DNS PRIVate Exchange (dprive) Internet Drafts


      
 Unilateral Opportunistic Deployment of Encrypted Recursive-to-Authoritative DNS
 
 draft-ietf-dprive-unilateral-probing-13.txt
 Date: 23/10/2023
 Authors: Daniel Gillmor, Joey Salazar, Paul Hoffman
 Working Group: DNS PRIVate Exchange (dprive)
 Formats: html xml txt
This document sets out steps that DNS servers (recursive resolvers and authoritative servers) can take unilaterally (without any coordination with other peers) to defend DNS query privacy against a passive network monitor. The steps in this document can be defeated by an active attacker, but should be simpler and less risky to deploy than more powerful defenses. The goal of this document is to simplify and speed deployment of opportunistic encrypted transport in the recursive-to-authoritative hop of the DNS ecosystem. Wider easy deployment of the underlying encrypted transport on an opportunistic basis may facilitate the future specification of stronger cryptographic protections against more powerful attacks.


data-group-menu-data-url="/group/groupmenu.json"> Skip to main content

DNS PRIVate Exchange (dprive)

WG Name DNS PRIVate Exchange
Acronym dprive
Area Internet Area (int)
State Active
Charter charter-ietf-dprive-02 Approved
Document dependencies
Additional resources Jabber Logs
Wiki
Zulip stream
github
Personnel Chairs Brian Haberman, Tim Wicinski
Area Director Éric Vyncke
Mailing list Address dns-privacy@ietf.org
To subscribe https://www.ietf.org/mailman/listinfo/dns-privacy
Archive https://mailarchive.ietf.org/arch/browse/dns-privacy/
Chat Room address https://zulip.ietf.org/#narrow/stream/dprive

Charter for Working Group

The DNS PRIVate Exchange (DPRIVE) Working Group develops mechanisms
to provide confidentiality to DNS transactions in order to address
concerns surrounding pervasive monitoring (RFC 7258).

The set of DNS requests that an individual makes can provide an
attacker with a large amount of information about that individual.
DPRIVE aims to deprive the attacker of this information (The IETF
defines pervasive monitoring as an attack [RFC7258]).

The initial focus of this Working Group was the development of
mechanisms that provide confidentiality and authentication between
DNS Clients and Iterative Resolvers (published as RFCs 7858 and
8094). With proposed standard solutions for the client-to-iterative
resolvers published, the working group turns its attention to the
development of documents focused on: 1) providing confidentiality
to DNS transactions between Iterative Resolvers and Authoritative
Servers, 2) measuring the efficacy in preserving privacy in the
face pervasive monitoring attacks, and 3) defining operational,
policy, and security considerations for DNS operators offering
DNS privacy services. Some of the results of this working group
may be experimental.There are numerous aspects that differ between
DNS exchanges with an iterative resolver and exchanges involving
DNS root/authoritative servers. The working group will work with
DNS operators and developers (via the DNSOP WG) to ensure that
proposed solutions address key requirements.

DPRIVE is chartered to work on mechanisms that add confidentiality
to the DNS. While it may be tempting to solve other DNS issues while
adding confidentiality, DPRIVE is not the working group to do this.
DPRIVE will not work on any integrity-only mechanisms. Examples
of the sorts of risks that DPRIVE will address can be found in [RFC
7626], and include both passive wiretapping and more active attacks,
such as MITM attacks. DPRIVE will address risks to end-users' privacy
(for example, which websites an end user is accessing).

DPRIVE Work Items:

  • Develop requirements for adding confidentiality to DNS exchanges
    between recursive resolvers and authoritative servers (unpublished
    document).

  • Investigate potential solutions for adding confidentiality to DNS
    exchanges involving authoritative servers (Experimental).

  • Define, collect and publish performance data measuring effectiveness
    of DPRIVE-published technologies against pervasive monitoring
    attacks.

  • Document Best Current Practices for operating DNS Privacy services.

Milestones

Date Milestone Associated documents
Aug 2020 Submit draft on DNS privacy exchanges involving authoritative servers (Exp)

Done milestones

Date Milestone Associated documents
Done Unpublished document on requirements for DNS privacy services between recursive and authoritative servers (Wiki)