RFC 7830
The EDNS(0) Padding Option
RFC 7830: The EDNS(0) Padding Option 🎀
Okay bestie, this one is a Standards Track document from the IETF, so it's officially an Internet Standard. 💅 It was written by Alexander Mayrhofer of nic.at GmbH (Vienna, Austria) and published in May 2016. Its ISSN is 2070-1721. The title block doesn't list any documents it obsoletes or updates, so it's a standalone spec. ✨
Abstract 🦋
This doc is all about the EDNS(0) "Padding" option. It lets DNS clients and servers pad their request and response messages by a variable number of octets. Padding is how you make your messages look the same size, so nobody can read your life story from the lengths. 🙈
Status of This Memo 💜
This is an Internet Standards Track document. ✨
It's a product of the Internet Engineering Task Force (IETF), so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more info on Internet Standards, check Section 2 of RFC 5741. 📚
For the current status of this document, any errata, and how to give feedback, go to http://www.rfc-editor.org/info/rfc7830. 🌸
Copyright Notice 🌈
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. 🫶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as they stand on the publication date. Please actually read these, because they spell out your rights and restrictions for this doc. 💀 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License.
Table of Contents 🧚
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2
3. The "Padding" Option . . . . . . . . . . . . . . . . . . . . 3
4. Usage Considerations . . . . . . . . . . . . . . . . . . . . 3
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
6. Security Considerations . . . . . . . . . . . . . . . . . . . 4
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 4
7.1. Normative References . . . . . . . . . . . . . . . . . . 4
7.2. Informative References . . . . . . . . . . . . . . . . . 5
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 5
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 51. Introduction 🍓
So, the Domain Name System (DNS) [RFC1035] was originally built to send DNS messages in cleartext. 😭 That's a problem, because it can expose a ton of info about what an end user does online. The IETF is working on confidentiality for DNS transactions (check the DPRIVE working group). One of the big ideas is encrypting the DNS transport. ✨
But here's the tea: even if both the query and the response are encrypted, the metadata can still be used to match them up with well-known unencrypted messages. That totally undoes some of the privacy you got from encryption. One of those properties is the message size. 👀
This document specifies the Extensions Mechanisms for DNS (EDNS(0)) "Padding" option. It lets DNS clients and servers artificially increase the size of a DNS message by a variable number of bytes, so size-based correlation of encrypted messages gets way harder. It's giving main character energy. 👑
2. Terminology 🎀
The terms "Requestor" and "Responder" mean what they're defined to mean in [RFC6891]. 💅
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. ✨
3. The "Padding" Option 🦋
The EDNS(0) [RFC6891] mechanism lets you include new options in DNS packets. They go in the RDATA of the OPT meta-RR. This document defines the "Padding" option so clients and servers can pad DNS packets by a variable number of bytes. 🌸 The "Padding" option MUST occur at most, once per OPT meta-RR (and hence, at most once per message). No doubles, bestie. 🙅
Here's what the option looks like in the RDATA of the OPT RR (Figure 1):
0 8 16
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| OPTION-CODE |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| OPTION-LENGTH |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
| (PADDING) ... (PADDING) ... /
+- - - - - - - - - - - - - - - -
Figure 1The OPTION-CODE for the "Padding" option is 12. 🔥
The OPTION-LENGTH is the size (in octets) of the PADDING. The minimum number of PADDING octets is 0. 🧚
The PADDING octets SHOULD be set to 0x00. Other values MAY be used, for example, if the padded message might get compressed before encryption and that's a concern. 🌈 PADDING octets of any value MUST be accepted in received messages. So whatever's in there, don't be picky. 🫶
4. Usage Considerations 💜
This document doesn't pin down the actual amount of padding, because that depends on the situation you're using it in. ✨ Padded DNS messages MUST NOT exceed the number of octets in the Requestor's Payload Size field, which is encoded in the RR Class Field. Check Sections 6.2.3 and 6.2.4 of [RFC6891] for the details. 📚
Responders MUST pad DNS responses when the matching DNS query included the "Padding" option, unless doing so would violate the maximum UDP payload size. 🙈
Responders MAY pad DNS responses when the matching DNS query indicated EDNS(0) support from the Requestor and the "Padding" option was not included. 🦋
Responders MUST NOT pad DNS responses when the matching DNS query did not indicate EDNS(0) support. 🚫
5. IANA Considerations 🌸
IANA assigned Option Code 12 for "Padding" in the "DNS EDNS0 Option Codes (OPT)" registry. 🎀
IANA also updated that registration record: the Reference field now points to RFC 7830, and the Status field says "Standard". 💅
6. Security Considerations 💀
Okay, this part is serious, so listen up. 🫣
Padding DNS packets obviously makes them bigger, and that means more traffic. 😭
Padding is only useful when DNS packets are not sent in cleartext. Also, EDNS(0) padding might make DNS amplification attacks easier. So implementations MUST NOT use this option if the DNS transport is not encrypted. ⚠️
Padding without encryption is basically a waste, and it might even help attackers. Don't do it. 🚨
Padding length can be affected by lower-level compression. So, as described in Section 3.3 of [RFC7525], implementations and deployments SHOULD disable compression at the Transport Layer Security (TLS) level. 🔒
And finally, the payload of the "Padding" option could (like lots of other fields in the DNS protocol) be used as a covert channel. 👀
7. References 📚
7.1. Normative References 💖
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
November 1987, <http://www.rfc-editor.org/info/rfc1035>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC6891] Damas, J., Graff, M., and P. Vixie, "Extension Mechanisms
for DNS (EDNS(0))", STD 75, RFC 6891,
DOI 10.17487/RFC6891, April 2013,
<http://www.rfc-editor.org/info/rfc6891>.7.2. Informative References 🧠
[RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security
(DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
2015, <http://www.rfc-editor.org/info/rfc7525>.Acknowledgements 🫶
This document was inspired by a discussion with Daniel Kahn Gillmor during IETF 93, as an alternative to the proposed padding on the TLS layer. 🌈 Allison Mankin, Andreas Gustafsson, Christian Huitema, Jinmei Tatuya, and Shane Kerr suggested text for this document. Thank you, queens. 👑
Author's Address 🧚
Alexander Mayrhofer
nic.at GmbH
Karlsplatz 1/2/9
Vienna 1010
Austria
Email: alex.mayrhofer.ietf@gmail.com📦 where this page comes from
- ietf: rfc7830 2016-05
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms