Subject: [dnsext] [[email-masked]: [dns-dir] Heads up on a London BoF]

From: Andrew Sullivan <[email-masked]>
Date: Fri, 24 Jan 2014 21:12:05 -0500

Dear colleagues,

Please see Brian's note below.  It will be important to get people
with protocol expertise into this room.

A

----- Forwarded message from Brian Haberman <[email-masked]> -----

Date: Fri, 24 Jan 2014 08:31:19 -0500
From: Brian Haberman <[email-masked]>
To: IETF DNS Directorate <[email-masked]>
Subject: [dns-dir] Heads up on a London BoF
List-Id: IETF DNS directorate discussion list <dns-dir.ietf.org>

All,
    I have agreed to sponsor a BoF in London to look into adding
confidentiality to DNS.  The current description of the DNSE BoF is
available at:

http://trac.tools.ietf.org/bof/trac/wiki/WikiStart#Internet

I want to encourage the DNS protocol experts to participate in the BoF.
 The primary focus will be on discussing whether there are existing ways
to accomplish the goals described in the problem statement draft
targeted for the DNSOP WG.

If you have any questions, feel free to let me know.

Regards,
Brian

_______________________________________________
dns-dir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dns-dir

----- End forwarded message -----

-- 
Andrew Sullivan
[email-masked]

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 25 Jan 2014 13:53:49 +0100

Hi,

At least for IPv6, this is possible by using both asymetric and symetric
encryption. One solution might be the use of CGA-TSIG
(http://tools.ietf.org/html/draft-rafiee-intarea-cga-tsig  ). I wrote a
paper about it and called it CGA-TSIGe (e represents encryption)

How?

1- Client asks for a public key of the server
2- Server answers with his own public key that is binded to his IP address
3- Client encrypt a session key using the public key of the server and also
encrypt the whole message using this session key and also can generate a
signature and sign the whole message.
4- server receive this message and decrypt the session key using his own
private key and decrypt the whole message using this session key.

I also evaluted the encryption and decryption using a public key
cryptography. If the message size or the session key is small(less than 100
bytes) then the encryption is in microseconds.

Security Analysis of this approach
- Nobody can spoof the public key of the server since there is a binding
between this public key and the server's IP address
- It provides both data integrity and confidentiality

Disadvantage
- It only supports IPv6 since CGA or SSAS that is the main algorithm in this
approach is supported by IPv6

Smile,
Hosnieh
P.S. I would need to update the draft and will do this soon.  

> -----Original Message-----
> From: dnsext [mailto:[email-masked]] On Behalf Of Andrew Sullivan
> Sent: Saturday, January 25, 2014 3:12 AM
> To: [email-masked]
> Subject: [dnsext] [[email-masked]: [dns-dir] Heads up on a
London
> BoF]
> 
> Dear colleagues,
> 
> Please see Brian's note below.  It will be important to get people with
protocol
> expertise into this room.
> 
> A
> 
confidentiality
> to DNS.  The current description of the DNSE BoF is available at:
> 
to
> accomplish the goals described in the problem statement draft targeted for
> the DNSOP WG.
> 
> dnsext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dnsext