Re: [Add] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Paul Vixie <[e-mail]>]

On Friday, 26 June 2020 22:08:05 UTC Eric Rescorla wrote:
> ... Other than inelegance, what's problematic about the CNAME approach?

inelegance is permanent, accretive, and earns compound interest. we ought not 
dismiss inelegance as the basis for reluctance. inelegance is not inevitable 
nor is it automatically acceptable.

> ...
> 
> The scenario you seem to be interested in is one in which the user joins
> the network and then learns that the associated Do53 resolver supports DoH
> and then connects to it with whatever coordinates that resolver (or DHCP or
> whatever) provides. That clearly is not useful in the 3552 threat model
> which assumes that the attacker entirely controls the network because the
> attacker can just send their own resolver coordinates. That isn't to say
> that there aren't more limited but still realistic threat models where this
> would be useful, but I think you should start by describing those.

as we describe them, we should also describe their scale, their age, and their 
likely lifespan. the 3552 threat model, while it does use the term 
'pervasive', is nowhere near as common as the SASE (secure access service 
edge) operations model, nor will it ever be. if apps who want to do their own 
DNS treat any DoH failure as an attack, and start an arms race of spy-vs-spy 
bypass along the lines of Tor, that's going to feel problematic to any of us 
whose privately owned securely operated edge networks have a local-only DNS 
policy.

RESINFO could probably get better results by using TXT, because of long tail 
problems. but ultimately we have to pick a default assumption that we can act 
on when secure resolver discovery fails. "OMG it's a 3552 attack" is not the 
only interpretation we could think of for this. it's entirely possible that 
the most engineering solution to the discovery problem is to fail hard when 
the middlebox prevents authenticated policy negotiation, to force middlebox 
upgrades. i know that "tough love" is a hard sell, but "assume 3552 attack" is 
also a form of tough love.

-- 
Paul