Re: [DNSOP] extension of DoH to authoritative servers

[Paul Vixie <[e-mail]>]

Ted Lemon wrote on 2019-02-12 13:00:
> ...
> 
> I still feel like we are talking past each other.
> 
> What I am saying is that there are a set of different mechanisms, all of 
> which use port 443, in order to avoid being subjected to your control 
> plane.   DoH is in principle one of these.   We do not disagree about 
> this, as far as I can tell.
> 
> What I think we differ on is the idea that, in the absence of these 
> “political tacticians” of whom you speak, that this problem would not exist.
> 
> What I am trying to point out is that the situation with DoH is a 
> symptom of the problem you are not talking about, not the only instance 
> of it.
> 
> You seem to be asserting that DoH is special among all other misuses of 
> port 443.   But you haven’t explained why it is special.   This is what 
> I was trying to tease out with my initial response to what you said.

i may have been too brief. however, i reject this false equivalence.

when a new flow or pattern of flows shows up to distant tcp/443 
responders, this is detectable. if what's detected exceeds thresholds, 
or if it is found to coincide with any other behaviour change, then it 
can be investigated, and perhaps made the subject of new policy. no 
security is perfect and we can't demand it. what we have is temporary 
equilibriums that appropriately match investments and known risks.

DoH _specifically_ evades this, by looking as much as possible like 
other traffic to IP addresses shared by a lot of existing traffic. this 
means the only way to maintain the risk:cost balance of pre-DoH is to 
inspect every flow. many network operators can't afford this or can't 
otherwise do it. those who can and do, can be expected to be grumpy 
about it having their risks and costs increased for political reasons. 
those who can't or don't, can be expected to be grumpy about losing more 
of what little control or visibility they had, for political reasons.

google, ibm, cloudflare, cisco, and other so-called "public dns" 
providers will at some point choose whether to offer DoH from shared 
addresses, making those shared addresses into risks that the rest of us 
have to manage differently; or whether to dedicate DoH to well known 
addresses that can be outright blocked. in the later case, existing 
anomaly detection and post-facto investigations and policy shifts will 
continue to be good enough.

and that's why DoH is special.

(five paragraphs elided.)

-- 
P Vixie