Re: [Add] data integrity and DNSSEC or DoH/DoT

[Stephen Farrell <[e-mail]>]

Hiya,

On 21/08/2019 23:14, David Conrad wrote:
> Stephen,
> 
> On Aug 21, 2019, at 2:47 PM, Stephen Farrell
> <[e-mail]> wrote:
>>> DNSSEC and DoH/DoT are not different paths to the same end goal
>>> of data integrity. They provide different flavours of data
>>> integrity.
>> 
>> I don't agree that the goals are precisely the same as the actors
>> involved in providing the security services differ. There's a lot
>> in common, but they aren't identical.
> 
> You appear to be agreeing with Jim.

I often do :-)

> DNSSEC provides data integrity _for what the zone authority put into
> the zone_, regardless of how it gets to the client.
> 
> A TLS channel between a client and a resolver (DoH or DoT) provides
> data integrity and confidentiality (and _resolver_ origin
> authentication)  _for what the RESOLVER chooses to serve_.

Yep.

> DoH _will not help_ if the “trusted” resolver is compromised to
> modify the response (something I suspect concentrating the resolver
> function will encourage).  DNSSEC would help that particular attack.

Yep.

Those are both true statements. There are equally true
statements that'd demonstrate cases where DoH or DoT do
better than DNSSEC - IIUC an important one being: given
the (unfortunate) relative sparsity of DNSSEC signed
data, the data integrity service that DoH or DoT can
provide could well be argued to be as good as what a
client can get via DNSSEC when the full set of queries
a client makes are taken into account. I'm not saying
I agree with that as a winning-argument, but it is an
entirely arguable proposition.

> My response to Ted that caused me to get sucked into this particular
> swamp (something I already regret) was merely trying to point out
> there is a significant difference there.

Sure. But I figure its important we try be precise in how
we talk about those differences - given how controversial
people find this topic, we otherwise end up making a hard
discussion harder, as was evident in some recent exchanges.

Cheers,
S.


> 
> I hope that clarifies.
> 
> Regards, -drc
> 
> 
>