Re: [dns-privacy] Possible use case: Opportunistic encryption for recursive to authoritative

"John R. Levine" <> Thu, 06 August 2020 19:45 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id C670D3A0E45 for <>; Thu, 6 Aug 2020 12:45:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.1
X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Kt_6NDvI1D00 for <>; Thu, 6 Aug 2020 12:45:02 -0700 (PDT)
Received: from ( [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id ABC633A0E44 for <>; Thu, 6 Aug 2020 12:45:01 -0700 (PDT)
Received: (qmail 19668 invoked from network); 6 Aug 2020 19:44:59 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple;; h=date:message-id:from:to:subject:in-reply-to:references:mime-version:content-type; s=4cd1.5f2c5dbb.k2008;; bh=Ee1tAaHZpaxo7IMw9Al9ohXYcU66js7bInGZ2Ef7hRQ=; b=uxjKHuxpxAMqrzko3fvrRFUxIC1csKVoJ+HX6YJuM7fZxtj7p7SpvfN4yl+K3Vo/cRLSBfekPAhsm7z2QMX/bcQY7A+gbxOJW9HOJn/Fg01y44O/MtiIolLLdOuhDlCg1DIB5dByKpf/VC7MBfEL1+/13HQt575jiMxbnvKzH7h6yAmNMk1ESaRm9pYXGsy1Vym5NWaoXkLrIddxJbPUIgu9n+Mh6iEo8LHpNSFuzUuJCQA119q5WS+Sgjg1146hn6wkuYv0ZaPAzFyWu3LAvlLocV1C0fQc/2v598obGTFNZcYv+Hrye4Ro8c6lTc+FLiUynfw/NZ7qlpfFK9QCEw==
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPSA (TLS1.3 ECDHE-RSA AES-256-GCM AEAD, via TCP6; 06 Aug 2020 19:44:59 -0000
Date: Thu, 06 Aug 2020 15:44:58 -0400
Message-ID: <>
From: "John R. Levine" <>
To: Paul Hoffman <>, "" <>
In-Reply-To: <>
References: <>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-1599479388-1596743099=:22026"
Archived-At: <>
Subject: Re: [dns-privacy] Possible use case: Opportunistic encryption for recursive to authoritative
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 06 Aug 2020 19:45:04 -0000

Yes, this is worth doing.  Agree with comments that it has to be 
compatible with non-opportunistic encryption.


PS: RFC 7435.

> Greetings again. The following is a short text-based version of my slides from last week's WG meeting. I'd like to find out if this is one of the use cases that the WG would be interested in dealing with.
> Use case: Opportunistic encryption for recursive to authoritative
> In this use case, a resolver operator says “I’m happy to use encryption with the authoritative servers if it doesn’t slow down getting answers by much”, and an authoritative server says “I’m happy to use encryption with the recursive resolvers if it doesn’t cost me much”.
> Opportunistic encryption is defined in RFC 7535. From the abstract: "Protocol designs based on Opportunistic Security use encryption even when authentication is not available, and use authentication when possible, thereby removing barriers to the widespread use of encryption on the Internet."
> The assumptions behind the use case are:
> • More encryption is good for the Internet
> • Resolver vendors are smart and motivated
> • Most resolvers don’t validate with DNSSEC and may never want to
> • Authoritative operators don’t care much about encryption, but some would turn it on because more encryption is good for the Internet
> • Other use cases for authentication stronger than opportunistic may appear and would co-exist with this one
> The other slides had thoughts about possible solutions that implement this use case, but before we go there, I wanted to find out if more than a handful of people here are interested in this use case. If so, I could turn the above into a draft with some possible solutions for us to bang on.
> --Paul Hoffman

John Levine,, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail.