Subject: Re: [Mud] Unique credentials for devices in a home network

From: Ad Bresser <[email-masked]>
Date: Wed, 5 Jun 2019 13:33:32 +0000

Hi,

> Subject: Re: [Mud] Unique credentials for devices in a home network
> 
>    mcr> Do we need to write an Operational BCP for IoT and DNS here?
>
> tirumal reddy <[email-masked]> wrote:
>    > Yes, looks useful to me.
>
> could there be someone else who wants to write this?

To save some writing time: 
The ICANN SSAC (Security and Stability Advisory Committee), published:
SAC105 The DNS and the Internet of Things: Opportunities, Risks, and Challenges
https://www.icann.org/en/system/files/files/sac-105-en.pdf   

Kind regards, 

Ad Bresser

---

From: Michael Richardson <[email-masked]>
Date: Wed, 12 Jun 2019 17:35:40 -0400

Ad Bresser <Ad.Bresser=[email-masked]> wrote:
    mcr> Do we need to write an Operational BCP for IoT and DNS here?

    > https://www.icann.org/en/system/files/files/sac-105-en.pdf

I read through it.
I think that it is too positive about DoH:
   "As a result, it becomes more difficult to trick IoT devices into using a
   malicious resolver.

This is kinda true.
It also makes it hard to substitute a resolver that provides some filtering,
or answers local names correctly, or which does not expose one's lookups to
third party, if the IoT manufacturer has locked in the certificate of the DoH
resolver.

This is useful background, and should be referenced, but I don't think it
goes to core of how to do DNS well from an IoT device such that MUD can work
well.

From section 5, it says:

> The challenges we identified are:
> * Developing a DNS library for IoT devices (Section 5.1) that makes the
> DNS’s security functions (e.g., DNSSEC validation and DoH/DoT) available
> for device control applications and that uses DNS query data to make IoT
> deployments more transparent for users (Sections 3.1, 3.2, and 3.4).

It seems that ICANN might want to do development work here?

> * Training IoT and DNS professionals (Section 5.2) to help DNS players such
> as registrars and registrants understand the implications of providing
> services for domain names that act as a backend for IoT devices rather than
> as a means for making content available to humans (Section 3.3), and to
> help IoT device manufacturers understand how to use the DNS and how to
> configure resolvers (Sections 4.1 and 4.3).

I think that there is a missing element here, which is talking about DNS at
IoT conferences, about the libraries one can use, but most importantly, about
how to do DNS in a way that makes MUD easier to do.

There is also a need to reach out to the CDN community, and deal with the
question of names to IP mapping, and how we make sure that the name provides
the service requested, and only that service.

> * Developing a shared system that enables different DNS operators to
> automatically and continually share information on IoT botnets (Section
> 5.3), allowing them to more quickly respond to rapidly growing botnets and
> the DDoS attacks they generate (Section 4.2).

I see we get mentions:
  Examples of
  security systems for edge networks are SIDN Labs’ SPIN system [48], CIRA’s secure home
  gateway [59], and IIT/CNR’s NTOP system [60].

but, then I see that Jacques is a contributor!

> * Developing systems that enable DNS operators to share DDoS handling
> capacity and that stop attacks in an early stage in edge networks (Section
> 5.4), so DNS operators can better handle very large (amplified) IoT-powered
> DDoS attacks (Sections 4.2 and 4.3).

> * Developing a system that enables DNS operators to measure how the IoT
> uses the DNS (Section 5.5), to better understand how IoT risks evolve
> (Section 4)—for instance to develop new domain name policy or for incident
> response purposes.