Re: [Add] data integrity and DNSSEC or DoH/DoT

[David Conrad <[e-mail]>]

Stephen,

On Aug 21, 2019, at 2:47 PM, Stephen Farrell <[e-mail]> wrote:
>> DNSSEC and DoH/DoT are not different paths to the same end goal of
>> data integrity. They provide different flavours of data integrity.
> 
> I don't agree that the goals are precisely the same as the
> actors involved in providing the security services differ.
> There's a lot in common, but they aren't identical.

You appear to be agreeing with Jim.

DNSSEC provides data integrity _for what the zone authority put into the zone_, regardless of how it gets to the client.

A TLS channel between a client and a resolver (DoH or DoT) provides data integrity and confidentiality (and _resolver_ origin authentication)  _for what the RESOLVER chooses to serve_.

DoH _will not help_ if the “trusted” resolver is compromised to modify the response (something I suspect concentrating the resolver function will encourage).  DNSSEC would help that particular attack.

My response to Ted that caused me to get sucked into this particular swamp (something I already regret) was merely trying to point out there is a significant difference there.

I hope that clarifies.

Regards,
-drc