Downtown Chicago was the setting for IETF98, which took place at the end of March. Before the packed main programme, various fringe events were held, including a hackathon on the Saturday and Sunday. The highlights of the gathering are sketched below.
IEPG
On the Sunday before IETF98, things got underway with the IEPG meeting. Although it wasn't part of the official programme, which kicked off on the Monday, the session got delegates warmed up by exploring a number of topical issues. We presented our research into Let's Encrypt in a talk entitled 'No domain left behind'.
What's the effect of Let's Encrypt?
In tandem with Delft University of Technology, we have been investigating whether and how the Let's Encrypt initiative has changed the TLS landscape, and whether more sites do now have TLS security. Our research drew on the public Certificate Transparency Logs plus the results of scans performed using our own DNS-EMAP crawler and data from other sources, such as DNSDB. We were able to establish that the convenience and low cost of Let's Encrypt has given a significant boost to use of the TLS protocol. The full research report is available to download here.
DNS errors are a problem for DNS software developers
At least equally interesting were the presentations made by other delegates, including our colleagues at CN.NIC, who talked about common DNS errors. The errors are a challenge for DNS (resolver) software developers. Job Snijders put the cat amongst the pigeons by highlighting the numerous uncertainties surrounding IPv6 prefix lengths.
IETF: considerable interest in the internet of things (IoT)
Following Sunday's enjoyable appetiser, the official IETF meeting got underway on Monday with a full programme of parallel sessions. To sum up, as well as devoting a lot of time to privacy and encryption following the Snowden revelations at earlier meetings, the proceedings focused particularly on the implications of the rapidly growing internet of things (IoT). The IoT's rise has consequences for many aspects of the internet and the activities of the IETF. So, for example, the IETF now has a Thing-to-Thing Research Group (T2TRG) and various working groups concerned with communication between 'things' or the security and authentication of such communication.
DNS
As indicated, privacy and security remained prominent on the agenda. Almost every IETF working group had privacy and security questions to consider, and the DNS-related working groups were no exceptions. The recent DDoS on Dyn by the Mirai botnet had also given delegates a lot to think about. During the attack, many name servers were very hard to reach, with the result that numerous popular services – including Twitter, Airbnb, CNN, NetFlix, PayPal and GitHub – were partially disabled. With a view to reducing vulnerability to future attacks, it was suggested that, if authoritative name servers stop responding, a DNS resolver should provide the most recently cached response. Under normal circumstances, that would be undesirable, but it could keep services in the air in an emergency situation. The practice appeared to have worked well during the attack on Dyn and is now being formalised as a draft.
SIDN Labs
The work done under the IETF umbrella is relevant to the research themes pursued by SIDN Labs, and vice versa. As well as presenting research results, the SIDN Labs team therefore contributes actively to the development of IETF standards. We have authored and/or co-authored a number of drafts, including IPv6 DOTS Signal Option and DMARC Failure reporting Interval tag. However, consensus remains elusive on both those topics. So we were particularly pleased when our recent draft on the secure transfer of DNSSEC-signed domain names (RFC8063) was ratified. More recently, SIDN Labs' Jelte Jansen has co-authored a brand new draft on the use of SHA-3 (Keccak) and RSASSA-PSS algorithms in DNSSEC.
Other news from IETF98
Against the backdrop of so much privacy and security 'violence' and the rise of the IoT, it is important to consider the impact on internet users and their rights. The implications were considered by the Human Rights Protocol Considerations (HRPC) research group and others. The HRPC is a bit of an oddity within the IETF, but its sessions have been attracting increasing attention in recent times.
Summary
One only has to look at an IETF agenda to see that the internet is still developing rapidly. Yes, the internet faces threats, such as DDoS attacks that undermine the availability of services. But there are also opportunities out there. Plenty of opportunities! So there is ample inspiration for making the internet even more reliable, as well as faster and more secure. And the SIDN Labs team continues to draw on that inspiration.
With so many internet-connected devices of all kinds appearing all the time, reliability, speed and security are certainly not luxuries that we can do without.
