Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Paul Vixie <[e-mail]>]

On Tuesday, 30 June 2020 09:07:43 UTC Martin Thomson wrote:
> Hi Paul,
> 
> On Tue, Jun 30, 2020, at 17:51, Paul Vixie wrote:
> > Eric Rescorla wrote on 2020-06-29 20:08:
> > > On Mon, Jun 29, 2020 at 8:05 PM Daniel Migault <[e-mail]
> > > 
> > > <mailto:[e-mail]>> wrote:
> > >     If the lookup takes as input the IP addresses or something provided
> > >     by the ISP (like the local resolver IP address), the resulting chain
> > >     is likely to be from the ISP. DNSSEC is needed to assert it.
> > > 
> > > Why do you assume that the IP is delivered securely?
> > 
> > because dnssec allows me to verify end-to-end authenticity of
> > name/address bindings (and other dns content.)
> 
> DNSSEC allows you to be sure of the veracity of what comes from DNSSEC, but
> in this case the IP address didn't come from DNSSEC.  It's not DNS content.

i have badly misunderstood.

the way i know that the ip address provided by the isp was delivered securely 
today is because off-net DHCP forgery is hard, or because their technician 
programmed it into my edge gateway, or their customer service department 
printed it on my welcome letter.

but i didn't want to interpret the question in that way because my answer 
would sound silly, even to me. i apologize for my confusion.

---

moving on, what i'd love to have is SDNCP rather than DHCP. S=secure, 
N=network. because i want to know i'm getting what the operator of the network 
wants me to get, and because there are other parameters besides RDNS that i 
care about, such as whether there's a mandatory HTTPS or HTTP/3 proxy i will 
have to talk to. because, IoT. if DHCP isn't useful because it's not secure, 
we should stop using it. but before we could do that, we'd have to meet its 
functionality in another way.

i realize that i've identified an unmarketable general case which has got to 
sound like i want to boil the ocean, or boil frogs, or something. but i figure 
if i don't say something, then after we've consensed around a secure RDNS 
discovery protocol, and somebody says what about all these other parameters 
that also have to be set by the network operator and have to be authenticated, 
we won't know how we got there.

i'd like setting up an IoT device to be like bluetooth pairing, only, secure. 
like, enter a four-digit PIN or something. getting secure RDNS configuration 
should be like that. right now it's a welcome letter printed by my ISP, and 
that seems outdated.

-- 
Paul