Re: [Add] Draft Posting: CNAME Discovery of Local DoH Resolvers

[Eric Rescorla <[e-mail]>]

On Fri, Jul 3, 2020 at 5:39 PM Puneet Sood <[e-mail]> wrote:

> > So, if we are to have unauthenticated discovery of Do[TH] servers,
> > then we must have some other threat model. For instance we might
> > think that the attacker can read all packets but for some reason
> > can't impersonate the DHCP server. What I'm saying is that we should
> > start by laying out what that threat model is and then we can define
> > what, if any, technical measures add security benefit in that threat
> > model. That would be true even if we knew that there weren't
> > middleboxes which tampered with new record types.
>
> From RFC 3552, the threat model for unauthenticated discovery would be
> passive attacks described in section 3.2. There is benefit to
> upgrading from Do53 to Do[TH] even if the network between the client
> and the DHCP server is secure - specifically when the DNS resolver is
> further away on the network. This could be because the network
> operator is running the DNS resolver further away (e.g. DHCP could be
> on the home router for a typical home user) or the DNS resolver
> specified by the ISP is operated by a third-party on a different
> network.
>

Puneet,

Thanks for your response.

This certainly seems like a reasonable threat model. However, if this *is*
your threat model,
then it seems like it would be rather easier to just have the gateway
router just proxy
to the actual resolver over a secure channel. This would have several
advantages:

1. It would not require defining any new discovery protocol.
2. It would work with any client, even older, non-upgradeable ones.
3. It would allow the gateway router to inspect the traffic and perhaps do
filtering/monitoring/etc.
(This last one seems like it's arguably not an advantage but given that
that device can insert
itself in the middle anyway....)

-Ekr