stephane Bortzmeyer
On Wed, Mar 31, 2021 at 02:32:46PM +0100, Jim Reid wrote a message of 13 lines which said: > > RFC 7626 (the threat model and problem analysis that some people > > claim is missing) is clear (section 2.5.2 for instance). > > RFC7626 is 6 years old. RFC 793 is 39 years old. Let's drop TCP

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Stephane Bortzmeyer
On Wed, Mar 31, 2021 at 10:12:52PM +, Andrew Campling wrote a message of 30 lines which said: > My apologies if the stance of TLD operators is well known to most in > this group, I don't think so, this they are a very diverse group, working under very different conditions. > do

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Stephane Bortzmeyer
On Wed, Mar 31, 2021 at 11:43:57PM +0200, Bill Woodcock wrote a message of 74 lines which said: > This isn’t a place for pointless thrashing around as a byproduct of > someone’s unrelated agenda. Which was, I think, the point of the > statement. But I wonder again who this "someone" is? I

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Vittorio Bertola
> Il 01/04/2021 14:08 Brian Haberman ha scritto: > > The WG seems to fluctuate between wanting to treat all authoritatives > the same and thinking of the root as being different from TLDs. If you > recall during our interim meeting last year, we tried to keep them > separate and some folks

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Bill Woodcock
> On Apr 1, 2021, at 2:08 PM, Brian Haberman wrote: >>> On Mar 31, 2021, at 11:49 PM, Stephen Farrell >>> wrote: >>> The real issue IMO is not querying the root servers but the TLDs. There are >>> still performance issues to consider of course but the business model and >>> the value to the

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Brian Haberman
On 3/31/21 5:51 PM, Bill Woodcock wrote: > > >> On Mar 31, 2021, at 11:49 PM, Stephen Farrell >> wrote: >> The real issue IMO is not querying the root servers but >> the TLDs. There are still performance issues to consider >> of course but the business model and the value to the >> person

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Petr Špaček
On 01. 04. 21 11:59, Tomas Krizek wrote: On 31/03/2021 23.28, Rob Sayre wrote: On Wed, Mar 31, 2021 at 2:16 PM Bill Woodcock wrote: …and it’s measuring latency rather than server-side load. I just checked with our engineers, and it sounds like the server load per-query is more like 3x-5x

Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

2021-04-01 Thread Tomas Krizek
On 31/03/2021 23.28, Rob Sayre wrote: > On Wed, Mar 31, 2021 at 2:16 PM Bill Woodcock wrote: > >> >> …and it’s measuring latency rather than server-side load. I just checked >> with our engineers, and it sounds like the server load per-query is more >> like 3x-5x higher for the encrypted