Re: [dns-privacy] Fwd: New Version Notification for draft-ghedini-dprive-early-data-01.txt

[Alessandro Ghedini <[e-mail]>]

On Tue, Jul 09, 2019 at 10:25:15PM -0400, Ben Schwartz wrote:
> Thanks for writing this up.  Your recommendation makes sense to me, and I
> think it will be useful in practice.
> 
> One thought: instead of rejecting unsafe 0-RTT data with FormErr, could we
> tell servers to reject the early data at the TLS layer to force a
> retransmission?  That seems like it might be simpler to implement on both
> sides, and just as safe.

The problem is that the decision of whether you accept or reject early data
happens before the application had a chance of actually reading it, so you don't
know whether a specific DNS query can be allowed before deciding to reject all
of the early data. Also, there could potentially be multiple queries in the
early data.

HTTP solved this by defining a special HTTP status code that instructs the
client to retry only the affected request(s), so the server could, after
accepting early data at the TLS layer, execute some of the early data requests
but not all of them. Maybe we could do something similar with extended DNS
errors (draft-ietf-dnsop-extended-error)? Though I don't know how useful this
would be in practice.

Cheers