Subject: [apps-discuss] review request

From: Jitendra Lulla <[email-masked]>
Date: Mon, 6 Apr 2015 05:13:26 +0000 (UTC)

Hi,
Please ignore if you have already received this mail. I am re-sending as my previous mail got blocked. 
I am writing this mail to request you to please provide me with the group emails where I can send my internet draft URL:            http://www.ietf.org/internet-drafts/draft-jlulla-whois-ip-validation-00.txt

The document is about querying the whois server with (1. a hostname and 2. local dns provided IP for this hostname)  and expecting a response from the whois server about how probable is the validity of the given pair (name, IP) is. 
This is in new state and I am not sure how I can find/request people to review and provide their useful comments on it.
So please advise me which working group this document should be sent for review.
Or if this group ie appsawg is appropriate, please review the document and provide the comments.
The document is about querying the whois server with (1. a hostname and 2. local dns provided IP for this hostname)  and expecting a response from the whois server about how probable is the validity of the given pair (name, IP) is. 
The need for this service is arising from the fact that a compromised DNS may lead to unintended connections. If before initiating the connection, if there exist a means to get a hint on the IP's association with its name, we may decide whether to proceed or not with the connection. This need is applicable for both plain as well as secure connections. For secure connections, though there exist a certificate based authentication method but still if the 
certificate has been signed by a rogue trusted CA, the client may end up having a connection with the server with that fake certificate.
Please copy my email [email-masked] if possible while responding using any ietf website. 
ThanksJitendra Lulla

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Mon, 6 Apr 2015 06:55:17 +0000

It sounds as if you have not heard of DNSSEC. Have a look at that, I 
think you may find that it provides a reasonable solution to your 
problem.

Arnt

---

From: John C Klensin <[email-masked]>
Date: Mon, 06 Apr 2015 04:51:46 -0400

--On Monday, April 06, 2015 06:55 +0000 Arnt Gulbrandsen
<[email-masked]> wrote:

> It sounds as if you have not heard of DNSSEC. Have a look at
> that, I think you may find that it provides a reasonable
> solution to your problem.

In addition, what you have described in your message and the I-D
[1] is unlikely to work because:

(1) Very few whois services are provided for domain names below
the second (or where structural subdomains are used, third)
level and, if those services were supported one would then have
a location and validation problem with them.

(2) Whois servers and databases for domain names rarely give out
information about hosts.  The only addresses usually provided
are those of the DNS servers for the relevant domains.
Sometimes those are in the same domains and address ranges as
actual hoses; very often, especially at the second level, they
are the addresses of DNS servers belonging to service providers
and tell one more about a registrar than about the specific
domains.  By contrast, queries of, e.g., regional registry whose
servers about addresses will yield ranges and owners but, except
for fairly large ("provider indepentent") allocations are more
likely to identify an ISP than to have any information
associated with the hosts you are interested in.

(3) While a Whois server can be configured to accept almost
anything (as long as the characters are NVT ASCII), they can't
return anything that is not in their databases.  As far as the
whois protocol is concerned, addressing a request to a
particular server for information about what you had for lunch
yesterday would be perfectly reasonable and, if the server
located has that information (and no privacy concerns about it),
that information could be returned.  But few, if any, whois
servers for, e.g., second-level domain names have the
information you are looking for and many registries and
registrars have protested very loudly, and then rejected and
refused, suggested requirements that they keep and provide data
to support much smaller changes to the services provided,
citing, among other things, privacy and the huge aggregate costs
involved, for the databases and interface changes.  Were your
approach adopted and used at even a few orders of magnitude
fewer times than the number of DNS queries, they would also be
concerned about costs and legitimately so (noting that the DNS
provides for caching, slave servers, and other ways to reduce or
distribute load and whois has no such provisions.

(4) In general, whois queries and responses, and whois servers
themselves, are as easily or more easily spoofed than DNS
queries, responses, and servers.  That is the case even without
DNSSEC; DNSSEC makes the difference much larger.  Your Security
Considerations section seems to suggest querying whois servers
by knowing their IP address, but gives no information about how
those addresses can be reliably and securely obtained.  

Something like this might have been a useful idea with an
Internet that was designed and structured around very
centralized administration and administrative databases.
However, the present Internet is very highly distributed
operationally and administratively.  Many people consider that a
strength but one of the side effects is to make a reliable
system of network informational and information-validating
servers quite difficult.

     john

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 6 Apr 2015 07:04:38 -0700

I hate to pile on, but:

> [1] is unlikely to work because:

(5) I don't think there are many operators interested in extending WHOIS,
which generally speaking no longer serves the community well for several
reasons.  The WEIRDS working group just finished development of RDAP which
appears to have the interest of both name and number registry operators
going forward.

-MSK