Re: [dns-privacy] Root Server Operators Statement on DNS Encryption

[Bill Woodcock <[e-mail]>]

> On Mar 31, 2021, at 10:51 PM, Rob Sayre <[e-mail]> wrote:
> 
> 
> 
> On Wed, Mar 31, 2021 at 1:29 PM Bill Woodcock <[e-mail]> wrote:
> 
> 
>>> > On Mar 31, 2021, at 9:55 PM, Rob Sayre <[e-mail]> wrote:
>>> > I still don't understand the resistance here. Some data on what the impact would be still seems like the most helpful thing to move the conversation forward.
>>> 
>> We have that:
>> 
>> https://vaibhavbajpai.com/documents/papers/proceedings/dot-pam-2021.pdf
>> 
> That paper is about home measurements, and says:
> 
> "Previous work [8,17,26] has studied the support and response times of DoT (and DoH). However, the studies performed response time measurements from proxy networks and data centers, which means that results might not appropriately reflect the latency of regular home users...”

…and it’s measuring latency rather than server-side load.  I just checked with our engineers, and it sounds like the server load per-query is more like 3x-5x higher for the encrypted queries.

> only measures DoT, rather than the more popular DoH.

DoH isn’t that much worse than DoT from a load perspective, but it's a web-browser thing…  It’s difficult for me to imagine anyone with enough clue to operate a recursive resolver wanting to use DoH to query an authoritative server.  What would be the point?

>> Could you state the problem that’s being solved?
>> 
> Sure, it's in the first sentence of https://tools.ietf.org/html/draft-ietf-dprive-opportunistic-adotq-00:
> 
> "A recursive resolver using traditional DNS over port 53 may wish instead to use encrypted communication with authoritative servers in order to limit passive snooping of its DNS traffic."

Right, so that just means the wording of the draft is over-broad, in that it just says “authoritative” rather than “authoritative SLD” or something.  It’s quite a stretch to think that anything sensitive would be disclosed between a well-behaved recursive and a _root_ server, since it doesn’t disclose either the individual nor the domain being queried.

So, again, what problem would be solved?

                                -Bill