Re: [Add] fixing coffee shop brokenness with DoH

[Brian Dickson <[e-mail]>]

On Wed, Jul 24, 2019 at 9:15 AM Eric Rescorla <[e-mail]> wrote:

>
>
> On Wed, Jul 24, 2019 at 3:54 AM Ted Lemon <[e-mail]> wrote:
>
>> On Jul 24, 2019, at 6:40 AM, Eric Rescorla <[e-mail]> wrote:
>> >> In many cases, whether you are being told the truth by your recursive
>> resolver is a less interesting property than whether you can get the
>> correct answer. For instance, if the recursive resolver replaces the A
>> record you want with NXDOMAIN even if you know that it's done so, you're
>> still blocked from going where you wanted to go.
>>
>> However, even if you are not blocked, without DNSSEC you do not know that
>> the resolver gave you the right answer.  So ideally you want both: not to
>> be blocked, and also to be able to validate the result you got.
>>
>
> Well, this is true, but in the Web context, as we move towards 100% HTTPS,
> the importance of getting the right IP starts to decrease quite a bit: if
> you get the wrong IP address, then this turns into a connection failure.
>
> -Ekr
>

This is an important assertion that requires refutation: this is incorrect.

The importance of the correct IP is essential, because of the relatively
weak system under which TLS certificates are (or can be) issued.
While individual CAs may be extremely trustworthy, there has been instances
of other CAs (retrospectively discovered as being untrustworthy) issuing
TLS certificates to parties other than the domain owner.

This is why DNSSEC, and DANE, are an important mechanism available for
strengthening certificate/browser security.

DANE allows domain owners to securely link a specific CA or specific
certificate to a domain name.

Only with DNSSEC and DANE, is it true that the IP address being wrong would
a connection failure be guaranteed to occur.

That is, in fact, one of the underpinnings for why bad actors have an
interest in altering DNS caches to provide forged IP addresses.

Thus, I assert that not only is DANE not strictly orthogonal, it is an
essential part of securing the web, along with DNSSEC.

This is true even in a 100% HTTPS environment. The security of DNS as
provided by DNSSEC is both orthogonal to, and more important than, the
privacy of DNS recursive queries, when it to achieving that 100% HTTPS
environment.

Brian