Re: [Add] [Ext] Updated charter proposal for ADD

[Brian Dickson <[e-mail]>]

On Wed, Jan 15, 2020 at 1:01 PM STARK, BARBARA H <[e-mail]> wrote:

>
>
> On Wed, Jan 15, 2020 at 11:47 AM Andrew Campling <
> [e-mail]> wrote:
>
> On Wed, Jan 15, 2020 at 19:24 Rob Sayre <[e-mail]> wrote:
>
> > Right now, my DNS server is 192.168.86.1, and encrypted DNS seems
> designed to bypass it.
>
>
>
> Well, a lot of networking products (both consumer and corporate) have an
> unencrypted DNS server on a private IP.
>
>
>
> I was wondering how the certificates would be constructed if they wished
> to offer DoH or DoT. I know public services are able to get certificates
> with SAN[1] extensions containing public IPs (e.g. the Cloudflare cert for
> 1.1.1.1). That doesn't seem to make sense for private IPs, so I'm wondering
> how private networks will offer encrypted DNS, and whether the debate
> around the security considerations is important.
>
>
>
> thanks,
>
> Rob
>
>
>
> [1] https://tools.ietf.org/html/rfc5280#section-4.2.1.6
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__tools.ietf.org_html_rfc5280-23section-2D4.2.1.6&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=8_yvv1il3zewjGy7Q4S4OtQitnmASPvjF6La_TDH_6U&s=DIByZeZTbnVQz-bhge3oVFvDzYJTHKdgueM0_z-8W7s&e=>
>
>
>
> <bhs> Discussions I’ve had with people so far have been along the lines of
> (1) we’re not aware of any user-friendly/easy way to get a certificate into
> consumer routers that will be ok’ed by a CA in browsers’ trust stores, (2)
> the user experience of doing https to a consumer router from a browser is
> pretty horrible and scary, (3) some of these routers (e.g., Netgear) don’t
> even allow users to change what the router sends in DHCP/RA (it’s always
> the router’s private IP address; but the user can change what recursive
> resolver the router then uses), and (4) many people are unconvinced that
> the threat of compromise inside the home network is worth the effort and
> negative user experience.</bhs>
>
>
The other relevant question for those consumer boxes is whether they are
full resolvers, or if they are merely forwarders to an upstream resolver
that they learn from e.g. DHCP or RA. (Some even advertise their own IP,
but only do NAT without any real DNS functionality, and literally forwarder
the packet, rather than the query, from what I understand.)

If the upstream resolver can be identified and is reachable directly, that
potentially makes the middle box a moot point, as the client would have the
ability to do whatever the WG adopts, to the real upstream resolver.

Making that sufficiently user-friendly on the client side, and scalable and
operable on the resolver side, are pertinent questions. I expect the user
experience would be better, and the security model much better, when
bypassing the middle box.

The threat potential would still exist outside of the home network if a
forwarder was used without using an upgraded transport, between the middle
box and the upstream resolver. This threat would be addressed indirectly
if/when the middle box were bypassed entirely.

This model presumes the upstream resolver is the resolver discovered, and
would not change the actual (functional) resolver being used.

Brian