Re: [Add] [Ext] Draft Posting: CNAME Discovery of Local DoH Resolvers

Hi,

My responses would have been inline with those of Paul.

Yours,
Daniel

On Tue, Jun 30, 2020 at 5:19 AM Paul Vixie <paul@redbarn.org> wrote:

> On Tuesday, 30 June 2020 09:07:43 UTC Martin Thomson wrote:
> > Hi Paul,
> >
> > On Tue, Jun 30, 2020, at 17:51, Paul Vixie wrote:
> > > Eric Rescorla wrote on 2020-06-29 20:08:
> > > > On Mon, Jun 29, 2020 at 8:05 PM Daniel Migault <mglt.ietf@gmail.com
> > > >
> > > > <mailto:mglt.ietf@gmail.com>> wrote:
> > > >     If the lookup takes as input the IP addresses or something
> provided
> > > >     by the ISP (like the local resolver IP address), the resulting
> chain
> > > >     is likely to be from the ISP. DNSSEC is needed to assert it.
> > > >
> > > > Why do you assume that the IP is delivered securely?
> > >
> > > because dnssec allows me to verify end-to-end authenticity of
> > > name/address bindings (and other dns content.)
> >
> > DNSSEC allows you to be sure of the veracity of what comes from DNSSEC,
> but
> > in this case the IP address didn't come from DNSSEC.  It's not DNS
> content.
>
> i have badly misunderstood.
>
> the way i know that the ip address provided by the isp was delivered
> securely
> today is because off-net DHCP forgery is hard, or because their technician
> programmed it into my edge gateway, or their customer service department
> printed it on my welcome letter.
>
> but i didn't want to interpret the question in that way because my answer
> would sound silly, even to me. i apologize for my confusion.
>
> ---
>
> moving on, what i'd love to have is SDNCP rather than DHCP. S=secure,
> N=network. because i want to know i'm getting what the operator of the
> network
> wants me to get, and because there are other parameters besides RDNS that
> i
> care about, such as whether there's a mandatory HTTPS or HTTP/3 proxy i
> will
> have to talk to. because, IoT. if DHCP isn't useful because it's not
> secure,
> we should stop using it. but before we could do that, we'd have to meet
> its
> functionality in another way.
>
> i realize that i've identified an unmarketable general case which has got
> to
> sound like i want to boil the ocean, or boil frogs, or something. but i
> figure
> if i don't say something, then after we've consensed around a secure RDNS
> discovery protocol, and somebody says what about all these other
> parameters
> that also have to be set by the network operator and have to be
> authenticated,
> we won't know how we got there.
>
> i'd like setting up an IoT device to be like bluetooth pairing, only,
> secure.
> like, enter a four-digit PIN or something. getting secure RDNS
> configuration
> should be like that. right now it's a welcome letter printed by my ISP,
> and
> that seems outdated.
>
> --
> Paul
>
>
> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

-- 
Daniel Migault
Ericsson