Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Paul Vixie <[e-mail]>]

On Tuesday, 30 June 2020 13:17:32 UTC Ted Lemon wrote:
> On Jun 30, 2020, at 5:19 AM, Paul Vixie <[e-mail]> wrote:
> > moving on, what i'd love to have is SDNCP rather than DHCP. S=secure,
> > N=network. because i want to know i'm getting what the operator of the
> > network wants me to get, and because there are other parameters besides
> > RDNS that i care about, such as whether there's a mandatory HTTPS or
> > HTTP/3 proxy i will have to talk to. because, IoT. if DHCP isn't useful
> > because it's not secure, we should stop using it. but before we could do
> > that, we'd have to meet its functionality in another way.
> 
> We tried that. Unfortunately, what we found is that it just moves the
> problem. Suppose you send out an SDNCP discovery request and get back one
> or more signed responses. Which one do you choose?

as i wrote, i'd expect it to be like bluetooth pairing, which has the same 
problem, and which solves it with a six-digit PIN code for verification. maybe 
we can use something more modern, like thumbprint scans.

> ...
> 
> So the question is, what problem are you solving with SDNCP that isn’t
> already solved with DNSSEC, TLS and PKI?

as i wrote, there are other network configuration parameters which are also 
valuable targets, such as outbound proxy settings.

as i've written elsewhere, not all DNSSEC-validating servers are equal. as the 
owner and operator of private networks, i require all my users, apps, and 
nodes to use a DNSSEC-validating server that also has a policy layer, and 
transaction logging. so, using DNSSEC as a measure of correctness does not and 
will never cover the requirements of the Secure Access Service Edge. this is 
more important than ever now that so many workers are working from home. see:

https://techspective.net/2020/06/23/the-four-horsemen-of-sase-secure-access-service-edge/

> The only answer we came up with is that it might be nice to be able to know
> that we are speaking to the same operator we were last time. But we didn’t
> actually identify a compelling use case for that, and consequently the work
> was abandoned.

i think i should have paid more attention at that time, and i apologize. DHCP 
was always the wrong thing to build, like BOOTP before it, and IPv6 address 
assignment after it. secure hosting networks have to use /30 and later /31 
netmasks (one customer per vlan) in order to trust any of this.

-- 
Paul