Re: [dns-privacy] [Ext] Possible use case: Opportunistic encryption for recursive to authoritative

Paul Hoffman <> Wed, 12 August 2020 16:00 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BD1923A1384 for <>; Wed, 12 Aug 2020 09:00:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id qxX_FT0l3J2j for <>; Wed, 12 Aug 2020 09:00:58 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 7DE633A1383 for <>; Wed, 12 Aug 2020 09:00:58 -0700 (PDT)
Received: from ( []) by ( with ESMTPS id 07CG0vUj023050 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 12 Aug 2020 16:00:57 GMT
Received: from ( by ( with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.595.3; Wed, 12 Aug 2020 09:00:56 -0700
Received: from ([]) by ([]) with mapi id 15.02.0595.003; Wed, 12 Aug 2020 09:00:56 -0700
From: Paul Hoffman <>
To: Vladimír Čunát <>
CC: "" <>
Thread-Topic: [Ext] [dns-privacy] Possible use case: Opportunistic encryption for recursive to authoritative
Thread-Index: AQHWcMHDNX4qlEKCFU+WXt8QTIh29Q==
Date: Wed, 12 Aug 2020 16:00:56 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
x-originating-ip: []
x-source-routing-agent: Processed
Content-Type: multipart/signed; boundary="Apple-Mail=_876E666D-CD8D-4AAC-98BF-92203F99C154"; protocol="application/pkcs7-signature"; micalg="sha-256"
MIME-Version: 1.0
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.235, 18.0.687 definitions=2020-08-12_09:2020-08-11, 2020-08-12 signatures=0
Archived-At: <>
Subject: Re: [dns-privacy] [Ext] Possible use case: Opportunistic encryption for recursive to authoritative
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 12 Aug 2020 16:01:00 -0000

On Aug 12, 2020, at 5:44 AM, Vladimír Čunát <> wrote:
> On 8/6/20 4:59 PM, Paul Hoffman wrote:
>> In this use case, a resolver operator says “I’m happy to use encryption with the authoritative servers if it doesn’t slow down getting answers by much”, and an authoritative server says “I’m happy to use encryption with the recursive resolvers if it doesn’t cost me much”.
> This motivation confuses me a bit, but perhaps it's just me.  I'd expect
> the extra performance costs to be quite close to authenticated
> encryption, at least in principle.  

Yes, definitely.

> And the extra privacy gain feels
> relatively small in comparison.

The privacy gain is preventing passive snoopers from being able to see the traffic. That seems important to some people, not to others.

> In any case, there may be other common motivations for going
> opportunistic.  For example the fact that for years we don't seem to
> really move towards consensus about how exactly the authentication could
> be done, but that motivation would be incompatible with desires like
> developing these two approaches together - and I must admit I'd really
> like to minimize incompatibility among the future approaches (DoT and
> DoH come into mind).

That's exactly why the use case included:

> • Other use cases for authentication stronger than opportunistic may appear and would co-exist with this one

As folks with other use cases for authenticated (normal!) encryption clarify their use cases, nothing in the opportunistic use case should make their work any harder.

--Paul Hoffman