1. DNS SD Privacy Christian Huitema, Daniel Kaiser
IETF 97, Seoul, November 17, 2016
draft-ietf-dnssd-privacy-00
draft-ietf-dnssd-privacy-00

2. Changes in content from IETF 96
Removed the confusing “simple design”
Text was confusing, “we could do this, but we won’t, do that instead.”
Focus instead on the “two-step” solution:
Publish the “private discovery service” using DNS-SD and obfuscated names
Private discovery service uses DNS over TLS, secured with a mutually authenticated pairwise shared secret (PSK).
Fixed a bunch of small issues in the text
E.g., the two-step solution does in fact defend against fingerprinting.
Moved “pairing” specification to separate draft
Still rely on PSK established through pairing process
draft-ietf-dnssd-privacy-00

3. Discuss: simple fix to scaling issues
Current: Advertise hints of the form Hash(nonce, PSK)
Potential cost is O(N*M),
N: number of pairings per machine
M: number of servers in the network
Suggested fix: compute only once per interval, e.g. 5 minutes
Nonce = 32 bit Unix time, rounded to “interval”
Servers compute N hashes per interval, based on server’s pairings
Clients compute N hashes per interval, based on client’s pairings
Clients perform M simple “hash comparisons” per query
Simple implementation: set 24 bit nonce as Unix time >> 8
Feedback?
draft-ietf-dnssd-privacy-00

4. draft-ietf-dnssd-privacy-00
Process and Next steps
Adoption call passed
Draft is now: draft-ietf-dnssd-privacy-00
Need implementation experience
Working on it with Get DNS team
Anybody else?
Report on implementation and last call before IETF 98?
draft-ietf-dnssd-privacy-00