Re: [Add] data integrity and DNSSEC or DoH/DoT

[Alec Muffett <[e-mail]>]

On Fri, 6 Sep 2019, 16:26 Vittorio Bertola, <vittorio.bertola=
[e-mail]> wrote:

> > Il 6 settembre 2019 05:27 Paul Wouters <[e-mail]> ha scritto:
> >
> > Trusting unsigned data from the internet from random parties is not done
> > for any other protocol, why allow it for DNS?
>
> I see your point, but one could reply: is the *content* of any web page
> you load signed or independently verified for integrity in any way? No, you
> just authenticate the source and secure the channel, and then trust any
> content you receive that way.



One could also say that what you outline as the trust model for web pages
is precisely what one would expect from a typical HTTPS URL: because a URL
literally represents "go to <source> and retreive <content> and that is
defacto what you wanted."

A URL is a Uniform Resource Locator; there's that word, "location".

Others have layered signatures and the like atop of this mechanism, but if
you are talking about content-based-addressing (which you essentially are)
then you want non-HTTP URIs, for instance "Magnet" URIs.

Whereas: DNS is a distributed database, and the goal of that is more like a
service discovery protocol (who here remembers Jini?) - where you ask the
aether "What is the address X which corresponds to site Y?" - and there is
(currently, regrettable) little/no chain of trust, nor source-integrity nor
content-integrity, in the response.

So why should it be different when the content (via DoH) is a DNS response?


Because HTTPS has a security-model of "the URL is the Key, and a chain of
trust should permit an authoritative response of the content - which need
not be fixed! - whereas DNS is essentially a search query amongst untrusted
search engines, some of which are lying for their own reasons/benefit.

That's why.

- alec





>