Subject: [secdir] SECDIR review of draft-ietf-dnsop-root-loopback-03

From: Matthew Lepinski <[email-masked]>
Date: Sun, 13 Sep 2015 20:08:03 -0400

I have reviewed this document as part of the security directorate’s
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments
just like any other last call comments.

This draft is essentially ready for publication (with minor comments below).

This is an Informational document that specifies how the operator of a
recursive resolver could run a copy of the root zone on a loopback
interface. The purpose of this mechanism are two-fold: (1) to speed
response time in the case of a negative response from the root zone; (2) to
hide queries to the root zone from malicious observers.

The security story for this mechanism is essentially:
A) Since this mechanism must be run on a loopback interface, there is
no possibility that the mechanism will negatively impact other entities.
(I.e., it would be bad if a recursive resolver started giving authoritative
answers for the root zone to anyone other than itself.)
B) DNSSEC is used to ensure that the answers provided by this mechanism are
valid.

The security considerations section for this document is somewhat terse and
I believe the document could be improved by expanding that section. In
particular, I believe that point (A) above should be stated explicitly in
the security considerations section. (That is, it is stated elsewhere in
the document that using a loopback mechanism is essential. However, I think
that repeating that in the security considerations section would be helpful
-- I think that point is an important part of the story for why this
mechanism doesn't break things.)

Additionally, in the security considerations section, the authors are
somewhat brief in describing the need for DNSSEC. I think that is fine, but
given the brevity, I think it would be helpful to have a citation to
another document that describes why DNSSEC is needed. (Is RFC 4033 the best
reference regarding what DNSSEC protects against? Or is there a better
document now?)

- Matt Lepinski

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 14 Sep 2015 08:17:56 -0700

Thanks! We have made these changes in the pre-draft of -04. If the ADs 
want us to publish this before the IESG review, we can; otherwise, we'll 
wait until after the IESG review to release them.

--Paul Hoffman

       <t>A system that does not follow the DNSSEC-related requirements 
given
       in <xref target="reqs"/> can be fooled into giving bad responses 
in the
       same way as any recursive resolver that does not do DNSSEC 
validation on
       responses from a remote root server. Anyone deploying the method
       described in this document should be familiar with the 
operational benefits
       and costs of deploying DNSSEC <xref target="RFC4033"/>.</t>

       <t>As stated in <xref target="intro"/>, this design explicitly 
only allows
       the new root zone server to be run on a loopback address, in 
order to
       prevent the server from serving authoritative answers to any 
system other
       than the recursive resolver. This has the security property of 
limiting
       damage to any other system that might try to rely on the copy of 
the root
       in case that copy becomes altered.</t>

---

From: joel jaeggli <[email-masked]>
Date: Mon, 14 Sep 2015 10:44:46 -0700

> wait until after the IESG review to release them.

It's fine by me if you do that. no reason not to be dicsussing the
latest version so long as we have a few days between the update and the
review call.

thanks
joel

>       described in this document should be familiar with the operational
> benefits
>       the new root zone server to be run on a loopback address, in order to

---

From: "Paul Hoffman" <[email-masked]>
Date: Mon, 14 Sep 2015 10:46:13 -0700

> latest version so long as we have a few days between the update and the

OK, we'll do a new rev soon then.

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Mon, 14 Sep 2015 18:22:55 -0400

Thank you Paul for taking care of this...

W

On Monday, September 14, 2015, Paul Hoffman <[email-masked]> wrote:

> _______________________________________________
> secdir mailing list
> [email-masked] <javascript:;>
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>

-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf