DNS Related Stuff @ IETF 105

by sylph01

Slide 1

Slide 1 text

DNS Related Stuff @ IETF105 sylph01 (Ryo Kajiwara) DNS-Onsen 6

Slide 2

Slide 2 text

୭ʁ ֿݪ ཾ(sylph01) Twitter: @s01 ҉߸ͱ͔Ͱ͖·͢ TLSΑΓ্ͷ૚ DNS·ΔͰΘ͔ΒΜ

Slide 3

Slide 3 text

એ఻ "DNSDNS Resolution" ͳΔຊΛॻ͍ٕͯ ज़ॻయ6(ࠓ೥ͷ4݄)ʹ൦෍͠·ͨ͠ DNSʹର͢Δ߈ܸɺDNSϒϩοΩϯάɺ DNSSECɺDNS over TLS/HTTPS͋ͨΓ ͷɺDNSͷηΩϡϦςΟɾϓϥΠόγʔ ʹؔΘΔτϐοΫΛѻ͍ͬͯ·͢ ෺ཧ൛͸׬ച͠·͕ͨ͠ݟຊ͸͖࣋ͬͯ ͯ·͢ɻిࢠ൛͸ܧଓͯ͠൦෍த ϚαΧϦ͓଴͍ͪͯ͠·͢

Slide 4

Slide 4 text

એ఻ͦͷ2 ಉٕ͘͡ज़ॻయ4(ࡢ೥)ʹͯ "Dark Depths of SMTP" ͳΔຊΛग़͠·ͨ͠ ೔ຊޠͷ঎ۀͷSMTPͷຊ͸5೥Ҏ্ग़ͯ ͳ͍ϋζͳͷͰ͜ͷ෼໺ͷوॏͳup-to- dateͳຊͰ͢ SPF, DKIM, DMARC౳΋౰વΧόʔ͍ͯ͠ ·͢ ͪ͜Β΋෺ཧ൛͸׬ചɺిࢠ൛Λܧଓ͠ ͯ൦෍த ͳ͓౦ํཁૉ͸දࢴ͚ͩͰ͢

Slide 5

Slide 5 text

https:/ / cryptic- command.net

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

ͱ͍͏Θ͚Ͱ IETF105 (7/20-26) ߦ͖ͬͯ·ͨ͠ (ࠓճॳࢀՃ)

Slide 8

Slide 8 text

ߦͬͨओͳ໨తͰ͋Δͱ͜Ζͷ Messaging Layer Securityͷ࿩͸ผͷ ͱ͜ΖͰ͠Ό΂ͬͨͷͰҎԼࢀর https://bit.ly/2LuvrAv

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

ANRW (Applied Network Research Workshop)

Slide 11

Slide 11 text

Who Is Answering My Queries: Understanding and Characterizing Interception of the DNS Resolution Path ύϒϦοΫDNSαʔόʔͱͷ௨৴Λinterceptͯ͠ҟͳΔIPΞυϨε Λฦ͍ͯ͠Δon-path deviceͷଘࡏͱͦͷಛ௃Λେن໛ଌఆʹΑΓ ໌Β͔ʹͨ͠ɺͱ͍͏ݚڀɻ શੈքͰ7.36%ɺதࠃࠃ಺Ͱ17.13%ͷAS͕͜ͷΑ͏ͳinterceptionΛ ߦ͍ͬͯΔͱͷ͜ͱɻ

Slide 12

Slide 12 text

Who Is Answering My Queries(ry Կ͕ى͜Δ͔͸ https:/ /labs.ripe.net/Members/babak_farrokhi/is- your-isp-hijacking-your-dns-traffic ͷهड़͕Θ͔Γ΍͍͢ɻ http:/ /whatismydnsresolver.com/ Ͱࣗ෼ͷ؀ڥʹ͍ͭͯ஌Δ͜ͱ͕ Ͱ͖Δʢ͜Ε͸ݚڀνʔϜ͕༻ҙͨ͠΋ͷʣɻ

Slide 13

Slide 13 text

Who Is Answering My Queries(ry • Global analysis: TCP SOCKSΛ࢖ͬͨproxy networkͰଟ਺ͷIPΞυ Ϩε͔Βͷ௨৴ΛࢼΈΔ • ϞόΠϧϢʔβʔ޲͚ͷωοτϫʔΫσόοάπʔϧΛ։ൃ͠ ͍ͯΔձࣾͱڞಉݚڀɺ͜ΕʹΑͬͯUDPͰͷDNS௨৴΋ଌఆ Մೳʹ

Slide 14

Slide 14 text

Oblivious DNS: Practical Privacy for DNS Queries ݱߦͷDNSͰ͸recursive resolver͕ϢʔβʔͷϓϥΠόγʔʹؔΘ Δ৘ใͷଟ͘ΛऩूͰ͖ΔɻύϒϦοΫDNS΋τϥετΛ൴Βʹ ҕͶΔ͚ͩͰղܾʹͳ͍ͬͯͳ͍ɻ ͜ͷఏҊͰ͸ݱߦͷΠϯϑϥͱޓ׵ੑͷ͋Δํ๏ͰϢʔβʔͷݸ ਓಛఆ৘ใΛΫΤϦ಺༰͔Β෼཭͢Δɺͱ͍͏͜ͱΛࢼΈ͍ͯ Δɻ

Slide 15

Slide 15 text

Oblivious DNS ʮDNSͰDNSΛτϯωϦϯά͢Δʯํ๏ΛऔΔɻ • ελϒϦκϧόʔ͸υϝΠϯΛ҉߸Խͨ͠ϑΥʔϚοτʹม׵ • recursive resolverͰ͸ΫΤϦͷ࣮ࡍͷத਎͸ݟΕͳ͍ • Ϣʔβʔͷidentity͸ݟΕΔ • ODNS authoritative server͕࣮ࡍͷrecursive resolverͷ໾ׂΛՌͨ ͢ • ͜͏͢ΔͱODNSͰ͸Ϣʔβʔͷidentity͸ݟΕͳ͍

Slide 16

Slide 16 text

No content

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

Oblivious DNS ύϑΥʔϚϯε͸Ͳ͏ͳΔͷʁ • ҉߸ԽͷΦʔόʔϔου͸ରশ伴҉߸ͳͷͰ1-2ms • ODNS resolver΁ͷϨΠςϯγ͕֤ΫΤϦͰ௥Ճ͞ΕΔ • CDNΛ࢖ͬͯanycastͰେن໛ʹσϓϩΠ͢Δ͜ͱͰWANϨΠ ςϯγΛ࡟ݮͰ͖Δ • ͨͩ͠anycastͰ΍ͬͯ͠·͏ͱ҉߸伴഑෍ͷ໰୊͕ൃੜ͢Δ • Ωϟογϡ͕ޮ͖ʹ͍͘ͱ͍͏໰୊͸ى͜Δ

Slide 19

Slide 19 text

Analyzing the Costs (and Benefits) of DNS, DoT, and DoH for the Modern Web DoH͕Do53ΑΓ଎͍͜ͱ͕͋ΔɻͳΜͰʁ • DNS wire formatͷHTTP cachingʹΑΔޮՌ • lossy networkͰ͸TCPͷ࠶ૹ੍ޚͷ͓͔͛ͰDoT/DoH > Do53

Slide 20

Slide 20 text

What Can You Learn from an IP? (Measurement and Optimisation͔Β) DNSΫΤϦͷϦΫΤετ/Ϩεϙϯε͸DoH/DoTɺSNI͸Encrypted SNIɺαʔόʔূ໌ॻ͸TLS 1.3Ͱ҉߸Խ͞ΕΔΑ͏ʹͳͬͨɻ߈ܸ ऀ͕ݟΕΔͷ͸IPͷΈɻͰ͸IP͸߈ܸऀʹϢʔβʔಛఆͷͨΊͷ͍ ͔ͳΔ৘ใΛఏڙ͢Δͷ͔ʁ -> ͚ͬ͜͏͍ΖΜͳ͜ͱ͕Θ͔Δɻ rDNSͰ͸େͨ͠৘ใ͕ಘΒΕͳ͍ͷͰɺେن໛ΫϩʔϦϯάͰIP → υϝΠϯͷϚοϐϯάΛ࡞Δɻ

Slide 21

Slide 21 text

What Can You Learn from an IP? • 47.6%ͷIP͸anonimity set(1 IPʹର͍͍ͯͭͯ͠ΔυϝΠϯͷू ߹)ͷαΠζ͕1 • ࠷େͷanonimity setͷαΠζ͸16000+ • αΠτϢχʔΫͳIPΞυϨε͸68% • ϖʔδϩʔυ࣌ʹಡΈࠐΉIPΞυϨεͷηοτΛऔಘ͢Δ͜ͱ Ͱ͞ΒʹಛఆΛਐΊΒΕΔ • ରࡦ: ϗεςΟϯάΠϯϑϥͷมߋɻCDNͷIPΞυϨεͷϥϯμ ϜԽͳͲɻ

Slide 22

Slide 22 text

What Can You Learn from an IP? ݸਓతʹڵຯਂ͍ͱࢥͬͨ͜ͱ͸ʮIPv4ރׇରࡦͷͨΊʹIPv6ɺ SNIཁΒͳ͍ʯΛશྗͰਪ͠ਐΊΔͱAnonimity Set 1ͷIPΞυϨε ͩΒ͚ʹͳͬͯ͠·͍ɺIPΞυϨεͰͷfingerprinting͕༰қʹͳͬ ͯ͠·͏͜ͱɺ·ͨͦͷͨΊSNIͷॏཁੑ͸IPv4ރׇରࡦΑΓ΋ϓ ϥΠόγʔʹγϑτ͍ͯ͠ΔՄೳੑ͕͋Δɺͱ͍͏͜ͱɻ

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

dnsop

Slide 25

Slide 25 text

interoperable dns server cookies https:/ /datatracker.ietf.org/doc/draft-sury-toorop-dnsop-server- cookies/ DNS Server Cookies͸ʢݶఆతͰ͸͋Δ͕ʣ૿෯߈ܸɺύε֎ͷ ΩϟογϡϙΠζχϯάͳͲʹରͯ͠ରࡦΛఏڙ͢Δ࢓૊Έɻຊ ౰ʹ༗༻ʹͳΔͨΊʹ͸ଟ͘ͷαʔόʔ͕ಋೖ͢Δඞཁ͕͋Δɻ Αͬͯ͜ΕΛαʔόʔؒͰinteroperableʹ͍ͨ͠ɻ

Slide 26

Slide 26 text

ANAME https:/ /datatracker.ietf.org/doc/draft-ietf-dnsop-aname/ "CNAME on apex"ͱͯ࢝͠·͕ͬͨɺ"Address-specific DNS aliases"ͱ͍͏υϥϑτ໊ɻapexυϝΠϯ໊ΛaliasʹͰ͖Δɻ CNAMEͱ͸ҟͳΓଞͷϨίʔυλΠϓͱڞଘՄೳɻ httpssvcͱ໾ׂͷ੗Έ෼͚ΛͪΌΜͱ্ͨ͠Ͱsimplifyɺͦͷ্Ͱ WGLCɻ

Slide 27

Slide 27 text

HTTPSSVC HTTPS઀ଓͷࡍʹඞཁͳ৘ใΛͻͱ·ͱΊʹͨ͠Ϩίʔυ͕ཉ͠ ͍ • Encrypted SNIͷͨΊͷ伴 (-> ESNI DNSϨίʔυ) • HTTP/2͋Δ͍͸HTTP/3Ͱ௨৴ՄೳͰ͋Δͱ͍͏͜ͱΛࣔ͢Alt- svc (-> HTTPϨεϙϯεϔομ౳ʹؚ·ΕΔ) • ...

Slide 28

Slide 28 text

HTTPSSVC example.com. 2H IN HTTPSSVC 0 0 svc.example.net. svc.example.net. 2H IN HTTPSSVC 1 2 svc3.example.net. "hq=\":8003\" \ esnikeys=\"...\"" svc.example.net. 2H IN HTTPSSVC 1 3 svc2.example.net. "h2=\":8002\" \ esnikeys=\"...\"" (subtyping͋Δͷ͸࣮૷্໘౗ͳͷͰ͸…ʁ৽͍͠ϑΥʔϚοτ͕ ௥ՃͰ͖Δͱ͸͍ͬͯ΋ઈରʹαϙʔτ͞Εͳ͍ɻྫͱͯ͠ DNSKEY)

Slide 29

Slide 29 text

RDBD https:/ /datatracker.ietf.org/doc/draft-brotman-rdbd/ related domains by dns υϝΠϯͷؔ࿈ͷ༗ແΛࣔ͢ dnssec-likeͳsignature RDBD RRtype

Slide 30

Slide 30 text

DNS Resolver Information Self-Publication https:/ /datatracker.ietf.org/doc/draft-ietf-dnsop-resolver-information/ looking for WG adoption -> WGʹadopt͞Εͨɻ DoHΤϯυϙΠϯτ͕ͲͷΑ͏ʹৼΔ෣͏͔Λࣔ͢৘ใΛඪ४త ͳํ๏Ͱ஌Γ͍ͨɻDNS Resolver͕ͦͷ৘ใΛࣗΒࠂ஌Ͱ͖Δɻ

Slide 31

Slide 31 text

Avoid Fragmentation https:/ /datatracker.ietf.org/doc/draft-fujiwara-dnsop-avoid- fragmentation/ JPRSͷ౻ݪઌੜΑΓɻΑΓϑϥάϝϯςʔγϣϯʹڧ͍TCP͕࢖͑ ͳ͍৔߹ɺEDNS0ͷUDPϖΠϩʔυαΠζΛ1220(= RFC 4035ͷ࠷ ௿஋)ʹͯ͠ϑϥάϝϯςʔγϣϯ͕ى͖ͳ͍Α͏ʹ͠Ζɺͱ͍͏ ಺༰ɻ

Slide 32

Slide 32 text

draft-krecicki-dns-covert-00 "Domain Name System (DNS) Resource Record types for transferring covert information from primary to secondaries" ΫΤϦ͞ΕΔ΂͖Ͱͳ͍৘ใ(nsec5 keys, zsk for inline signing, ...)Λ primary͔Βsecondaryʹzone transfer͢ΔͨΊͷํ๏ͷఏҊɻυϝ ΠϯϨίʔυͷಋೖΛఏҊ͍ͯ͠Δ͕ɺͿͬͪΌ͚DNS RRͰ΍Δ ͳɺͱ͍͏ҙݟ͕ڧ͍ɻ

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

add (Applications Doing DNS) DoH/DoTʹؔ͢Δ͍Ζ͍ΖͳBoFɺͿͬͪΌ͚ͱͬࢄΒ͔ͬͯͨɻ • DoHͷσϓϩΠͲ͏͢΂͖ʁBCP࡞Δʁ • Ͳͷάϧʔϓ͕͜ͷ΁Μ΍Δͷʁ • DNSOPͰ΍Εɺ͚ͩͲ͜Εͬͯ"ops"͚ͩͬͨͬ • DNSOP͕࣮࣭DNS WGͱԽͯ͠ΔͷͰϦϑΝΫλϦϯά͕ඞ ཁͳͷͰ͸

Slide 1

Slide 1 text

Slide 2

Slide 2 text

Slide 3

Slide 3 text

Slide 4

Slide 4 text

Slide 5

Slide 5 text

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

Slide 9

Slide 9 text

Slide 10

Slide 10 text

Slide 11

Slide 11 text

Slide 12

Slide 12 text

Slide 13

Slide 13 text

Slide 14

Slide 14 text

Slide 15

Slide 15 text

Slide 16

Slide 16 text

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Slide 21

Slide 21 text

Slide 22

Slide 22 text

Slide 23

Slide 23 text

Slide 24

Slide 24 text

Slide 25

Slide 25 text

Slide 26

Slide 26 text

Slide 27

Slide 27 text

Slide 28

Slide 28 text

Slide 29

Slide 29 text

Slide 30

Slide 30 text

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

Slide 36

Slide 36 text

Slide 37

Slide 37 text

Slide 38

Slide 38 text

Slide 39

Slide 39 text

Slide 40

Slide 40 text