]> Orange

Rennes 35000 France mohamed.boucadair@orange.com

Nokia

India kondtir@gmail.com

Citrix Systems, Inc.

USA dwing-ietf@fuggles.com

ELVIS-PLUS

RU svan@elvis.ru

ipsecme security name resolution encryption service discovery naming resolver stub-resolver CPE Customer premise equipment VPN Secure discovery DoT DoH DoQ Tunnel connectivity This document specifies new Internet Key Exchange Protocol Version 2 (IKEv2) Configuration Payload Attribute Types to assign DNS resolvers that support encrypted DNS protocols, such as DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ).

This document specifies a mechanism to assign encrypted DNS configurations to an Internet Key Exchange Protocol Version 2 (IKEv2) initiator. Specifically, it assigns one or more Authentication Domain Names (ADNs) of DNS resolvers that support encrypted DNS protocols. The specific protocols supported are described using the Service Parameters format defined in ; supported protocols include DNS-over-HTTPS (DoH) , DNS-over-TLS (DoT) , and DNS-over-QUIC (DoQ) . This document introduces three new IKEv2 Configuration Payload Attribute Types () to add support for encrypted DNS resolvers. The ENCDNS_IP4 and ENCDNS_IP6 attribute types () are used to provision ADNs, a list of IP addresses, and a set of service parameters. The ENCDNS_DIGEST_INFO attribute () additionally allows a specific resolver certificate to be indicated by the IKEv2 responder. Sample use cases are described in . The Configuration Payload Attribute Types defined in this document are not specific to these deployments, but can also be used in other deployment contexts. It is out of the scope of this document to provide a comprehensive list of deployment contexts. The encrypted DNS resolver hosted by a VPN provider can get a domain-validate certificate from a public Certificate Authority (CA). The VPN client does not need to be provisioned with the root certificate of a private CA to authenticate the certificate of the encrypted DNS resolvers. The encrypted DNS resolver can run on private IP addresses and its access can be restricted to clients connected to the VPN. Note that, for many years, typical designs have often considered that the DNS resolver was usually located inside the protected domain, but could be located outside of it. With encrypted DNS, the latter option becomes plausible.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses the terms defined in . Also, this document uses the terms defined in . In particular, readers should be familiar with "initiator" and "responder" terms used in that document. This document makes use of the following terms: refers to unencrypted DNS. refers to a scheme where DNS messages are sent over an encrypted channel. Examples of encrypted DNS are DoT, DoH, and DoQ. refers to any IKEv2 Configuration Payload Attribute Types defined in .

The ENCDNS_IP* IKEv2 Configuration Payload Attribute Types, ENCDNS_IP4 and ENCDNS_IP6, are used to configure encrypted DNS resolvers to an initiator. Both attribute types share the format that is shown in . The information included in these attributes adheres to the recommendation in .

The description of the fields of the attribute shown in is as follows: R (Reserved, 1 bit) - This bit MUST be set to zero and MUST be ignored on receipt (see for details). Attribute Type (15 bits) - Identifier for Configuration Attribute Type. This is set to TBA1 for ENCDNS_IP4 or TBA2 for ENCDNS_IP6, as registered in . Length (2 octets, unsigned integer) - Length of the enclosed data in octets. In particular, this field is set to: 0 if the Configuration payload has types CFG_REQUEST (if no specific DNS resolver is requested) or CFG_ACK. If the 'Length' field is set to 0, then later fields shown in are not present. (4 + Length of the ADN + N * 4 + Length of SvcParams) for ENCDNS_IP4 attributes if the Configuration payload has types CFG_REQUEST or CFG_REPLY or CFG_SET; N being the number of included IPv4 addresses ('Num addresses'). (4 + Length of the ADN + N * 16 + Length of SvcParams) for ENCDNS_IP6 attributes if the Configuration payload has types CFG_REQUEST or CFG_REPLY or CFG_SET; N being the number of included IPv6 addresses ('Num addresses'). Service Priority (2 octets) - The priority of this attribute compared to other ENCDNS_IP* instances. This 16-bit unsigned integer is interpreted following the rules specified in . AliasMode () is not supported because such a mode will trigger additional Do53 queries while the data can be supplied directly in the IKE response. As such, this field MUST NOT be set to 0. Num Addresses (1 octet) - Indicates the number of enclosed IPv4 (for ENCDNS_IP4) or IPv6 (for ENCDNS_IP6) addresses. This value MUST NOT be set to 0 if the Configuration payload is of type CFG_REPLY or CFG_SET. ADN Length (1 octet) - Indicates the length of the "Authentication Domain Name" field in octets. When set to '0', this means that no ADN is enclosed in the attribute. IP Address(es) (variable) - Includes one or more IP addresses that can be used to reach the encrypted DNS resolver identified by the Authentication Domain Name. For ENCDNS_IP4 this field contains one or more 4-octet IPv4 addresses, and for ENCDNS_IP6 this field contains one or more 16-octet IPv6 addresses. Authentication Domain Name (variable) - A fully qualified domain name of the encrypted DNS resolver, in DNS presentation format and using an Internationalized Domain Names for Applications (IDNA) A-label . The name MUST NOT contain any terminators (e.g., NULL, CR). An example of a valid ADN for DoH server is "doh1.example.com". Service Parameters (SvcParams) (variable) - Specifies a set of service parameters that are encoded following the rules in . Section 3.1.5 of lists a set of service parameters that are recommended to be supported by implementations. The service parameters MUST NOT include "ipv4hint" or "ipv6hint" SvcParams as they are superseded by the included IP addresses. If no port service parameter is included, this indicates that default port numbers should be used. As a reminder, the default port number is 853 for DoT (Section 6 of ), 443 for DoH (Section 8.1 of ), and 853 for DoQ (Section 8 of ). The service parameters apply to all IP addresses in the ENCDNS_IP* Configuration Payload Attribute.

The ENCDNS_DIGEST_INFO configuration payload attribute allows IKEv2 responders to specify a certificate digest that initiators can use when validating TLS connections to encrypted resolvers. This attribute can also be sent by the initiator to request specific hash algorithms for such digests. The format of ENCDNS_DIGEST_INFO attribute if the Configuration payload has type CFG_REQUEST is shown in .

The description of the fields of the attribute shown in is as follows: R (Reserved, 1 bit) - This bit MUST be set to zero and MUST be ignored on receipt (see for details). Attribute Type (15 bits) - Identifier for Configuration Attribute Type; is set to TBA3 value listed in . Length (2 octets, unsigned integer) - Length of the enclosed data in octets. This field MUST be set to "2 + 2 * number of included hash algorithm identifiers". Num Hash Algs (1 octet) - Indicates the number of included hash algorithm identifiers. This field MUST be set to "(Length – 2)/2". ADN Length (1 octet) - MUST be set to 0. List of Hash Algorithm Identifiers (variable) - Specifies a list of 16-bit hash algorithm identifiers that are supported by the encrypted DNS client.The values of this field are taken from the Hash Algorithm Identifiers of IANA's "Internet Key Exchange Version 2 (IKEv2) Parameters" registry . There is no padding between the hash algorithm identifiers. Note that SHA2-256 is mandatory to implement (see ). The format of ENCDNS_DIGEST_INFO attribute if the Configuration payload has types CFG_REPLY or CFG_SET is shown in .

The description of the fields of the attribute shown in is as follows: R (Reserved, 1 bit) - This bit MUST be set to zero and MUST be ignored on receipt (see for details). Attribute Type (15 bits) - Identifier for Configuration Attribute Type; is set to TBA3 value listed in . Length (2 octets, unsigned integer) - Length of the data in octets. Num Hash Algs (1 octet) - MUST be set to 1. ADN Length (1 octet) - Indicates the length of the "Authentication Domain Name" field in octets. When set to '0', this means that the digest applies on the ADN conveyed in the ENCDNS_IP* Configuration Payload Attribute(s). Authentication Domain Name (variable) - A fully qualified domain name of the encrypted DNS resolver following the syntax defined in . The name MUST NOT contain any terminators (e.g., NULL, CR). A name is included only when multiple ADNs are included in the ENCDNS_IP* Configuration Payload Attributes. Hash Algorithm Identifier (2 octets) - Specifies the 16-bit hash algorithm identifier selected by the DNS resolver to generate the digest of its certificate. Certificate Digest (variable) - This field includes the Subject Public Key Info (SPKI) hash () of the encrypted DNS resolver certificate using the algorithm identified in the 'Hash Algorithm Identifier' field. The length of this field is "Length – 4 – ADN Length". The ENCDNS_DIGEST_INFO attribute may be present in the Configuration payload of CFG_ACK. In such a case, the ENCDNS_DIGEST_INFO MUST be returned with zero-length data. As discussed in , there are no defined uses for the CFG_SET/CFG_ACK exchange. The use of the ENCDNS_DIGEST_INFO attribute for these messages is provided for completeness.

This section describes how the attributes defined in are used to configure an IKEv2 initiator with one or more encrypted DNS resolvers. As a reminder, badly formatted attributes or unacceptable fields are handled as per Section 2.21 of . Initiators first indicate support for encrypted DNS by including ENCDNS_IP* attributes in their CFG_REQUEST payloads. Responders supply encrypted DNS configuration by including ENCDNS_IP* attributes in their CFG_REPLY payloads. Concretely: If the initiator supports encrypted DNS, it includes either or both of the ENCDNS_IP4 and ENCDNS_IP6 attributes in its CFG_REQUEST. If the initiator does not want to request specific DNS resolvers, it sets the Length field to 0 for the attribute. For a given attribute type, the initiator MAY send either an empty attribute or a list of distinct suggested resolvers. The initiator MAY also include the ENCDNS_DIGEST_INFO attribute with a list of hash algorithms that are supported by the encrypted DNS client. If the request includes multiple bitwise identical attributes, only the first occurrence is processed, and the rest SHOULD be ignored by the responder. The responder MAY discard the full request if the count of repeated attributes exceeds an (implementation specific) threshold. For each ENCDNS_IP* attribute from the CFG_REQUEST, if the responder supports the corresponding address family, and absent any policy restrictions, the responder sends back ENCDNS_IP* attribute(s) in the CFG_REPLY with an appropriate list of IP addresses, service parameters, and an ADN. The list of IP addresses MUST include at least one IP address. The service parameters MUST include at least the "alpn" service parameter. The responder MAY ignore suggested values from the initiator (if any). Multiple instances of the same ENCDNS_IP* attribute MAY be returned if distinct ADNs or service parameters need to be assigned to the initiator. In such instances, the different attributes can have matching or distinct IP addresses. These instances MUST be presented to a local DNS client following their service priority (i.e., smaller service priority values indicates a higher preference). In addition, the responder MAY return the ENCDNS_DIGEST_INFO attribute to convey a digest of the certificate of the encrypted DNS and the identifier of the hash algorithm that is used to generate the digest. If the CFG_REQUEST includes an ENCDNS_IP* attribute but the CFG_REPLY does not include an ENCDNS_IP* matching the requested address family, this is an indication that requested address family is not supported by the responder or the responder is not configured to provide corresponding resolver addresses. If the initiator receives both ENCDNS_IP* and INTERNAL_IP6_DNS (or INTERNAL_IP4_DNS) attributes, it is RECOMMENDED that the initiator uses the encrypted DNS resolvers. The DNS client establishes an encrypted DNS session (e.g., DoT, DoH, DoQ) with the address(es) conveyed in ENCDNS_IP* and uses the mechanism discussed in Section 8 of to authenticate the DNS resolver certificate using the authentication domain name conveyed in ENCDNS_IP*. If the CFG_REPLY includes an ENCDNS_DIGEST_INFO attribute, the client has to create an SPKI hash () of the DNS resolver certificate received in the TLS handshake using the negotiated hash algorithm in the ENCDNS_DIGEST_INFO attribute. If the computed digest for an ADN matches the one sent in the ENCDNS_DIGEST_INFO attribute, the encrypted DNS resolver certificate is successfully validated. If so, the client continues with the TLS connection as normal. Otherwise, the client MUST treat the resolver certificate validation failure as a non-recoverable error. This approach is similar to certificate usage PKIX-EE(1) with selector SPKI(1) defined in but without PKIX validation. If the IPsec connection is a split-tunnel configuration and the initiator negotiated INTERNAL_DNS_DOMAIN as per , the DNS client resolves the internal names using ENCDNS_IP* DNS resolvers. Note: requires INTERNAL_IP6_DNS (or INTERNAL_IP4_DNS) attribute to be mandatory present when INTERNAL_DNS_DOMAIN is included. This specification relaxes that constraint in the presence of ENCDNS_IP* attributes. That is, if ENCDNS_IP* attributes are supplied, it is allowed for responders to include INTERNAL_DNS_DOMAIN even in the absence of INTERNAL_IP6_DNS (or INTERNAL_IP4_DNS) attributes.

The SPKI hash of the encrypted DNS resolver certificate is the output of a cryptographic hash algorithm whose input is the DER-encoded ASN.1 representation of the SPKI. Implementations MUST support SHA2-256 .

This document adheres to the security considerations defined in . In particular, this document does not alter the trust on the DNS configuration provided by a responder. Networks are susceptible to internal attacks as discussed in . Hosting encrypted DNS resolvers even in case of split-VPN configuration minimizes the attack vector (e.g., a compromised network device cannot monitor/modify DNS traffic). This specification describes a mechanism to restrict access to the DNS messages to only the parties that need to know. The initiator may trust the encrypted DNS resolvers supplied by means of IKEv2 from a trusted responder more than the locally provided DNS resolvers, especially in the case of connecting to unknown or untrusted networks (e.g., coffee shops or hotel networks). If the IKEv2 responder has used NULL Authentication method to authenticate itself, the initiator MUST NOT use returned ENCDNS_IP* resolvers configuration unless it is pre-configured, e.g., in the operating system or the application. This specification does not extend the scope of accepting DNSSEC trust anchors beyond the usage guidelines defined in .

As discussed in , the use of encrypted DNS does not reduce the data available in the DNS resolver. For example, the reader may refer to or for a discussion on specific privacy considerations to encrypted DNS.

This document requests IANA to assign the following new IKEv2 Configuration Payload Attribute Types from the "IKEv2 Configuration Payload Attribute Types" namespace available at .

Many thanks to Yoav Nir, Christian Jacquenet, Paul Wouters, and Tommy Pauly for the review and comments. Yoav and Paul suggested the use of one single attribute carrying both the name and an IP address instead of depending on the existing INTERNAL_IP6_DNS and INTERNAL_IP4_DNS attributes. Thanks to Tero Kivinen for the Shepherd review and Roman Danyliw for the AD review. Thanks to Stewart Bryant for the gen-art review, Dhruv Dhody for the ops-dir review, and Patrick Mevzek for the dns-dir review.

In this Enterprise scenario (Section 1.1.3 of ), a roaming user connects to the Enterprise network through an IPsec tunnel. The split-tunnel Virtual Private Network (VPN) configuration allows the endpoint to access hosts that reside in the Enterprise network using that tunnel; other traffic not destined to the Enterprise does not traverse the tunnel. In contrast, a non-split-tunnel VPN configuration causes all traffic to traverse the tunnel into the Enterprise. For both split- and non-split-tunnel configurations, the use of encrypted DNS instead of Do53 provides privacy and integrity protection along the entire path (rather than just to the VPN termination device) and can communicate the encrypted DNS resolver policies. For split-tunnel VPN configurations, the endpoint uses the Enterprise-provided encrypted DNS resolver to resolve internal-only domain names. These names may be configured to the endpoints using Enterprise-specific provisioning mechanisms or the INTERNAL_DNS_DOMAIN attribute. For non-split-tunnel VPN configurations, the endpoint uses the Enterprise-provided encrypted DNS resolver to resolve both internal and external domain names. Enterprise networks are susceptible to internal and external attacks. To minimize that risk all enterprise traffic is encrypted (Section 2.1 of ).

Legacy VPN service providers usually preserve end-users' data confidentiality by sending all communication traffic through an encrypted tunnel. A VPN service provider can also provide guarantees about the security of the VPN network by filtering malware and phishing domains. Browsers and operating systems support DoH/DoT; VPN providers may no longer expect DNS clients to fall back to Do53 just because it is a closed network. The encrypted DNS resolver hosted by the VPN service provider can be securely discovered by the endpoint using the IKEv2 attributes specified in .

VPN service providers typically allow split-tunnel VPN configuration in which users can choose applications that can be excluded from the tunnel. For example, users may exclude applications that restrict VPN access. The encrypted DNS resolver hosted by the VPN service provider can be securely discovered by the endpoint using the IKEv2 attributes specified in .

depicts an example of a CFG_REQUEST to request the configuration of IPv6 DNS resolvers without providing any suggested values. In this example, the initiator uses the ENCDNS_DIGEST_INFO attribute to indicate that the encrypted DNS client supports SHA2-256 (2), SHA2-384 (3), and SHA2-512 (4) hash algorithms. The label of these algorithms is taken from . The use of INTERNAL_IP6_ADDRESS is explained in ; it is thus not reiterated here.

depicts an example of a CFG_REPLY that can be sent by a responder as a response the above CFG_REQUEST. This response indicates the following information to identify the encrypted DNS resolver: Its IPv6 address (2001:db8:99:88:77:66:55:44) Its authentication domain name (doh.example.com) Its supported HTTP version (h2) The relative form of the URI Template (/dns-query{?dns}) The SPKI hash of the resolver's certificate using SHA2-256 (8b6e7a5971cc6bb0b4db5a71...)

In this example, no ADN is included in the ENCDNS_DIGEST_INFO attribute because only one ADN is provided in the ENCDNS_IP6 attribute. There is no ambiguity to identify the encrypted resolver associated with the supplied digest. An initiator may provide suggested values in the CFG_REQUEST when requesting an encrypted DNS resolver. For example, the initiator may: Indicate a preferred resolver that is identified by an IPv6 address (see ).

Indicate a preferred resolver that is identified by an ADN (see ).

Indicate a preferred transport protocol (DoT, in the example depicted in )

or any combination thereof. An initiator may also indicate that it supports Split DNS by including the INTERNAL_DNS_DOMAIN attribute in a CFG_REQUEST as shown in . In this example, the initiator does not indicate any preference for the requested encrypted DNS server nor which DNS queries will be forwarded through the IPsec tunnel.

shows an example of a reply of the responder. Absent any prohibited local policy, the initiator uses the encrypted DNS server (doh.example.com) for any subsequent DNS queries for "example.com" and its subdomains.