Re: [Add] draft-ietf-add-resolver-info-09

[Mark Andrews <[e-mail]>]

If a recursive server passes through a response with AA=1 it is broken. If a recursive  server forwards a query with RD=0 it is broken.  If a “recursive server” is just forwarding queries and responses the attacker will just put the response in the authority section.  The change of section provides no security. It doesn’t prevent problems. It is just change for changes sake. 

-- 
Mark Andrews

> On 21 Feb 2024, at 06:30, Steffen Nurpmeso <[e-mail]> wrote:
> 
> tirumal reddy wrote in
> <[e-mail]>:
> |On Thu, 15 Feb 2024 at 06:02, Mark Andrews <[e-mail]> wrote:
> |> Why is it necessary to change the standard processing of queries for
> |> RESINFO when we already have a signal (AA=1) about whether the answer
> |> is coming from elsewhere or not ?
> |
> |It is introduced to handle a scenario where SUDN is used to discover the
> |encrypted resolver, and if the discovered resolver does not support
> |RESINFO, it will forward the query upstream. An attacker might provide a
> |RESINFO response with AA=1. The proposed mechanism aims to help the client
> |identify whether the response is coming from the discovered encrypted
> |resolver.
> 
> By the way i am really not worth being noted for anything
> acknowledgeable regarding the work of this WG.  At all.
> If you have another iteration of the document, i would prefer if
> you would simply scratch my name from your work.
> It is solely your work, for sure.
> And the above is possibly very smart: my DNS work was two decades
> ago, and i could not even tell whether i have ever seen authority
> section entries being passed through or not.
> 
> My main topics are simplicity so small teams can still exist
> competetively as was true over two decades ago (ie, with knowing
> the entire picture, not by delegating to "trusted" external
> modules in uncounted numbers), when there were <3000 RFCs.
> 
> As such i very much appreciated RFC 8499, but i alone from my
> superficial out-of-interest reading have 17 DNS-related RFCs
> added locally since then, plus the draft of yours and whatever
> else from this WG.
> 
> And a different way to get the TLS trust (or, rather, use existing
> ways of various kind eg rpki, ikev2, or simply public keys as is
> done by DKIM (certificates are a bit larger, but with the TCP that
> is more and more needed per se, or QUIC; or even the permanent
> HTTP proxying of everything, that is "no problem")) away from CA
> pools, to DNS/TLS + DNSSEC zone records.  Thank you for that, too!
> 
> Ciao, and greetings from Germany,
> 
> --steffen
> |
> |Der Kragenbaer,                The moon bear,
> |der holt sich munter           he cheerfully and one by one
> |einen nach dem anderen runter  wa.ks himself off
> |(By Robert Gernhardt)