IETF 92 Webinar

©!Men!&!Mice!!http://menandmice.com!
IETF!92!Review
 
31st!March!2015
1

Agenda
IETF!92!in!Dallas!!
DNS,!DNSSEC,!DANE,!DHCP,!IPv6!
the!following!information!is!an!excerpt!of!the!IETF!
working!group!activities!
for!a!full!overview!of!all!activities!at!IETF!92,!see! 
https://datatracker.ietf.org/meeting/92/materials.html
2

DNS
3

new!DNS!related!RFCs! 
published!since!last!IETF
4
RFC Title Category
7489
Domain-based Message Authentication, Reporting, and
Conformance (DMARC)
Informational
7479 Using Ed25519 in SSHFP Resource Records Informational
7477 Child-to-Parent Synchronization in DNS Standards Track
7435 Opportunistic Security: Some Protection Most of the Time Informational

draft-ietf-dnsop-qname-minimisation
•today,!DNS!resolver!always!send!the!full!query!
name!when!doing!recursive!DNS!resolution!
•if!the!zone-cut!is!already!known,!this!is!not!necessary!
•less!data!on!the!root-server!system!and!TLD!server!level!
provides!better!privacy!for!users!
•not!a!protocol!change,!just!a!change!in!resolver!
implementations
5

©!Men!&!Mice!!http://menandmice,com!
http://www.example.com.
“”
com.
example.com.
local!caching!!
DNS!Server
Name!Resolution!in!Pictures

“”
com.
example.com.
local!caching!!
DNS!Server
What!is!the!address!
of!
www.example.com.

“”
com.
example.com.
local!caching!!
DNS!Server
of!
www.example.com.

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!a!list!of!
“com.”!Name!Servers

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!a!list!of!
“example.com.”!Name!
Servers

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!the!address!of!
“www.example.com.”

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!the!address!
of!

with!qname!minimisation!
“”
com.
example.com.
local!caching!!
DNS!Server

“”
com.
example.com.
local!caching!!
DNS!Server
of!
www.example.com.

“”
com.
example.com.
local!caching!!
DNS!Server
what!are!the!names!
of!the!name!server(s)!
for!"com."?

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!a!list!of!
“com.”!Name!Servers

“”
com.
example.com.
local!caching!!
DNS!Server
what!are!the!name!
server(s)!for!
"example.com."?

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!a!list!of!
“example.com.”!Name!
Servers

“”
com.
example.com.
local!caching!!
DNS!Server
Here!is!the!address!of!

Decreasing!Access!Time!to!Root!Servers!by!Running!
One!on!Loopback!-!draft-ietf-dnsop-root-loopback
•a!local!copy!of!the!root-zone!can!greatly!speed!
these!queries!and!to!hide!them!from!outsiders!
•esp.!queries!that!get!negative!answers!
•document!shows!how!to!start!and!maintain!such!a!
copy!of!the!root!zone!that!does!not!pose!a!threat!to!
other!users!of!the!DNS!
•at!the!cost!of!adding!some!operational!fragility!for!the!
operator.!
•design!not!considered!a!"best practice"
24

©!Men!&!Mice!!http://menandmice.com!25
DNS!resolver
Internet! 
root!"."
resolver!process
authoritative!DNS!server!
process
"."
127.0.0.53192.0.2.53
DNS!query
DNS!recursive!
lookup!for!TLD
Zone-!
transfer
draft-ietf-dnsop-root-loopback

DNS!Terminology! 
draft-hoffman-dns-terminology
•great!document!that!lists!and!defines!terms!used!
in!DNS!
•labels,!domains,!zones,!apex,!zone-cut!…!
•good!read!for!anyone!that!wants!to!understand!DNS!
related!RFC!documents
26

DNS!Meta-Queries!restricted 
draft-ogud-dnsop-acl-metaqueries
•DNS!"meta-queries"!of!type!"ANY"!have!been!used!
by!DNS!operators!for!troubleshooting!purposes!
•and!by!attackers!to!launch!DNS!reflection!attacks!
•very!little!software!uses 
!"ANY"!queries!
•Firefox!36!started!to!use 
"ANY"!queries!in!February 
2015
27
http://www.sidnlabs.nl/laatste-berichten/nieuwsdetail/article/firefox-and-the-mysterious-rise-of-any-queries/

•DNS!server!operators!measured!an!significant!
increase!of!DNS!queries!of!type!"ANY"!
•Webhoster!and!CDN!Cloudflare!announced!to!
stop!answering!DNS 
queries!of!type!"ANY"!
•the!IETF!DNSOPS!WG 
is!discussing!the! 
"right!way"!to!not 
answer!"ANY"!queries
28
https://bug1093983.bugzilla.mozilla.org/attachment.cgi?id=8574534

•the!proposed!solutions!were!discussed,!not!consensus!
reached!this!time!
•possible!way!to!not!answer!"ANY"!queries:!
•send!REFUSED!(will!not!be!cached)!
•send!NOTIMPL!(not!cached)!
•send!NODATA!
•send!NOERROR!with! 
some!data!
•send!empty!answer!with! 
TC-Flag!(forcing!TCP)
29
https://blog.cloudflare.com/deprecating-dns-any-meta-query-type/

Minimal!Incremental!Zone!Transfer!in!DNS!
draft-mekking-mixfr
•with!DNSSEC!signed!zones,!an!incremental!zone!
transfer!(IXFR)!can!be!larger!than!a!full!zone!
transfer!(AXFR)!
•MIXFR!(minimal!incremental!zone!transfer)!
•The!richer!syntax!of!MIXFR!allows!to!add!or!delete!
multiple!records!with!one!resource!record!(RR).!!
•MIXFR!is!DNSSEC!aware!thus!if!there!is!a!change!to!
RRset!it!knows!to!delete!the!covering!RRISG(s),!this!saves!
the!transmission!of!old!RRsigs.
30

special!domain!names
•The!.onion!Special!Use!Domain! 
(draft-appelbaum-dnsop-onion-tld)!
•Additional!Reserved!TLDs! 
(draft-chapin-additional-reserved-tlds) 
.corp!.mail!.work!
•".ALT"!Special!Use!Top!Level!Domain! 
(draft-wkumari-dnsop-alt-tld)
31

Aggressive!use!of!NSEC/NSEC3 
draft-fujiwara-dnsop-nsec-aggressiveuse
•generate!negative!responses!from!cached!NSEC(3)!
records!
•benefits!!
•shorter!latency!on!many!negative!responses!
•non-existent!TLD!queries!to!Root!DNS!servers!will!
decrease!
•helps!counter!"water!torture!attacks"!
•Unbound!"Proof!of!Concept"!implementation!exists
32

Operational!Problem!in!DNS!Servers 
draft-andrews-dns-no-response-issue
•some!"middleboxes"!(Firewall,!Load-Balancer)!block!EDNS!
queries!
•implementations!filter!unknown!EDNS!versions,!options!and!flags!
•hinders!deployment!of!new!EDNS 
functions!
•draft!documents 
issue!and!describes 
test!using!"dig"! 
(requires! 
BIND!9.11.x)
33

DANE
34

OPENPGPKEY!Record
35
DNSSEC!
Resolver
Authoritative!
DNS!Server!
example.com
Mail-Server
1)!user!writes!email!to!
"joe@example.com"
2)!mail!client!asks!for!OPENPGPKEY!
Record!for!"joe@example.com"
3)!auth!DNS!Server!sends!PGP!key
4)!DNSSEC!resolver!validates!RRSIGs
5)!PGP!key!data!with!AD-Flag!is!send!
to!client,!client!encrypts!email!msg

SMIMEA!Record
36
DNSSEC!
Resolver
Authoritative!
DNS!Server!
example.com
1)!user!A!receives! 
S/MIME!email!from!
"joe@example.com"
2)!mail!client!asks!for!SMIMEA!
record!in!DNS
3)!Auth.!DNS!server!returns!SMIMEA!record
4)!DNSSEC!resolver!validates!RRSIGs
5)!S/MIME!cert!hash!is!send!to!mail!
client,!mail!client!verifies!S/MIME!cert!
and!encrypts!reply!email

S/MIME!Cert!library!and!Thunderbird!
plugin
Verisign-Labs!published!a!programming!library!and!
a!Thunderbird-Plugin!(Proof-of-Concept)!for!using!
SMIMEA! 
records
37

OPENPGPKEY!example
38
# openpgpkey --output rfc carsten@menandmice.com
; keyid: 32FF496A344DAF05
0c8ff712f5c90d593fde66fcbb7c2675bf75ae8c572bfb9cc9d6c6df._openpgpkey.menandmice.com. IN OPENPGPKEY mQENBF…
SHA224!hash!
of!the! 
"local!part" 
!of!an!email!
address
delegation!
point
email!
domain
record!type
public!part!
of!an!PGP!
key

SMIMEA!example
39
0c8ff712f5c90d593fde66fcbb7c2675bf75ae8c572bfb9cc9d6c6df._smimecert.menandmice.com. IN SMIMEA 1 0 0 mQENBF…
SHA224!hash!
of!the! 
"local!part" 
!of!an!email!
address
delegation!
point
email!
domain
record!type
public!part!
of!an!S/
MIME!Cert!
or!hash
certificate!usage,!
selector,!matching!
type!(same!as!TLSA)

the!issue!with!hashing!the!local!part
Are!these!the!same!email!mailboxes?!
!! carsten.strotmann@menandmice.com
carstenstrotmann@menandmice.com
Carsten.Strotmann@menandmice.com
Carsten.strotmann+Inbox@menandmice.com!
only!the!mail-server!on!the!receiving!side!does!
know!!
!discussion!on!the!drafts!continues!in!the!DANE!WG
40

Using!DANE!to!associate!payment!information 
with!email!addresses 
draft-wiley-paymentassoc
A!payment!association!record!associates!an!Internet!
service!identifier!such!as!an!email!address!with!
payment!information!such!as!an!account!number!or!
Bitcoin!address!
55[..]7a._pmta.example.com. IN PMTA <payment association>
an!open!source!implementation!of!a!Bitcoin!wallet!
using!PMTA!records!exist
41

DHCP
42

new!RFCs!published!since!last!IETF
no!new!RFC!from!the!DHC!working!group!since!
IETF!91
43

DHCPv6!update 
draft-ietf-dhc-dhcpv6bis
the!update!draft!for!the!DHCPv6!protocol!gains!
shape!
Appendix!A!of!the!document!lists!all!major!changes!
from!the!current!DHCPv6!standard!
We!will!have!a!Webinar!on!the!new!DHCPv6!once!
the!new!standard!is!stable
44

IPv6/IPv4-sunset
45

published!new!RFCs!since!last!IETF
46
RFC Title Category
7421 Analysis of the 64-bit Boundary in IPv6 Addressing Informational
7422
Deterministic Address Mapping to Reduce Logging in
Carrier-Grade NAT Deployments
Informational
7428 Transmission of IPv6 Packets over ITU-T G.9959 Networks Standards Track
7411
Multicast Listener Extensions for Mobile IPv6 (MIPv6) and
Proxy Mobile IPv6 (PMIPv6) Fast Handovers
Experimental

Close!encounters!of!the!ICMP!type!2!kind!!
(near!misses!with!ICMPv6!PTB) 
draft-ietf-v6ops-pmtud-ecmp-problem
Path!MTU!Discovery!and!delivery!of!ICMPv6!"Packet
too big"!messages!can!be!broken!on!load-balancing!
(equal-cost!multi-path![ECMP]!routing)!or!anycast!
deployments!
•as!ICMPv6!does!not!have!"ports",!the!hashing!functions!
used!in!load-balancers!to!provide!server!"stickiness"!does!
not!work!
Cloudflare!Blog!"Path MTU discovery in practice" 
https://blog.cloudflare.com/path-mtu-discovery-in-practice/
47

HTTP!State!Management!Mechanisms!with!Multiple!
Addresses!User!Agents 
draft-vyncke-v6ops-happy-eyeballs-cookie
•Websites!sometimes!store!the!IP!address!of!a!client!
as!a!security!token!to!create!a!session!and!to!prevent!
session!hijacking!
•this!creates!an!issue!with!dual-stack!hosts,!hosts!with!
multiple!interfaces!or!changing!IPv6!addresses!or!IPv4!CGN!
•the!same!client!might!reach!the!server!from!different!
IP[v4|v6]!addresses!
•the!server!terminates!the!session,!falsely!detecting!a!
session!hijacking
48

•draft!documents!issue!and!discussed!mitigation!
options!
•Multipath!TCP!RFC6824!
•HTTP/2!(Hypertext!Transfer!Protocol!version!2!-!draft-
ietf-httpbis-http2)!
•NOT!to!link!any!HTTP!state!management!(including!
cookies)!to!any!IP!address!(requires!other!means!to!
protect!against!session!hijack)
HTTP!State!Management!Mechanisms!with!Multiple!
Addresses!User!Agents 
draft-vyncke-v6ops-happy-eyeballs-cookie
49

•IPv6!deployment!in!India,!with!MAP-T!trials 
http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-1.pdf!
•JPNE!MAP-E!Deployment 
http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-2.pdf!
•MAP-T!and!MAP-E!deployment!in!CERNET!and!
China!Telecom 
http://www.ietf.org/proceedings/92/slides/slides-92-v6ops-3.ppt
MAP-E!and!MAP-T!deployments
50

don't!miss!our!next!webinar
•DNSSEC!best!practices,!Tuesday,!28th!April!2015!
•DNSSEC!and!Denial-of-service!attacks!
•selecting!crypto!algorithms!and!key-length!
•DNSSEC!key-rollover:!why,!when,!how!
•NSEC!or!NSEC3?!
•DNSSEC!monitoring!
•DNSSEC!literature!recommendations!
•Signup!@! 
https://www.menandmice.com/resources/educational-resources/webinars/dnssec-best-practices-webinar/
51

Q/A
52
?
2015!Schedule,!Slides,!Links,!Recording!and!errata!
can!be!found!@ 
https://www.menandmice.com/resources/educational-resources/webinars/

IETF 92 Webinar

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (14)

Semelhante a IETF 92 Webinar

Semelhante a IETF 92 Webinar (20)

Mais de Men and Mice

Mais de Men and Mice (10)

Último

Último (20)

IETF 92 Webinar