Re: [Add] Food for thought?

[Mohit Sethi M <[e-mail]>]

My comment maybe somewhat misleading and might be interpreted as if I am against forming this working group. That is certainly not the case. I would like to see this working group formed and would be happy to review/contribute as we proceed.

As a more concrete suggestion, perhaps the following bullet in the current charter text could be better explained:


- define a mechanism that allows clients to discover DNS resolvers,
including encrypted DNS servers, that are available to the client
either on the public Internet or on private or local networks;

Rather than distinguishing between private/local networks vs. Internet, it could distinguish home/enterprise networks or whether infrastructure is available to aid the discovery or not. For example, some enterprise networks may have servers (such as a Windows Active Directory Domain Service) to help assist in the discovery of DNS resolvers. This would not be possible in many home networks on the other hand.

--Mohit

On 1/21/20 3:09 PM, Mohit Sethi M wrote:

Hi all,

I took time to study some of the email discussion (albeit not all). I made sure to carefully read the proposed charter text written by Tommy: https://mailarchive.ietf.org/arch/msg/add/yFOsdTOf6VfNzsHPUbuFfQ5URzw.

As security folks, many of us inadvertently solve our problems by making them someone else's. A very naive example of this would be that we solved the key exchange problem of symmetric keys by making it a key distribution problem with public-key cryptography. I know that we shouldn't really discuss solutions when formulating the charter. However, I suggest that we use this opportunity to discuss the starting assumptions for a client to securely discover DNS resolvers.

Some of the proposed solutions that I looked at rely on an another trusted server in the network to provide information about DNS resolvers. And how do I discover that trusted server?, well of-course, mDNS. I would like us to solve real problems and not make cyclical dependencies (knowing that solving real problems is hard and time-consuming). I would also like to understand what type of networks are in scope? Assuming a trusted server in the local network to inform me about candidate DNS resolvers is certainly not likely in many/most home networks?

--Mohit

On 1/18/20 4:20 AM, Rob Sayre wrote:
On Fri, Jan 17, 2020 at 7:28 AM Paul Hoffman <[e-mail]<mailto:[e-mail]>> wrote:

This proposal rules out any solution that does not mandate the client (such as an operating system) having an up-to-date set of cryptographic trust anchors (such as the web PKI or other crypto initialization by vendors). It would hobble discovery in many of the common cases that have been discussed, such as my laptop in my home using my ISP's resolver. If that type of hobbling is what this group wants, go for it...

What is the improvement such a group would miss out on?

thanks,
Rob