Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Paul Vixie <[e-mail]>]

i wasn't speaking, but i was addressed, so i will attempt an answer.

Eric Rescorla wrote on 2020-06-29 20:08:
> 
> 
> On Mon, Jun 29, 2020 at 8:05 PM Daniel Migault <[e-mail] 
> <mailto:[e-mail]>> wrote:
> 
>     If the lookup takes as input the IP addresses or something provided
>     by the ISP (like the local resolver IP address), the resulting chain
>     is likely to be from the ISP. DNSSEC is needed to assert it. 
> 
> Why do you assume that the IP is delivered securely?

because dnssec allows me to verify end-to-end authenticity of 
name/address bindings (and other dns content.) while tls and ssh and 
gssapi add a useful second layer of end-to-end identify verification, 
those are not the only protocols i use.

>     Another way would be to be able to display example.com
>     <http://example.com>. The user should be able to see how the domain
>     is associated to the ISP it has subscribed to or if it is being
>     redirected to a cloud provider.  DNSSEC would make sur
>     the corresponding IP address - as well as other information - are
>     bound to the displayed domain.
> 
> At this point, why would I need DNSSEC? I could just use the WebPKI.

dns has always been used by protocols outside the web, and will always 
be used by protocols outside the web. but even in your web use case, 
there will always be uri schemes which lack end-to-end identity 
verification. some current examples can be found here:

https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml

the web is a fish. the internet is a pond.

-- 
P Vixie