IETF Logo Mail Archive

Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00

tirumal reddy <kondtir@gmail.com> Wed, 17 July 2019 14:05 UTC

Return-Path: <kondtir@gmail.com>
X-Original-To: add@ietfa.amsl.com
Delivered-To: add@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87056120410 for <add@ietfa.amsl.com>; Wed, 17 Jul 2019 07:05:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.997
X-Spam-Level:
X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mtyeLaEaTuB7 for <add@ietfa.amsl.com>; Wed, 17 Jul 2019 07:05:37 -0700 (PDT)
Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3546A120074 for <add@ietf.org>; Wed, 17 Jul 2019 07:05:37 -0700 (PDT)
Received: by mail-io1-xd2f.google.com with SMTP id z3so45960928iog.0 for <add@ietf.org>; Wed, 17 Jul 2019 07:05:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9I8kDbi039TYjZ0aOL9iLRPq5s/1lPcPkoV5rOL8M6k=; b=o1L6A1Zd+bt/d69hho75ENHjTZ8WJg/B2cAYsjvZzrRKT9+ucS2vVecSf3zLeLxXnj /9YGJMoHe7OgfRcUgVe/Bx+PRqmxTT1y2wd9WwV+jC+t8OBGHVJSW/Q+4FccB3AgaQVT M5xu/FCdviWWbU2aBMf6qh/yQ3bFeRZ7tI6kjZFjet4zTKl5tyEf57VJ96DiS9TsUNWn YkJILHJeibrCQEA2yi6jk0sDUkOOJ5Ka8yuIhysneRWb3NYkDD78yIPB4W9Bng/ZJKsg davs3GqHNq4W9XXLKrTDDWR6Sa3JkI6iMp0UnoAnaswcduZ71pMsjhhhlVJ/tTkZLdpe GFkg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9I8kDbi039TYjZ0aOL9iLRPq5s/1lPcPkoV5rOL8M6k=; b=ADO5MPNflloI8HzlWsHQntoSCm2s1v/eVdo86ZVRVjvQ5d12a4ZBtOll7G1A37OzAJ DMlNJyI+w2Lnocz4JxXy8fg5u6LjAQTQZmyrb25SRkdRjnA0JE12E4EaONTgT1KBrpbN mfz7HjhmrCR6r5L1kOqasjDb5my9Blk2ne30Cv0CIE8I0U+wESDrmR31ADWw+/N2I8ey 5AepMwMry3bW0jduup8zCVho3lNTJsmb1M2WU3TH5I4sM3Y9I9Hi/Yhwiq0MlDqe3b/M 10yoTJPnxyQWKrDFx7nOsxibM3zc/MllJvhDU2itAJzVPjAYMycMcb5W0TfdaMjwZ+vp HVgQ==
X-Gm-Message-State: APjAAAXt5zn18Nif8eKF6dxxDNbIbVEjr8uaVl0S8AhWOQPB/aeupZyb XbWg5typ251OMAevL4QqKxPCBJTidRtFlvQxE2Q=
X-Google-Smtp-Source: APXvYqxaW5vJf9SlIv2KpMTLQ3x/2bLiypKweUrP/0sJiR6UkorkCCccWndJDtiq4hFuS5VlU+GqUtNVLQMc6mjOu60=
X-Received: by 2002:a6b:6f06:: with SMTP id k6mr28977312ioc.32.1563372336514; Wed, 17 Jul 2019 07:05:36 -0700 (PDT)
MIME-Version: 1.0
References: <CAChr6SwEUz9MrdRA0bnv9f-oNi0oUHkfRKjd9-o6jwhuckLXdw@mail.gmail.com> <CAFWeb9LNdT=EYVKTsYDxcBCQKoQFNShKotYtWujt4U9GA-V1mg@mail.gmail.com> <CAFWeb9+eWKSKY9O2JLn9-0+Zq7hrD48F-y+Y4T-iRaaF0vtdOA@mail.gmail.com> <A45F4F74-D6C1-435A-A52F-C2DEA82E2999@sky.uk> <CAFWeb9JVBj+Yehup5q4v9X-7XDY+02frd-04AQGL2HoSLON2qA@mail.gmail.com> <CABcZeBMY9q9vKGse1svzbvXF_dSHA+9q06j4ugDVCZP9VT1koQ@mail.gmail.com> <CAChr6Sz5Rfz=UxOYuPguSvVK2HCX2ZoA1-FytW7+EOUxN8y46Q@mail.gmail.com> <CABcZeBNB7ASu2U3ZMBZ+OOxEhbSnhDXwFN3Lsex1uzVSDv3R=Q@mail.gmail.com> <CAChr6SwEwRRX7BA6ZCeBuC93hFxbfi3d7G_3G3VA7Lm09yuneg@mail.gmail.com> <CABcZeBNa97Vb6Fw-fMhoZnMezGtm3nJODENN4=XXsz7GWxf2Cg@mail.gmail.com> <CAChr6Sxm__NroZ92v4HL_6iCa62fwYgNw9r8ZDAxCdzVwNoDGw@mail.gmail.com> <CABcZeBMxQgDZJs3BQkb7xiN6Gm=joBqLmTnHCO+TMdKQyUepOg@mail.gmail.com> <CAChr6SxN+72tY6_6tw-TeBWeYh4XQr-VRip_2LQh3Mnsk85GPw@mail.gmail.com> <CABcZeBPNevTZDXXXuRS87+YpZ8xY+Y79inW2x0AmPL2Hd9xNmQ@mail.gmail.com> <CAChr6SwYv66zuxCQv0FOjuqqsLxmVL++bK37x9G1S24XUKVgYg@mail.gmail.com> <CABcZeBOXfR0a+j0KF0FZPt=9ahNE0JsqO4=tg6Dr80TcBi895A@mail.gmail.com>
In-Reply-To: <CABcZeBOXfR0a+j0KF0FZPt=9ahNE0JsqO4=tg6Dr80TcBi895A@mail.gmail.com>
From: tirumal reddy <kondtir@gmail.com>
Date: Wed, 17 Jul 2019 19:35:24 +0530
Message-ID: <CAFpG3gfSSx9n4TyXkb0=q4F976B_3ZxwLeL4SrK1CVFnvPS4Nw@mail.gmail.com>
To: Eric Rescorla <ekr@rtfm.com>
Cc: Rob Sayre <sayrer@gmail.com>, ADD Mailing list <add@ietf.org>, "Dixon, Hugh" <Hugh.Dixon@sky.uk>, Alec Muffett <alec.muffett@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000c50daa058de0fcee"
Archived-At: <https://mailarchive.ietf.org/arch/msg/add/XbmfTc4zNI2LXXT_cG0OhMtyiH8>
Subject: Re: [Add] [EXTERNAL] Re: draft-grover-add-policy-detection-00
X-BeenThere: add@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Applications Doing DNS <add.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/add>, <mailto:add-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/add/>
List-Post: <mailto:add@ietf.org>
List-Help: <mailto:add-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/add>, <mailto:add-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Jul 2019 14:05:39 -0000

On Wed, 17 Jul 2019 at 01:41, Eric Rescorla <ekr@rtfm.com> wrote:

>
>
> On Tue, Jul 16, 2019 at 1:02 PM Rob Sayre <sayrer@gmail.com> wrote:
>
>>
>>
>> On Tue, Jul 16, 2019 at 12:53 PM Eric Rescorla <ekr@rtfm.com> wrote:
>>
>>>
>>> Taking a TRR-style system out of the equation for a moment. Suppose that
>>> what I want is for all devices on my network to use a filtering resolver. I
>>> don't expect any evasion because they're all my devices, it's just a matter
>>> of convenience to centrally configure it. So what I do here is I configure
>>> my DHCP server to provide the IP address of that resolver. Now, those
>>> devices do unencrypted DNS because that's what everyone does. Now, suppose
>>> that resolver starts offering DoT. How do my devices learn that
>>> information? The resolver could tell them over DNS but then we have a
>>> straightforward downgrade attack from anyone on the network. Do you agree
>>> with this so far? Do you have a proposed solution?
>>>
>>
>> In fairness, I'm not sure I quite follow. But, if I worked at a browser
>> vendor, I would be worried about DoH rollout too. I think I'd gradually
>> ratchet up the security signals in the location bar with the end result of
>> marking sites insecure if their IP was fetched over DNS in the clear.
>>
>
> Ignoring the UI question, let me push a bit on "in the clear".
>
> Currently, resolvers are configured by IP address, not domain name. So
> absent mechanisms such as TRR, how does the DNS client form a secure
> connection to the resolver? What domain name is in the certificate and how
> does the client learn that domain name?
>

https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-04
discusses
mechanism to automatically bootstrap endpoints to discover and authenticate
DoT/DoH servers provided by a local network. The client securely learns the
domain name and DNS server certificate.

Cheers,
-Tiru


>
> -Ekr
>
>
>
>
>> This is distinct from choosing a DNS vendor.
>>
>> thanks,
>> Rob
>>
>>
>>
>> --
> Add mailing list
> Add@ietf.org
> https://www.ietf.org/mailman/listinfo/add
>

v2.23.0 | Report a Bug | By Email