[Add] Relaxed validation and delegated IPv6 prefixes (Was: New Version Notification for draft-schwartz-add-ddr-forwarders-00.txt)

["STARK, BARBARA H" <[e-mail]>]

Hi Ben,
Thanks for the draft updates. I think they're an improvement.
I just wanted to explore the topic of IPv6 delegated prefixes a little more. Comments in-line with <bhs>, with just the relevant parts of the previous email. Apologies upfront for me stream-of-consciousness expressions.
Thx,
Barbara

Note that an IPv4 subnet and IPv6 on-link prefix could be comprised of globally routable addresses - so not necessarily "non-public" as some people might understand that word.
But since we're all trying to head for IPv6, I think it's good to recognize that the IPv6 address being advertised for DNS proxies tends to be from the delegated prefix and not ULAs. And it might be good if we could support this case.

This document is focused on the case where the DNS server is only known by a private IP address.  In this case "opportunistic security" is the best we can do, because cryptographic identity validation is not possible.  This draft is about exploring subtleties within the space of opportunistic security.

If the DNS forwarder is identified by a public address (IPv4 or IPv6), then it could get a TLS certificate for that IP address.  A client policy that doesn't require authentication in this case, even though authentication is possible, would be a much bigger departure from baseline DDR.  I would prefer not to describe that behavior in this draft.

<bhs> When you say "[the DNS forwarder] could get a TLS certificate for that IP address", are you saying it would be possible for a gateway to get a PKI CA-signed certificate every time it gets delegated an IPv6 prefix (and subsequent renewal)? Would this certificate need to have an expiry (valid date) consistent with the DHCPv6 IA_PD expiry (24 hours to a week)? AFAIK, the process for getting such a certificate doesn't exist (yet?). Is there some CA that offers such a thing? But, even if it did, this would require an upgrade to the gateway to somehow request and receive this certificate from the CA (with every lease renewal). I don't think we'd want a system where the CA couldn't verify that the gateway it was providing the certificate to was in possession of the IPv6 address. And this is all to support upgrade over gateways that aren't being updated. So a certificate is probably unrealistic? So if a client is provided a private IPv4 DNS server address and a public (GUA) IPv6 DNS server address (and, BTW, both reply with identical resolver.arpa info), will the relaxed-validation client prefer IPv6 and not upgrade because the IPv6 address is a GUA? Or will the relaxed-validation client try the private IPv4 address (also?) and do the DoH upgrade? I'm ok not worrying about people with static public IPv4 address assignments (assuming the same argument that a certificate isn't realistic). That's a small population. But is it really not possible to explore allowing "same IPv4 subnet" or "on-link IPv6 prefix"?