Re: [Add] What to do in this potential working group

[Stephen Farrell <[e-mail]>]

Hiya,

On 21/08/2019 22:28, David Conrad wrote:
> Stephen,
> 
> On Aug 21, 2019, at 2:13 PM, Stephen Farrell
> <[e-mail]> wrote:
>> DNSSEC provides origin-authentication and data integrity for DNS
>> answers between the signer and validator.
>> 
>> If the client validates the TLS server cert, DoH provides 
>> TLS-server authentication, confidentiality and data integrity
>> between the TLS client and server.
> 
> "TLS client and server" != "signer and validator”

Yes. That was part of my point.

> 
>> So yep, both give data integrity, just differently.
> 
> No.

Sorry, but yes:-)

> 
> What you say would be true ONLY if the DoH client connects to the
> authoritative source of the data. Which, of course, it doesn’t.

Disagree. Data integrity is a security service that can be
provided via digital signatures (in the DNSSEC case) or
via message authentication (use of an AEAD in the TLS case).
Please see RFC4949.

> 
> Again, what would happen if the TRR you contracted with is subject to
> a court order under seal that requires that TRR to modify responses
> for particular domains?  How would you know?

That's a good question but not relevant when considering
whether DNSSEC or TLS provide data integrity in the sense
of a cryptographic protocol. Both do that.

If you want to talk about data integrity in the sense of
"answer faithfully matches the zonefile equivalent content"
then that's possibly a confusing term to use in this case.
It may have been used historically amongst DNSSEC folks,
not sure, but certainly once TLS is in the mix, it'd be
better to call that another thing. That is what I meant
by origin authentication + data integrity though.

Anyway point is: yes, TLS does provide data integrity
for an entirely reasonable definition of the term. And
so does DNSSEC. But they do different things.

Cheers,
S.


> 
> Regards, -drc
> 
> 
> 
>