[Add] Food for thought?

[Mohit Sethi M <[e-mail]>]

Hi all,

I took time to study some of the email discussion (albeit not all). I made sure to carefully read the proposed charter text written by Tommy: https://mailarchive.ietf.org/arch/msg/add/yFOsdTOf6VfNzsHPUbuFfQ5URzw.

As security folks, many of us inadvertently solve our problems by making them someone else's. A very naive example of this would be that we solved the key exchange problem of symmetric keys by making it a key distribution problem with public-key cryptography. I know that we shouldn't really discuss solutions when formulating the charter. However, I suggest that we use this opportunity to discuss the starting assumptions for a client to securely discover DNS resolvers.

Some of the proposed solutions that I looked at rely on an another trusted server in the network to provide information about DNS resolvers. And how do I discover that trusted server?, well of-course, mDNS. I would like us to solve real problems and not make cyclical dependencies (knowing that solving real problems is hard and time-consuming). I would also like to understand what type of networks are in scope? Assuming a trusted server in the local network to inform me about candidate DNS resolvers is certainly not likely in many/most home networks?

--Mohit

On 1/18/20 4:20 AM, Rob Sayre wrote:
On Fri, Jan 17, 2020 at 7:28 AM Paul Hoffman <[e-mail]<mailto:[e-mail]>> wrote:

This proposal rules out any solution that does not mandate the client (such as an operating system) having an up-to-date set of cryptographic trust anchors (such as the web PKI or other crypto initialization by vendors). It would hobble discovery in many of the common cases that have been discussed, such as my laptop in my home using my ISP's resolver. If that type of hobbling is what this group wants, go for it...

What is the improvement such a group would miss out on?

thanks,
Rob