Subject: [spfbis] Draft agenda for IETF83

From: SM <[email-masked]>
Date: Wed, 14 Mar 2012 10:40:38 -0700

Hello,

This is a tentative agenda for the IETF83 session:

SPF Update Working Group Agenda

March 30, 2012 09:00 - 11:00              120 minutes

     Note well                               1 minute
     Agenda bashing                          4 minutes
     RFC 4408 issues                        35 minutes
     SPF RR Type and TXT RR (issue #9)      20 minutes
     DNS amplification attacks              20 minutes
     Adoption of draft describing the       30 minutes
      SPF/Sender-ID experiment and
      discussion
     Any Other Business                     10 minutes

http://www.ietf.org/proceedings/83/agenda/agenda-83-spfbis.txt

Regards,
S. Moonesamy
SPFBIS WG co-chair

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 14 Mar 2012 14:38:48 -0400

On Wednesday, March 14, 2012 10:40:38 AM SM wrote:
...
>      DNS amplification attacks              20 minutes
...

I think this would be a waste of the group's time.

Scott K

---

From: "John Levine" <[email-masked]>
Date: 15 Mar 2012 00:14:53 -0000

>I think this would be a waste of the group's time.

Agreed.  I'm only aware of one person who thinks that this is an
important issue, and although he is very persistent, after years of
effort he has attracted no support for his position.

R's,
John

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Mar 2012 14:17:22 -0400

Dear colleagues,

> I think this would be a waste of the group's time.

John Levine sent a similar remark.

Do people have other things they want on the agenda?  There was little
feedback apart from these two suggestions.  We plan to alter the
agenda, and if there are other changes people want I'd like to hear
them.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Dotzero <[email-masked]>
Date: Mon, 19 Mar 2012 14:23:24 -0400

> agenda, and if there are other changes people want I'd like to hear

Andrew, I will not be able to make it in person but I would like to
concur with Scott and Jown with regard to DNS amplification attacks.
his was first raised by Doug 7-8 years ago and we have not seen any
instances of this hypothetical abuse in the wild. As John pointed out,
despite Doug vocally asserting this as a significant issue, he has not
attracted significant (I was going to say any) support within the
community of folks actively working in this space.

Mike

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 19 Mar 2012 18:29:30 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Andrew Sullivan
> Sent: Monday, March 19, 2012 11:17 AM
> To: [email-masked]
> Subject: Re: [spfbis] Draft agenda for IETF83
> 

I can't think of any other topics that need face-to-face time except maybe a quick summary of where we are on each of the tickets in the tracker (quick, I said!).  The remaining time allocated to DNS attacks could be split between talking about what to put in the experiment document and the type 99 discussion/debate/détente/fiasco.

-MSK

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 19 Mar 2012 14:51:21 -0400

No hat.

Dear colleagues,

On Mon, Mar 19, 2012 at 02:23:24PM -0400, Dotzero wrote:

> instances of this hypothetical abuse in the wild.

I suggest to be very careful with this line of argument.  Dan
Bernstein identified outbound port predictability of DNS queries as a
vulnerability nearly 10 years before Kaminsky's much-discussed attack.
DJB's complaint was also dismissed as mostly theoretical.

It might be a stronger argument that other vectors of attack are
easier and more effective, however.  (I refuse to have an opinion on
the matter, though I have thought about it.)

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Dotzero <[email-masked]>
Date: Mon, 19 Mar 2012 15:01:27 -0400

> the matter, though I have thought about it.)

This has actually been a significant part of the response/discussion.
I plead guilty to knowing the history of the discussion and assuming
(a bad thing to do) that most others are also familiar (or have taken
the time to review the MARID and spf-discuss archives.

Mike

>
> Best,
>
> A
>
> --
> Andrew Sullivan
> [email-masked]
> _______________________________________________
> spfbis mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/spfbis

---

From: Scott Kitterman <[email-masked]>
Date: Mon, 19 Mar 2012 15:06:31 -0400

> the matter, though I have thought about it.)

Despite a large degree of skepticism about this type of attack, the SPF 
community did a serious analysis of the question several years ago:

http://www.openspf.org/draft-otis-spf-dos-exploit_Analysis

The conclusion (which I've seen no reason to step away from) is that the 
attack vector that Doug raises is extremely unlikely to ever materialize and 
in the event an attacker chose to do an attack similar to this one, there are 
significantly easier ways to do it.

If we can bolt on the void lookups limit (I've forgotten which issue # that 
one was) without affecting interoperability of current records (we'll need some 
survey results that we won't have for awhile, so no need to argue the point 
further now) then we should add it as an insurance policy/efficiency measure (it 
would give compliant receivers a way to stop processing bogus records sooner), 
but we should by no means regard it or removing per user policies as needed to 
make the protocol secure.

Scott K