Question re prevention of enumeration with DNSSEC (NSEC3, etc.)

Hi NANOGers,

I have a small question re DNSSEC `proof of non-existence’ records: NSEC, NSEC3 and the (dead?) NSEC5 proposal.

<begin background (probably known to all/most):> NSEC3 was motivated as a method to prevent Zone enumeration, then Berenstein showed its defense is pretty weak. RFC7129 (White Lies) prevents this enumeration attack but requires online signing with the zone’s key, which introduces another vulnerability and, of course, overhead of online-signing. NSEC5 was proposed to prevent enumeration without online signing, so arguably more secure than RFC7129, but has comparable online overhead and appears `dead’; the I-D expired (last update July’17).

Note that NSEC3 also supports `opt-out’, which reduces overhead for adoptions in domains with many non-adopting ASes, and I believe is not supported by NSEC.

Questions:

  • Do you find zone enumeration a real concern?
  • Do you think the white-lies countermeasure is sufficient and fine, or do you have security and/or performance concern (or just think it’s pointless)?
  • and the final question… would you think an alternative to NSEC5 which will be more efficient and simpler would be of potential practical importance, or just a nice academic `exercise’?

I’m really unsure about these questions - esp. the last one - and your feedback may help me decide on the importance of this line of research. Just fun or of possible practical importance?

thanks and peace, Amir

Hi NANOGers,

I have a small question re DNSSEC `proof of non-existence' records: NSEC,
NSEC3 and the (dead?) NSEC5 proposal.

<begin background (probably known to all/most):> NSEC3 was motivated as a
method to prevent Zone enumeration, then Berenstein showed its defense is
pretty weak. RFC7129 (White Lies) prevents this enumeration attack but
requires online signing with the zone's key, which introduces another
vulnerability and, of course, overhead of online-signing. NSEC5 was
proposed to prevent enumeration without online signing, so arguably more
secure than RFC7129, but has comparable online overhead and appears `dead';
the I-D expired (last update July'17).

Note that NSEC3 also supports `opt-out', which reduces overhead for
adoptions in domains with many non-adopting ASes, and I believe is not
supported by NSEC.
<end background>

Questions:
- Do you find zone enumeration a real concern?

The answer to this would vary depending on who is asked, so it's not
clear how you would use such answers. It may be a concern to some, may
not be a concern to others.

If zone enumeration was not a real concern, NSEC3 would not
exist. However, public DNS is a public tree and so we should have
limited expectations for hiding names in it.

- Do you think the white-lies countermeasure is sufficient and fine, or do
you have security and/or performance concern (or just think it's
pointless)?
- and the final question... would you think an alternative to NSEC5 which
will be more efficient and simpler would be of potential practical
importance, or just a nice academic `exercise'?

I'm really unsure about these questions - esp. the last one - and your
feedback may help me decide on the importance of this line of research.
Just fun or of possible practical importance?

These questions may be better posed to the dnsop@ietf.org and
dns-operations@dns-oarc.net mailing lists, as you'll get more relevant
answers from people who work in the DNS industry.

    Mukund

A significant motivation was to help defend database copyright in the zone content, rather than to explicitly hide particular entries.

With NSEC it was simply too easy for a third party to produce an infringing copy of the registry's entire database.

Ray

I don’t think copyright can enter into it, by dint of the fact that registry data, being purely factual and publicly available, cannot be copyrighted.

On March 27, 1991, in a case that transformed the nascent online database publishing industry, the Supreme Court ruled unanimously that there is no copyright protection for purely factual products such as a telephone directory white pages.

The plaintiff in the case was Kansas Rural Telephone Service (KRTS) , and the defendant regional phone book producer Feist Publications Inc… Feist asked KRTS, which published its own “white pages” for its subscribers in Kansas, to purchase the right to use its local listings in compiling its broader regional directory. KRTS refused, but Feist used the information anyway, copying at least 1,309 names, towns and telephone numbers of KRTS subscribers. KRTS then filed a copyright infringement suit.

A basic principle of copyright law is that facts themselves cannot be copyrighted because they are not “original works of authorship.” However, compilations of facts can be copyrighted, under the 1976 copyright law, if they are “selected, coordinated or arranged in such a way that the resulting work as a whole constitutes an original work of authorship.” An example of a compilation copyright is an anthology of fiction stories, collected on a single theme based on author, topic, or some other relationship. The compilation of just those stories creates a new “original work”, albeit one that the author would still need a license from the individual story authors to create. An example of a modern infringing idea of a composite work is a “mix tape” of songs, collected without the original authors’ permission

SCOTUS’ opinion, authored by Justice Sandra Day O’Connor, said telephone directories – which do nothing more than list subscribers in alphabetical order – do not meet that test. Feist thus did nothing wrong, and needed no permission, or license, from KRTS. Feist could simply copy records from the KPRS listings and use them without paying one red cent to KRTS.

“It is not only unoriginal, it is practically inevitable,” the decision states. “This time-honored tradition does not possess the minimal creative spark required by the Copyright Act and the Constitution.”

SCOTUS then said a number of lower courts were wrong when they decided compilations, such as geographical sorting or other works, were entitled to copyright protection by a “sweat of the brow” test, in which the amount of effort that went into gathering and arranging the data is substantial.

Originality, not effort, is the “touchstone of copyright protection,” according to the decision, further stating that copyright “is not a tool by which a compilation author may keep others from using the facts or data he or she has collected.”

So it is certain that domain registry records, which are purely factual and publicly available, cannot be copyrighted.

They lack “originality”.

-mel

* mel@beckman.org (Mel Beckman) [Sat 07 May 2022, 18:38 CEST]:

I don’t think copyright can enter into it, by dint of the fact that registry data, being purely factual and publicly available, cannot be copyrighted.

I'm not a lawyer nor pretend to be one on the internet but Database Legal Protection (BitLaw) provides some nuance to that statement.

  -- Niels.

Actually, that source quotes the Feist decision. The rest of the discussion makes it pretty clear that domain registries are not copyrightable.

“Thus, a database of unprotectable works (such as basic facts) is protected only as a compilation. Since the underlying data is not protected, U.S. copyright law does not prevent the extraction of unprotected data from an otherwise protectable database. In the example of a database of presidential quotations, it would therefore not be a violation of copyright law to extract (copy) a quotation from George Washington from the database. On the other hand, it would be violation to copy the entire database, as long as the database met the Feist originality and creativity requirements.”

The key problem is that no domain registry meets the originality and creativity requirements set forth by SCOTUS in Feist.

I am not a lawyer either, but I have a lot of initials after my name, just like some lawyers that post on NANOG :slight_smile:

-mel beckman, ABC, ACM, DEF, PFL, MEL, SEL, IFR, A&P, X&Y, QWERTY, ASDFG, NANOG,and St. Anthony’s Elementary School Diploma

For some reason NANOG is quoting my original reply in base64 encoding. I did not specify that on my end, so I’m not sure what is going on here.

  -mel

I wasn’t talking about US law…

Ray

Ackchyually, that’s only partly true — a significant amount of the driver (some would say hte large majority) behind NSEC3 was that it supports “opt-out”. This was important in very large, delegation-centric zones (e.g like .com), where the vast majority of delegations were initially not signed. This allows just signing the signed delegation and the holes between them, and not all of the unsigned delegations.

This was also before things like passive DNS services existed, etc., and the “secrecy” of a zone was viewed more as an actual thing…

From RFC5155:
"A second problem is that the cost to cryptographically secure

delegations to unsigned zones is high, relative to the perceived

security benefit, in two cases: large, delegation-centric zones, and

zones where insecure delegations will be updated rapidly. In these

cases, the costs of maintaining the NSEC RR chain may be extremely

high and use of the “Opt-Out” convention may be more appropriate (for

these unsecured zones)."

Yes, +1, etc.!

W

But, with op-out, there're some security concerns around... so TL;DR generally you should avoid-it.

http://www.e-ontap.com/dns/entpoison.html

It appears that Ray Bellis <ray@bellis.me.uk> said:

On March 27, 1991, in a case that transformed the nascent online database publishing industry, the Supreme Court ruled unanimously that there is no

copyright protection for purely factual products such as a telephone directory white pages.

I wasn’t talking about US law…

Is there any case law where someone has asserted a database right for a DNS zone?

It seems like a rather stupid thing to do. If someone asserted such a
right, I would make sure not to infringe it by ensuring no entries
from that database entered my DNS caches or other software.

Also, I see that in a decision last year the ECJ required "substantial
extraction" also caused "significant detriment" to the investment in
the database. I'm having trouble coming up with a scenario in which copying
even the entire thing would impair the investment unless they are going to
assert that the structure of the names somehow gave away secrets about their
business plans.

R's,
John

Is there any case law where someone has asserted a database right for a DNS zone?

It seems like a rather stupid thing to do. If someone asserted such a
right, I would make sure not to infringe it by ensuring no entries
from that database entered my DNS caches or other software.

It wasn’t the zone itself as such - the concern was use of enumerated zone data to then perform bulk collection of Whois data.

Also, I see that in a decision last year the ECJ required "substantial
extraction" also caused "significant detriment" to the investment in
the database. I'm having trouble coming up with a scenario in which copying
even the entire thing would impair the investment unless they are going to
assert that the structure of the names somehow gave away secrets about their
business plans.

The detriment was scammers sending fake domain renewal notices.

Also, this was 15 or so years ago now…

Ray

Many of the ccTLD registries used to be more open about publishing zones and new registrations. Nominet, the .UK registry, took legal action against a few operations that were scraping its WHOIS. The gTLDs also had major issues with fake renewal notices.

Around 2003, many of the ccTLD registries in Europe subsequently went dark on publishing anything other than statistics. Many registrants, at the time, were being hit with directory invoice scams rather than renewal scams.

Outside the US, there has been an on-going shift to ccTLDs since about 2005. In many of these countries, the local ccTLD has more new registations each month than new registrations in gTLDs like .COM/NET/ORG.

With the gTLDs, the domain renewal scams still exist but they are far rarer now. The search engine submission scams seem to have taken over but they are also dependent on old WHOIS data and a lot of them disappeared in 2018 because of GDPR limiting WHOIS data. Some of the European ccTLDs now publish their zones or lists of registations as the legal framework has improved. Most no longer publish comprehensive WHOIS data.

Regards...jmcc

Is there any case law where someone has asserted a database right for a DNS zone?

German law has something to goes somewhat near it, although closer to
a mandate rather than a right:

Rubens

Rubens Kuhl wrote:

Is there any case law where someone has asserted a database right for a DNS zone?

German law has something to goes somewhat near it, although closer to
a mandate rather than a right:
FAQs for Domain Holders - DENIC eG

Similar regulation also exists in Japan. However...

Considering that, with a detailed map of a town, one can enumerate
addresses of all the houses in the town and owner information
of the houses can be obtained from land registry office operated
by government (I know complications in US on such registry), such
regulation is not very meaningful.

As privacy breach is caused by not enumeration but registry,
there is little, if any, reason to avoid enumeration.

Moreover, because making ownership information of lands and
domain names publicly available promotes public well fair
and domain name owners approve publication of such
information in advance, there shouldn't be any concern
of privacy breach forbidden by local law of DE.

            Masataka Ohta

It appears that Ray Bellis <ray@bellis.me.uk> said:

Is there any case law where someone has asserted a database right for a DNS zone?

It seems like a rather stupid thing to do. If someone asserted such a
right, I would make sure not to infringe it by ensuring no entries
from that database entered my DNS caches or other software.

It wasn’t the zone itself as such - the concern was use of enumerated zone data to then perform bulk collection of Whois data.

It's perfectly reasonable to claim a database right in the WHOIS data,
but the offense is scraping WHOIS, not enumerating the DNS zone.

I could enumerate the DNS zone twice a day every day and so long as I stayed
away from WHOIS, nobody would notice or care.

R's,
John

It's perfectly reasonable to claim a database right in the WHOIS data,
but the offense is scraping WHOIS, not enumerating the DNS zone.

I could enumerate the DNS zone twice a day every day and so long as I stayed
away from WHOIS, nobody would notice or care.

The zone file could be seen as an accessory to the database rip-off.
For instance, it would be hard to see such a dependency on Alexa 1M
top domains, since they are already enumerated. But some spam actors
deliberately compared zone file editions to single out additions, and
then harass the owners of newly registered domains, both by e-mail and
phone.

A wrench can be a tool or a weapon, depending on how one uses it.

Rubens

It appears that Rubens Kuhl <rubensk@gmail.com> said:

It's perfectly reasonable to claim a database right in the WHOIS data,
but the offense is scraping WHOIS, not enumerating the DNS zone. ...

The zone file could be seen as an accessory to the database rip-off.
For instance, it would be hard to see such a dependency on Alexa 1M
top domains, since they are already enumerated. But some spam actors
deliberately compared zone file editions to single out additions, and
then harass the owners of newly registered domains, both by e-mail and
phone.

Yeah, I know, and some of us download and diff zone files every day to
see what's new to track abuse trends. That doesn't annoy anyone other
than perhaps people whose phish campaigns it might disrupt.

Once again, the issue is WHOIS scraping, not the DNS.

R's,
John

Rubens Kuhl wrote:

But some spam actors
deliberately compared zone file editions to single out additions, and
then harass the owners of newly registered domains, both by e-mail and
phone.

If that is a serious concern, stop whois.

A wrench can be a tool or a weapon, depending on how one uses it.

The wrench is whois.

              Masataka Ohta

As I wrote:

But some spam actors
deliberately compared zone file editions to single out additions, and
then harass the owners of newly registered domains, both by e-mail and
phone.

If that is a serious concern, stop whois.

There are various ways, such as crawling the web, to enumerate
domain names.

For example, large companies such as google can obtain enumerated
list of all the current most active domains in the world, which
can, then, be used to access whois.

Hiding DNS zone information from public is beneficial to powerful
entities such as google.

As such

A wrench can be a tool or a weapon, depending on how one uses it.

The wrench is whois.

However, something like trust banks may be able to hide
privacy of domain name owners if such entities can be regulated
properly for people who want some privacy.

   Masataka Ohta