Subject: [dns-privacy] Re: [DNSOP] Re: Proposal for opportunistic transport signaling from authoritative servers
From: Peter Thomassen <[email-masked]>
To: Ben Schwartz <bemasc=[email-masked]>, Joe Abley <jabley=[email-masked]>
Cc: Johan Stenstam <[email-masked]>, Working Group DNSOP <[email-masked]>, "[email-masked]" <[email-masked]>,Erik Bergström <[email-masked]>, Leon Fernandez <[email-masked]>
Date: Tue, 8 Jul 2025 23:39:04 +0200
List-Id: Addition of privacy to the DNS protocol <dns-privacy.ietf.org>

On 6/24/25 21:37, Ben Schwartz wrote:
> 1. An attacker could strip the SVCB record and its RRSIG, resulting in an ordinary delegation response that would be accepted and used without encryption.

While that is true, the same attacker can also prevent RFC9539-style opportunistic probing, by blocking the port or sending weird traffic. If that's deemed an OK threat model (for opportunistic encryption), I think the same applies here.

Also, such stripping is more easily observable via standard DNS queries (and looking for the additional SVCB record, e.g., using RIPE ATLAS).

It may be more difficult to directly compare reachability of port 853 from other vantage points, both because other network reasons may be at fault, and because the observer needs more capabilities (does RIPE ATLAS support that?).

Peter