Re: [Add] [EXTERNAL] My single use case

[Martin Thomson <[e-mail]>]

On Fri, Sep 11, 2020, at 01:27, Tommy Jensen wrote:
> > As a new device or application, when I join a network that I have no prior relationship with or configuration for, I want to discover the DoT or DoH resolver that corresponds to the Do53 resolver offered by that network
> 
> My issue with this scenario is I see "discover a DoT/DoH" server 
> differently from "discover a DoT/DoH server that corresponds to the 
> Do53 resolver". The former doesn't require authentication to meet 
> security parity with Do53 server use today. The latter is a novel 
> concept I would prefer to be authenticated. This means for existing TLS 
> infra would only be possible for publicly routable IP addresses, a 
> subset of the network-offered servers out there.
> 
> Is the difference important to you? Would you be fine with the network 
> offering the DoT/DoH server in the first place? If not, I just want to 
> better understand why not.

Thanks Tommy, that's a good question.

I worded it this way intentionally to allow for both of the interpretations you refer to:

1. What does the network claim is equivalent (DoT/DoH DHCP/RA discovery for example)
2. What does the provided Do53 resolver claim is equivalent (resinfo for example, or maybe just the opportunistic encryption stuff)

As you point out, the latter introduces an extra hop, which might then lead to difficult questions about authentication and what it means to achieve parity.  That's why this is a non-trivial use case to resolve.

I think that the difference is important and we will have to work through both paths, if only because the prevalence of forwarders might mean we need two sets of solutions.  However, it might be that people choose to adopt policies under these different circumstances once we document the properties of the end solutions.

I don't think that this necessarily depends on the creation of new infrastructure for authentication of servers that don't have IP addresses in the public address space, but it might make that results less usable for you.  It all depends on your tolerance for using unauthenticated information.

For instance, Mozilla's TRR program means that we can be more tolerant of failures in discovery, though that requires that we also be tolerant of attacks that aim to make split horizon unavailable, for example.