Re: [dns-privacy] Intermediate proposal (what I was saying at the mic)

In my view,

1. We should provide guidance on how to do unauthenticated DoT/Q using
default-port probing, like we used to have in
https://datatracker.ietf.org/doc/html/draft-ietf-dprive-opportunistic-adotq-00
.

2. Publishing a SVCB record should indicate support for authenticated
encryption.  Nameservers that don't support authenticated encryption can
offer opportunistic encryption based on default-port probing.

3. We should allow nameservers to indicate support for authentication via
common PKI, DANE, or both.

4. SVCB and TLSA records are a firm promise, but resolver behavior is
always up to the operator.  They can choose whether to "fail closed", skip
authentication, fall back to UDP, etc.

On Mon, Aug 2, 2021 at 9:11 AM Eric Rescorla <ekr@rtfm.com> wrote:

>
>
> On Sun, Aug 1, 2021 at 9:22 PM Martin Thomson <mt@lowentropy.net> wrote:
>
>> On Fri, Jul 30, 2021, at 06:08, Eric Rescorla wrote:
>> > - Recursives can attempt to connect to any authoritative by probing
>> >   with DoT/DoQ [0]. In this case, they should cleanly fall back to
>> >   Do53 on connect failure and not validate the credential (whether
>> >   WebPKI or DANE) This allows authoritatives to just turn on TLS
>> >   without risk.
>>
>> I assume that your MUST NOT validate here only exists because of the
>> combination of:
>>
>> 1.  Us not being able to decide between Web PKI and DANE; and
>>
>
> Largely, though it also allows for incremental rollout and a new auth
> mechanism.
>
> 2.  The potential for an unauthenticated mode.
>>
>> If we decided on a single answer for the first and in the negative for
>> the second, would that make authentication viable?  Or is the opportunism a
>> feature?
>>
>> _______________________________________________
>> dns-privacy mailing list
>> dns-privacy@ietf.org
>> https://www.ietf.org/mailman/listinfo/dns-privacy
>>
> _______________________________________________
> dns-privacy mailing list
> dns-privacy@ietf.org
> https://www.ietf.org/mailman/listinfo/dns-privacy
>

Re: [dns-privacy] Intermediate proposal (what I was saying at the mic)

Attachment: smime.p7s